# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Calculation
#### 4.2.3 Use of Threat Knowledge Bases  
According to NIST, threat intelligence is the information that has been \"aggregated, transformed, analysed, interpreted, or enriched\" [91] to provide context for decision-making. In the context of IoT, this means collecting applicable IoT threat information from various sources to form a threat knowledge base that can be used within IoT cyber risk management frameworks. Creating an IoT threat knowledge base allows an organisation or individual to assess threats and vulnerabilities that may not be considered in traditional IT system knowledge bases, for example sensor and actuator threats. [PERSON] and [PERSON] [76] build a knowledge base for estimating security needs and sources of IoT threats by using attacks found within EBIOS. They attribute baseline values of severity and likelihood to each attack and uncover sources for these attacks. This knowledge base can be used to carry out risk assessments by estimating the risk associated with different threat scenarios, where one or more attacks may take place. The associated risk values can then be combined to find the total risk of these scenarios. In contrast, [PERSON] et al. [47] also use EBIOS attacks to form a threat list, which is then used to map threats to threat classifications and assess their potential impact on systems based on the CIA model. However, they do not provide direct impact values for the attacks. [PERSON] et al. [43] use current IoT literature to develop a taxonomy for the security and privacy of medical IoT. This taxonomy is used to determine the architectural layers of IoT and identify potential attacks that may target these layers. To expand the threat knowledge, attack properties such as the difficulty of attack, CIA impact applicability, the method of carrying out each attack, the level of compromise, and the origin of the attack can be associated with each attack. This approach is used in various works, such as [PERSON] and [PERSON] [41], who curate smart home threats and link impact types, assets, and risk scores to them. The use of a defined criteria to estimate impact and likelihood can be easily applied to vulnerabilities as shown within [PERSON] and [PERSON] [64]. Here, the authors categorise low, medium, and high values using strict definitions. For example, a vulnerability with a high likelihood of exploitation would typically have a history of malicious incidents, motivated threat agents who can exploit the vulnerability, and assets that contain the vulnerability. In turn, each risk value uses a simple impact multiplied by likelihood calculation that produces a risk score, which is linked to a multidimensional matrix that displays the attack pathway, threat agent, associated assets, and threat that represent each risk. [PERSON] et al. [73] utilise DREAD as part of the criteria to estimate the potential of attacks. They produce a table of threats ranked by potential damage, reproducibility, exploitability, the number of affected users, and discoverability. The authors use a scale of high (3), medium (2), and low (1) to rank each of these criteria. As an example, an attacker that performs a man-in-the-middle attack targeting an IoT mobile application is rated as a medium risk as the total DREAD score is 8 out of 15, with reproducibility being the highest rating due to the ease of attack. Within [PERSON] et al. [66], a smart water security development framework is presented which reflects a 2-D architecture that can be used to assess risks within a smart water system. This framework focuses on capturing the attack surface, impact, and priority planes at different architectural layers (end device, communications, services, and application layers). The threat knowledge bases are formed by focusing on attack surfaces within each layer and associating impact types and priorities within each. For example, at the communications layer one attack surface is protocols, which can impact control, human safety, time, money, and energy are identified as high level priority.