# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.2 Identification of Users  
Users require protection from IoT cyber attacks to ensure safety and to protect users from being harmed. [PERSON] and [PERSON] [76] suggest that the context state of an IoT risk framework involves not only the collection of assets but the types of risk actors and stakeholders that could be impacted by an attack. Despite this, there is a significant lack of IoT cyber risk management frameworks that prioritise users, for example, users may be expressed as another asset type [47] rather than an individual entity. Researchers have suggested different approaches to mapping assets and users to threats.  
For instance, [PERSON] et al. [47] and [PERSON] et al. [64] propose that the impact of attacks on assets and users should be considered in threat analysis. In contrast, [PERSON] et al. [44] highlight the importance of considering user interactions with real-world physical devices. By adopting these approaches, researchers can develop a more nuanced understanding of the complex relationship between assets, users, and threats in the context of IoT security. While users could be simply viewed as another asset, other frameworks expand on how users can be modelled within the IoT domain based on a set of attributes.  
In contrast, [PERSON] et al. [73] define trust levels that show the access granted by an application to various users. This reflects privileges and user roles that can be used to model trust levels to aid in the creation of a data flow diagram. Additionally, with the second phase of [PERSON] et al. [40], a trust model is defined for a device, comprising software, hardware, and data, all of which the device relies on for its security. Rather than considering privileges, [PERSON] and [PERSON] [41] map users to assets to reflect responsibility for that asset.  
Another approach from [PERSON] et al. [60] describes user types as the membership (insiders and outsiders) and the location of a user in connection to a device (internal or external users). This is used with a formula that deals with the probability of abnormal usage at a storage and processing level. Finally, in our prior work, [PERSON] et al. [67] classify individual users by identifying high-risk behaviours, familiarity with security, as well as perception and prevention abilities.  
_Insight 2:_ Within the surveyed papers, assets and users are often intertwined, making them integral to answer RQ1. IoT devices have more enhanced capabilities than traditional IT hardware due to sensors and actuators, with the involvement of a controller (such as a smart phone) or automated actions based on environmental stimuli (like motion). The number of papers discussing users is significantly less than assets, with users often being seen as another asset to be protected, which may be sufficient for some IoT domains. The complex relationship between assets and users poses an additional need to know how users interact with devices, with [PERSON] et al. [40] and [PERSON] et al. [73] using trust models to define IoT security assurance. However, with IoT domains like smart homes, where there is little regulation, this approach neglects human interaction and the usage of the system and how this may affect risk. For example, in the work of [PERSON] et al. [67], the lack or abundance of best IoT practices (such as default passwords) can reduce or increase the risk level of a smart home. In turn, without understanding how users interact with devices, the link between a user and the vulnerabilities they may cause could be missed; thus, critical risks could be overlooked.