# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 3 Systematic Literature Review
### Analysis of Selected Results
There is a focus on the security and privacy requirements of MIoT, such as confidentiality, data integrity and availability, resilience to attacks, data usability, access control, data auditing/authentication, and privacy of patient information. The work details the MIoT infrastructure comprised of wireless body area networks (WBAN), sensing, cloud, and medical staff, all contributing towards effective patient care. They describe real-time location services (RTL) for IoT devices for tracking employees, patients, visitors, and assets. Finally, they comment on the need to perform regular RA to identify potential risks associated with MIoT. This should be set up and designed to understand vulnerabilities better before the environment becomes operational. **#07** by [PERSON] et al. (2022) [82] focuses on the NIST cyber security framework combined with self-assessment survey instruments for understanding vulnerability and risk. The work refers to vulnerability and threat pairs that produce two other risk indices, risk management culture (RMC) and risk process and technology (RPT), applied to Asia-based healthcare cyber-attacks. The objective was to understand cyber security maturity from a vulnerability and risk perspective in order to compute a so-called enriched vulnerability priority score (EVPS) to prioritise vulnerabilities for managers to consider for counteracting attacks. **#08** by [PERSON] et al. (2021) [83] considers medical standards for cyber security ((IEC 62304:2006, ISO/IEC 27032:2012, IEC 82304-1:2016, ISO/IEC 8001 (Risk Management of Medical Devices on a Network), IEC/TR 80002-1:2009, ISO/TR 800020-2:20017, IEC/TR 80002-3:2014). The authors comment on fault-tolerant designs to harden the infrastructure. The work comprises a survey that provides good explanations and classification of medical concerns employing IoT/IoMT. For instance, the authors suggest the following classification: _non-invasive_ devices, _invasive_ devices (transient use, short-term, long-term and connected), and _active therapeutic_ devices (e.g., muscle stimulators and hearing aids). They offer a classification of sensors in terms of _physiological_ (measure ECG, electromyography), _biological_ (glucose, alcohol), and _environmental_ sensors (accelerometer and gyroscope in smartwatches). In terms of cyber security protections, the work suggests using intrusion detection mechanisms to infer and confirm attacks, fine-grained access controls, privacy-preserving healthcare systems, employing artificial intelligence and machine learning (AI/ML) and big data, and in-depth investigation of smart medical devices and existing threats. **#09** by [PERSON] et al. (2020) [84] presents and explains design space exploration (DSE), Bayesian attack graphs (BAG), and risk trees (RISKEE). The authors provide a design framework to study a system's attack susceptibility to model security constraints. They comment on the need to incorporate RA in early system design and the advantages of drawing upon these choices. The paper showcases examples of limited capacity infrastructure, where they compute attack probabilities and the mean risk value for the setting under study. **#10** by [PERSON] (2020) [23] presents three critical elements for performing thorough RA: (i) cyber security risk assessment framework; (ii) security incident and event management; and (iii) resilience framework. It extends the European Telecommunications Standards Institute (ETSI) risk-based security assessment. It showcases the framework using the following steps: (i) understanding business cases and regulatory contexts; (ii) business processes identification and security requirements; (iii) risk identification, estimation, evaluation and security testing; (iv) assets--cloud web services, IoT devices and networks;and (v) upgrading software modules of end-to-end IoT platforms. This work brings together a risk assessment framework and an SIEM system as a significant contribution. **#11** by [PERSON] et al.