# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 3 Systematic Literature Review
### Analysis of Selected Results  
We next comment the selected papers and conduct an in-depth analysis outlining the major strengths and relevant considerations for tackling risks in IoT/MIoT ecosystems. The number of included studies is low because, after executing all of the PRISMA procedure, it favours quality over quantity, i.e., we will retrieve and scrutinise only the most relevant results aligned with the SLR's research question. \begin{table}
\begin{tabular}{c l l l} \hline \hline \# & **Authors** & **Domain** & **Highlights** \\ \hline \#01 & [PERSON] et al. (2020) [80] & IoT, MIoT & Showcases RA frameworks in IoT, computes MIoT risk, IoT risk vectors and risk ranking \\ \hline \#02 & [PERSON] (2020) [58] & IoT & Proposition of a four-layer IoT cyber risk management framework, risk identification, quantification \\ \hline \#03 & [PERSON] et al. (2021) [81] & MIoT & Dynamic agent-based risk management, generic case studies in IoT/MIoT, enhance trustworthiness of MIoT \\ \hline \#04 & [PERSON] et al. (2021) [16] & MIoT & SLR, discussing risk assessment frameworks in MIoT, comments on “medical risk” and risk methods \\ \hline \#05 & [PERSON] et al. (2018) [75] & IoT, MIoT & Methodology uses attack model to output qualitative criticality level of IoT-enabled devices \\ \hline \#06 & [PERSON] et al. (2021) [57] & MIoT & Focus on security and privacy of MIoT, CIA, resilience, access control, usability, data issues \\ \hline \#07 & [PERSON] et al. (2022) [82] & IoT & Risk assessment focused on NIST Cyber Security Framework using self-assessment survey instruments \\ \hline \#08 & [PERSON] et al. (2021) [83] & IoT & Discusses the benefits of fault-tolerant designs to improve security, a survey of known attacks in IoT \\ \hline \#09 & [PERSON] et al. (2020) [84] & IoT & Use of known methods to address risk, e.g., design space exp. (DSE), Bayesian attack graphs, risk trees \\ \hline \#10 & [PERSON] (2020) [23] & IoT & Combination of risk assessment framework with security incident and event management altogether \\ \hline \#11 & [PERSON] et al. (2017) [40] & IoT & Describes core RA concepts in IoT, Comments on deficiencies of RA approaches and their inadequacy \\ \hline \#12 & [PERSON] et al. (2018) [41] & IoT & Discusses the need for automated and collaborative RA in IoT, with industrial comments and practices \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Overview of selected literature on RA/DRA in IoT/MIoT. **#01** by [PERSON] et al. (2020) [80] comments on IoT-based vulnerabilities, such as complex architecture, inappropriate security configuration, physical security, and insecure firmware or software; it discusses how to address computation of cyber-risk referring to risk ranking, risk vectors, and risk assessment frameworks. The work tackles known impact factors, likelihood, and risk levels in IoT and comments on the risk assessment process (RAP) of known standards, such as NIST, ISO/IEC, OCTAVE, GSMA (It is called the Self Assessment Risk Management Toolkit, link: [[https://www.gsma.com/mobilefor](https://www.gsma.com/mobilefor)]([https://www.gsma.com/mobilefor](https://www.gsma.com/mobilefor)) development/resources/self-assessment-risk-management-toolkit-summary/, accessed on 19 June 2023) (based on OCTAVE), and threat assessment and remediation analysis (TARA). It compares various RA frameworks specifically for IoT, computing the MIoT risk for medical devices and discussing RA scales and rankings. It comments on known IoT risk vectors and risk rank calculation, devising numerical weights for computing risk likelihood parameters. **#02** by [PERSON] (2020) [58] discusses qualitative, e.g., ISO, cyber kill chain (CKC), OCTAVE, capability maturity model integration (CMMI), and consensus audit guidelines (CAG), as well as quantitative approaches, namely, Bayesian decision network (BDN), AVARCIBER, an extension of ISO 27005, and NIST's approach geared towards cyber security risk management.