# Internet of Things (IoT) Cybersecurity: Literature Review and IoT Cyber Risk Management
## 3 The Four-Layer IoT Cyber Risk Management Framework
### IoT Cyber Risk Assessment Layer
#### 3.3.3 Resource Allocation  
As discussed above, cyberattacks arrive in certain probability distributions (e.g., Poisson probability distribution), and the frequency of penetrated attacks per period is an essential parameter of the resource allocation model. From the defender's side, the defender's goal to increase defense probability will be achieved with a matching investment. The defense probability is binomial (i.e., either success or no success). The defense probability of each IoT asset-vulnerabilities-threat type and the frequency of penetrated attacks together determine the total financial loss of each IoT asset-vulnerabilities-threat type. The frequency of the penetrated attacks (i.e., unsuccessful defense) is measured as \(n^{*}\left(1-p\right)\), where \(n\) is the frequency of attacks in a given period and \(p\) is the defense probability. \(n^{*}\left(1-p\right)^{*}m\) is the total financial loss where \(m\) is financial loss per penetrated attack. As an example, assume that the current defense probability of the IoT asset-vulnerabilities-threat-1 is estimated to be 0.9. Assuming that the current frequency of attacks for the IoT asset-vulnerabilities-threat-1 is 5000/period, and eachpenetrated attack costs $1000. Then, the total financial loss from the IoT asset-vulnerabilities-threat-1 is estimated to be $500,000 (i.e., 5000 * (1 - 0.9) * ($1000).  
One of the challenges in cybersecurity management is the optimal allocation of limited resources among competing IoT asset-vulnerabilities-threats. A cost-benefit model is adopted to determine resource allocation to various IoT asset-vulnerabilities-threats. Organizational resources include labor, IoT assets, and financial resources, and these are translated into monetary terms. This paper uses a linear programming model to optimally allocate financial resources to each IoT asset-vulnerabilities-threat. It is noted that there have not been any resource allocation methods used for cybersecurity investment decisions. The linear programming is an intuitive and logical mathematical modeling technique, and it guarantees optimal solutions under certain financial and operational constraints for many business problems such as budgeting, transportation routing, production scheduling, and investment portfolio management. Given the limited financial resources for cybersecurity management and multiple cybersecurity projects, the linear programming method can serve as an effective decision-making technique.  
Figure 3 illustrates that more financial resource allocation will increase the defense probability from the starting defense probability of 0.9. The horizontal axis represents the defense probability from 0.9 to 0.99. The greater the financial resource allocation, the lower the financial loss will be from the IoT asset-vulnerabilities-threat-1 due to the increase of the defense probability. The total cost is the sum of the financial loss from the penetrated attacks and the allocated cyber investment cost for the target defense probability. In this example, linear curves are assumed for both the financial loss and the cyber investment cost within the range of 0.9 and 0.99. An exponential increase of the cyber investment cost is expected from a defense probability of 0.99 and greater due to the rapid increase of the marginal cost of cyber technologies. In this example, the formula for the financial loss is \(FL=\$500,000-\$5,000,000*(x-0.9)\), where \(x\) is the defense probability. The formula for the investment cost is \(IC=\$3,000,000*(x-0.9)\). The formula for the total cost is the sum of \(FL\) and \(IC\): \(TC=FL+IC=\$500,000-\$2,000,000*(x-0.9)\).  
Figure 2: Example risk matrix.