# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.1 Identification of IoT Assets  
NIST [8] defines _asset identification_ as being the \"use of attributes and methods to uniquely identify an asset\". The identification of assets may take place as part of a context-gathering phase, which supplies the information needed to understand the environment [60] and to provide a detailed architecture of the systems [71]. In the case of an IoT domain, the information provided from the identification of IoT assets and users is integral to ensuring that other risk management phases capture the most accurate results. Despite the similarities between IoT domains, devices operate in diverse ways to achieve different goals. [PERSON] et al. [70] consider this concept by evaluating various IoT domains and proposing the types of assets that may exist in an environment, as well as the fundamental security goals that threats could circumvent. Meanwhile, [PERSON] et al. [49] use ISO/IEC 2700 to analyse IoT risk, using primary and supporting assets that are inputted within a dedicated worksheet with the various related attributes. In the work of [PERSON] et al. [45], an asset assessment phase is used to identify all assets for an organisation, with these assets holding value and nonfunctional properties. Health-related IoT like the Internet of Medical Things (IoMT) aim to automate healthcare-related systems while also improving the level of care for patients. [PERSON] and [PERSON] [64] concentrate on assessing OCARIoT (Smart Childhood Obesity Caring Solution using IoT), a platform that provides an IoT-based system to coach children into adopting healthy eating and physical activity habits. Within the first phase of the model, the IoT domain's context is built, collecting information about assets. As a complement, the second phase builds a data flow diagram, which shows all the points that could be attacked. In the context of wearable health devices, [PERSON] et al. [73] establish that assets and their value must be identified so that the the accuracy of data flow diagrams can be improved, suggesting that rigorous qualitative analysis must be used to assess the value of  
Figure 4: A visual breakdown of the number of papers per IoT risk identification concept. For example, of the 39 collected papers, 22 of them fit into our survey’s identified assets category. assets. In connection, [PERSON] et al. [74] focus on assessing miniaturised wireless biomedical devices and establish a model phase that enumerates protected assets that are tangible or intangible. Smart cities hold a huge amount of data, assets, and users, which can make risk assessment difficult, with a limited number of datasets which can be used. [PERSON] et al. [58] overcome this issue by synthetically creating asset datasets to simulate a large-scale dynamic network. The use of a neural network allows the authors to easily decide the types of assets used, tailored to be smart city specific. Alternatively, [PERSON] et al. [44] focus on critical assets, rather than trying to identify them all. These assets may have a much higher priority due to a higher damage potential, which may propagate within a smart city network. Unlike other IoT domains, smart homes carry more freedoms due to not being bound by legislation, with users utilising devices how they see fit, which can pose a significant risk to personal life. According to [PERSON] [57], one of the most critical security objectives for smart homes is to prioritise the identification of user authorisation, where only specific users should have access to resources. [PERSON] et al. [69] suggest that an asset inventory of IoT devices needs to be created, with this inventory outlining the components of a smart home environment. The creation of such an inventory may be automatic or semi-automatic, and the information required relates to capturing device capabilities, which can be used to derive the impact on security and privacy. [PERSON] et al.