# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.4 Identification of Vulnerabilities
Cyber hygiene refers to the regular good practices and mitigation methods that help maintain security, with the lack of cyber hygiene hampering an IoT domain's ability to respond to attacks [85; 86]. Examples of high-risk actions include not changing passwords/usernames [72], the use of unknown public networks [57], and not receiving training when it comes to IoT security [75]. The lack of security knowledge and awareness [39; 60; 67] refers to the potential lack of security knowledge and awareness of a user about IoT security. Users may become vulnerable to cyber threats due to a lack of training, which can prevent them from understanding how to prevent or respond to such threats. This vulnerability also increases the risk of falling prey to social engineering attacks [41; 43; 67], such as phishing, which exploit personal factors to gain access to sensitive information. For instance, a user's emotional state and lack of knowledge regarding social engineering attacks can make them more susceptible to such attacks. Another common high-risk action is the misconfiguration of IoT systems [43; 54; 56; 66], where users configure an IoT system incorrectly or in a fashion that is not secure, for example, not setting up two-factor authentication. Finally, we have the potential misuse of systems [41; 48; 56; 66], which may be intentional with users using a system to perform an attack (e.g., spying or eavesdropping) or unintentional, where users choose to ignore some security mechanisms, e.g., bypassing security processes when using their devices. _Insight 4:_ The main objective of uncovering IoT vulnerabilities is to clearly define exploitable weaknesses that may become an IoT threat event and dealing with these. Within RQ1, we stated that IoT cyber risk management frameworks need to extend existing threats and vulnerabilities to factor in specific IoT elements. A common theme within the surveyed papers is the consideration of human vulnerabilities due to a lack of cyber hygiene. The main benefit of identifying human vulnerabilities is the understanding of human to asset weaknesses that could affect security, something that is especially important in IoT domains with little to no regulations. Discovering the types of high-risk user actions puts focus on basic IoT pracises and easy fixes that can reduce risk, for example, encouraging the use of different passwords/usernames from other accounts [72]. Cyber IoT vulnerabilities can be gathered from knowledge bases, with OWASP, NVD, and the MITRE CVE list being some of the most common. However, these bases are not always applicable to all IoT domains; works like those of [PERSON] and [PERSON] [53; 54] and [PERSON] et al. [52] use proposed classifications to overcome this. Moreover, IoT knowledge bases need to be consciously updated due to new vulnerabilities, with unknown vulnerabilities [62] making it difficult to predict the next IoT weakness. Within the work of [PERSON] et al. [51], the authors define an attack surface as the sum of all exposures to risks, being the set of known, unknown and potential vulnerabilities as explored by [PERSON] et al. [87]. The issue is that unlike traditional IT systems, IoT vulnerabilities (and by extension threats) need to consider non-traditional weaknesses, for example sensor-based attacks and insecure sensor hardware.