# Internet of Things (IoT) Cybersecurity: Literature Review and IoT Cyber Risk Management
## 2 Literature Review
### Literature Review on Cybersecurity Risk Management
#### 2.2.1 Qualitative Approaches to Cybersecurity Risk Management  
There are multiple competing and complimenting risk management frameworks. One of the most popular cybersecurity frameworks is the National Institute of Standards and Technology (NIST) Cybersecurity Framework. This is a high-level and easy-to-read guidance created for organizations to be able to customize [49]. The framework consists of the framework core, the implementation tiers, and the framework profile. The framework core describes five functions of the cybersecurity program. The implementation tiers describe the degree to which an organization's cybersecurity management practices exhibit the specific capabilities of cybersecurity defined in the tiers. An organization can use the framework profile to identify opportunities for improving its cybersecurity status by comparing a \"Current\" Profile with a \"Target\" Profile. While the NIST Cybersecurity Framework explicitly recognizes that the activities associated with managing cybersecurity risk are organization-specific, risk management issues are marginally addressed. ISO/IEC 27005 is a set of standards developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It provides managers with guidelines and techniques for implementing and managing information security risks [50]. While ISO/IEC 27005 provides a structured sequence of activities, it does not directly employ any specific risk management method, and the organization is expected to define their own approach to risk management, depending on the type of information security management system, state of risk management, and/or industry-specific security issues. The seven stages/chains Cyber Kill Chain(r) (CKC) framework is a risk management framework developed by Lockheed Martin [51]. The model analyzes what the cyber attacker would do in order to achieve their objectives and proposes countermeasures the defender must take to break the chain at an early stage as well as in later stages. The framework focuses mainly on the technological side of cybersecurity involving attackers and defenders, but it did not fully address the human and organizational issues in cyber risk such as human mistakes and internal threats. Furthermore, it does not provide any specific guide to cybersecurity investment decisions. Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) is a security evaluation framework developed at the CERT(R) Coordination Center (Pittsburgh, PA, USA) [52]. OCTAVE helps an organization identify and rank key IT assets, weigh threats to those assets, analyze their vulnerabilities and impacts, and develop security priorities to reduce the risk to the IT assets. At the core of OCTAVE is the concept of self-direction with which a small, interdisciplinary team drawn from an organization's own departments leads the organization's evaluation process. The original OCTAVE was updated to OCTAVE Allegro to make the framework easier to implement in an organization [53]. OCTAVE Allegro allows for a broad assessment of an organization's operational risk environment in a workshop-style collaborative setting without the need for extensive risk assessment knowledge. The CMMI Institute's Cybersecurity Platform shares a similar risk management approach with OCTAVE. However, one unique feature of the Cybersecurity Platform is a risk-based roadmap, which is a customized list of action items prioritized based on the risks most relevant to the organization [54]. To develop the risk-based roadmap, the Cybersecurity Platform conducts security gap analysis to measure current maturity versus target maturity and prioritizes security projects based on the organization's cybersecurity risk profiles. The Center for Internet Security (CIS) publishes Consensus Audit Guidelines (CAG) consisting of 20 key actions, which are called critical security controls (CSC), that organizations should implement to prevent or mitigate cyberattacks [55].