# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.1 Identification of IoT Assets
[59] present another smart home model that identifies assets in the second phase of their framework, enabling the development of data flow diagrams. [PERSON] et al. [67] utilise an adapted version of the Health and Safety Guidance (HSG48) to determine the most appropriate assets and users that may be vulnerable to risks in a smart home. In another study related to smart homes, [PERSON] and [PERSON] [41] utilise the OCTAVE Allegro model, which includes a phase that collects asset information through a profile asset approach, primarily focusing on critical information assets. The authors establish a risk measurement criteria before this phase. [PERSON] and [PERSON] [76] propose a risk analysis methodology using EBIOS [77], which also contains a context-gathering phase, aiming to ensure that the IoT domain is identified and described. This phase collects information about assets, different actors and stakeholders, and the parameters that need to be considered in risk analysis. [PERSON] et al. [51] incorporate a phase in their approach that establishes the purpose and requirements of the IoT domain, considering other relevant conditional factors that an organisation should consider when defining the environment. Sometimes, an organisation may need to prioritise the most critical assets. [PERSON] et al. [38] propose \"ArchiMate based Security Risk Assessment as a Service\" (ASRAaaS), which follows a \"Do-Act-Check\" approach starting with the creation of an inventory which contains identified critical assets using risk profiles. [PERSON] et al. [48] conduct an assessment of evaluation targets, which consists of multiple assets, and identified the components that an attacker would consider valuable. Finally, [PERSON] et al. [47] use an IoT domain model to aid in finding assets, which helps to avoid overlapping labels for assets. In another study, [PERSON] et al. [42] emphasise the importance of identifying assets in IoT systems due to their complex interfaces and architectural layers. The authors illustrate this point by highlighting how a seemingly simple device like a smart thermostat can comprise several components such as firmware, personal information, and more. These components are considered valuable assets, and their identification is crucial for ensuring their security and protection. By providing this insight, the authors shed light on the need for a comprehensive approach to IoT security that considers the different layers and components of a system. Meanwhile, [PERSON] et al. [60] focus on analysing the abnormal IoT system usage within a model that requires users to be identified by membership and location to devices, data which would need to be collected before the risk model could analyse risk. IoT assets will likely be dependent on or authoritative of other assets. For example, in the case that an information asset relies on a server, and this server is within a building [78], if the building was to be destroyed, both the information asset and server would be lost [78]. Such dependencies can allow for easier threat propagation, where if a device is dependent on other IoT nodes, the exploitation of a vulnerability can be amplified [44]. Uncovering dependencies requires the interactions and dependencies of an IoT system to be described [51]. _Insight 1:_ For RQ1, asset classification needs to be dynamic, fitting various standards and prioritising valuable assets, with the ability to be updated when required. The issue with current methods is that specific critical assets may be overlooked, thus being forgotten in the risk management process, with such classifications like tangible/intangible assets [74], primary/supporting assets [49], functional/nonfunctional asset properties [45] not being IoT specific. This poses the question of how IoT assets should be broken down, for example, a device being of more than one asset due to sensor hardware and how device capabilities can be factored in. As an example of non-specific IoT assets, [PERSON] et al.