# Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey
## 6 Discussion
### Intimacy  
As explained previously, the intimate nature of the relation between user and device gives way to many privacy-related challenges. With increasing large scale applications, such as smart cities collecting and manipulating personal information as described in [119], private data is increasingly at risk of exposure. For example, personal data is being used more for independent third party services, such as logging into a website using a social media account, sharing the data between the two platforms. This sharing although granting authentication to the user, increases the chances of a privacy leak.  
As such, many IoT Intimacy related challenges evolve around how such data is captured as well as how it is used and shared [120]. With biometric and GPS chips in many portable IoT devices, users are able to be identified as well as localised and even tracked with or without their knowledge. Furthermore, with increasing devices sharing our day to day lives, they are capable of capturing and correlating large quantities of data, effectively generating an identity profile of the user.  
This can, in turn, be exploited to specifically target the user's interests, as with targeted advertisements, or even to use social-engineering techniques to infiltrate IT systems. These are significant privacy issues where data is being captured and used without the users knowledge or express authorisation, and even, in some cases, the data is sold to another entity, once again forming a significant breach of privacy, As such, a significant challenge towards IoT intimacy and privacy is to find the middle ground between capturing, sharing, and using sensitive data; and their protection.  
Mobile  
One of the final features of IoT networks is the mobility of devices. Although this mobility grants many possibilities, it also raises some security challenges concerning its operability. For example, moving can cause a device to disconnect from a known domain and connect to another, previously unknown. Thus, the device needs to be verified before allowing access to the network as well as granting it various permissions to interact with the network services.  
However, verifying devices and deciding the correct permissions is a difficult task, since identifying a device as legitimate is an ongoing challenge in multiple areas. Furthermore, not only must the devices identity be verified but also any data it carries must be secured when switching network domains since confidential material may be present. As such, data confidentiality must be maintained and, in the case of data encryption, key negotiation must be secured.  
Ubiquitous  
The threats towards the \"Ubiquitous\" nature of IoT devices as presented by the authors of [14] generally revolve around human error. As such, there are no specific challenges towards such a feature since human error is inherently inevitable. Many of these errors are the result of accidental manipulation or configuration due to a lack of education and awareness, a notion that is examined in [57].  
That being said, certain steps can be taken to help limit these risks, such as manufacturer and professional operator training to reduce the possibility of misconfiguration. However, when it comes to the general consumer, such training is not possible. The only option is risk sensitiation through professional workshops to sensitize during work hours, or to include basic security awareness sessions into a university or high-school curriculum.