# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 4 Results
### Descriptive Study II
\begin{table}
\begin{tabular}{c|c|c|c|c|c} \hline \multirow{2}{*}{Components} & \multicolumn{5}{c|}{Organization (54.9\%)} \\ \cline{2-6}  & Domains & Pillars & Systems & Security configurations & Vulnerabilities \\ \hline Weight & 30\% & 20\% & 20\% & 10\% & 20\% \\ \hline \multicolumn{6}{c}{Scalability (12.39\%)} \\ \cline{2-6}  & Impact/degradation & P. Occurrence & P.time & P.coverage & Previous Attacks \\ \hline Weight & 40\% & 30\% & 10\% & 10\% & 10\% \\ \hline \multirow{2}{*}{Components} & \multicolumn{5}{c|}{Attack Surface (11.92\%)} & \multicolumn{5}{c}{Susceptibility (6.19\%)} \\ \cline{2-6}  & Number IoT dev. & Threats & Number IoT layers & No extra components \\ \hline Weight & 40\% & 40\% & 40\% & 100\% \\ \hline \multicolumn{6}{c}{Severity (7.18\%)} \\ \cline{2-6}  & Confidenciality & Integrity & Availability & Trazability & Authenticity \\ \hline Weight & 40\% & 20\% & 20\% & 10\% & 10\% \\ \hline \multicolumn{6}{c}{Interdependency (4.52\%)} \\ \cline{2-6}  & Upstream & Downstream & Functional & Geographical & Cybernetic \\ \hline Weight & 20\% & 20\% & 20\% & 20\% & 20\% \\ \hline \multicolumn{6}{c}{Uncertainity (2.9\%)} \\ \cline{2-6}  & \multicolumn{5}{c|}{No extra components} \\ \hline Weight & \multicolumn{5}{c|}{100\%} \\ \cline{2-6} Domain (30 \%) & Economic & Social & Environmental & \\ \hline Weight & 60\% & 25\% & 15\% & \\ \hline \end{tabular}
\end{table} 
Table 8: MCDA to evaluate the security risk value for IoT systems. \begin{table}
\begin{tabular}{c|c|c|c|c|c} \hline \multirow{2}{*}{**IoT System**} & \multirow{2}{*}{**Severity**} & \multirow{2}{*}{**Susceptibility**} & **Risk** & \multirow{2}{*}{**Risk Total (/10)**} \\ \cline{2-4}  & & **0.6** & **0.3** & **0.1** & \\ \hline IoTX & 1.44 & 2.10 & 0.49 & 4.03 \\ \hline IoTY & 0.70 & 0.77 & 0.21 & 1.68 \\ \hline IoTZ & 2.29 & 1.01 & 0.31 & 3.61 \\ \hline \end{tabular}
\end{table} 
Table 9: Screenshot of the application of MCDA to evaluate the risk of three different IoT systems. 1. Organization domain. The domain covers the organizational aspects of the organization (city, campus, enterprise, home) where IoT systems are implemented. The domain includes the evaluation of the security configurations according to policies or regulations related with cybersecurity in the different sectors, such as energy, traffic, health and home. The domain includes the analysis of the vulnerabilities that could affect the compliance of the policies or regulations of cybersecurity. This domain comprises three components: * Pillars: Represents the social, environmental, and economic contexts that encompass IoT systems. * Application domains: Represents the application domains that are covered by the IoT system such as agriculture, health and traffic. * Systems: Includes the IT/OT/IoT systems that support the development of the IoT system, to support the pillars and domains. 2. Dependency/interdependency domain: Include the upstream, downstream, functional, geographic or cyber dependencies that exist between IoT, OT and IT systems. 3. Attack surface domain: Include the natural (earthquakes, floods) and human (cyberattacks) hazards, or failures (configuration errors, system malfunctions) that may affect the operation of IoT systems. It includes the analysis of attacks that may occur in the layers of the IoT system. 4. Susceptibility domain: This domain includes the analysis of factors that could render IoT devices more vulnerable to attacks. 5. Severity domain: This domain includes the analysis of impact on CIA, traceability and authenticity of IoT devices. 6. Risk behaviors domain: This domain analyzes the factors that may affect the value at risk, including: * Impact: Represents the value of damage that an IoT system may suffer because of threats. * Probability: Represents the occurrence that a threat may occur. * Propagation time: Represents the time it takes for a threat to propagate and cause medium or high damage. Figure 20: Framework of security risk components of IoT systems.