# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 4 Challenges in Performing Risk Assessment in MIoT
### Particularities of IoT Relevant to RA  
One key issue in any RA concerns its _quantification_. NIST suggests using qualitative metrics (i.e., low, medium, high) when addressing likelihood and impacts in risk models [40], which risks multiple interpretations and abstractions and a lack of precision as managers might consider different aspects when determining perceived risks associated with threats. Current RA approaches might fail in IoT due to this dynamic nature, as prior assessments could quickly become obsolete when new devices emerge in networks with different requirements, technologies, objectives, and capabilities. As pointed out in a previous study [40], an effective RA requires predicting devices that could ingress into networks before the assessment, which is highly challenging. A round of discussion with professionals in the industry on the benefits and shortcomings of RA in IoT unveiled interesting points [41], including the following:  
* Incorporate security in early designs through effective shift-left approaches within DevOps [94], i.e., addressing security-related concerns since system specification. * Quantification of risk is not trivial to accomplish, as the industry still favours qualitative measures (e.g., low, medium and high, as suggested by NIST). * Careful thinking on how to balance dynamism, automation and human aspects when enacting effective RA in complex environments characterised by frequent connection requests and disconnections. * Addressing new emerging risks in partially unknown systems; this occurs when potentially malicious devices participating in the network demand service or interactions to act as stepping stones to larger cyber-attacks. The authors mention in their final remarks one critical point that remains neglected in RA frameworks and methodologies: the industry still believes in the _\"perceived infeasibility of fully automated risk assessment in the IoT\"_, mostly due to the issues raised throughout this paper, namely dynamism and temporality. IoT is a technological solution to address many problems in communicating information across multiple CPS and IS, with applications ranging from industry, healthcare and smart infrastructure, to mention a few. The dynamics and temporality of connections among devices distinguish IoT from other systems and services [95]. Next, we comment on the challenges in highly interconnected networks in IoT/MIoT, including:  
* Quantification of the communication of information to other devices that are aligned with the organisation's risk appetite and its scale when accommodating many interacting devices. * Clear shortcomings of _periodic_ RA that do not account for unknown system boundaries, latest vulnerabilities (as advertised by vendors and security-oriented organisations), and failure to recognise that IoT-based assets are sometimes the initiators or the promoters of larger attacks [41]. * Lack of rigorous _dynamic_ risk approaches [40] that are instead substituted by _periodic_ assessment approaches. * Accounting devices with different capabilities and objectives, i.e., sets requiring connections to happen only once or twice, as well as persistent connections and unsigned devices seeking to connect with signed/authorised devices that represent increases in risk and likelihood of attacks. * Consideration of the heterogeneity of devices interacting in healthcare-related IoT/MIoT ecosystems. * The need for _automated, continuous and collaborative_ RA coupled with supporting tools based on simulation and modelling to enhance the understanding of which new devices might emerge in networks, what they might request or perform, and communication patterns that could be developed through time. The most commonly desired properties of systems deployed to end-users include robustness, resilience (ability to retain operation even in the presence of catastrophic events), performance, and usability. Regarding MIoT, security officers also consider safety, privacy, seamless system-wide integration, and interoperability with other systems.