# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 4 Results
### Descriptive Study II
We can observe, in Figures 21 and 22, how output variables change based on the values of input variables. For instance, if there is evidence or a belief that vulnerabilities exist in IoT devices, we can change the probability of economic impact to 73.12%. However, if there is evidence or a belief that vulnerabilities and susceptibility exist, the attack surface is attackable, and interdependent systems are attacked, the economic impact increases to 86.5%. Figure 21: Calculation of the factors of IoT security risk based on the evidence of vulnerabilities. Figure 22: Calculation of the factors of IoT security risk based on the evidence of vulnerabilities, susceptibility, attack surface and interdependency. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & & & \multicolumn{2}{c}{**Performance Indices**} \\ \hline
**Label for** & **Factors** & **Constructs** & **Input Variables** & **Output Variables** \\ \hline H1 & Vulnerabilities & Organization, Attack Surface, Severity & (a) Values of vulnerabilities & \\ \hline H2 & Type of attack & Organization, Risk Behavior, Severity, Uncertainty & (a) Value of attack per layer & \\ \hline H3 & Attack surface & Organization, Risk Behavior, Attack Surface, Attack Surface, Interdependency, vulnerability & (a) Number of IoT devices & \\ H4 & Interdependency & Attack Surface, Susceptibility, Interdependency & (b) Security & \\ \hline H5 & Severity & Severity & (a) Values of degradation of CIA \\ \hline H6 & Application & Organization, Attack surface, Susceptibility, Interdependency & (a) Value of economic impact & (b) Value of economic impact \\ \hline H7 & Scalability & Risk behavior & (a) Number of IoT devices, (b) Historical attack, (c) Time between attacks & \\ \hline H8 & Type of device & Severity, Interdependency, Uncertainty & (a) Security level of CIA \\ \hline H9 & Susceptibility & Organization, Susceptibility & (a) Frequency of attack (b) Time between attacks (c) Security levels \\ \hline H10 & Type information & Organization & (a) Security configurations & \\ \hline H11 & Uncertainty & Attack Surface, Susceptibility, Interdependency, Uncertainty & (a) Number of IoT devices (b) Security configurations (c) Values of interdependency & (a) Number of IoT devices (b) Security configurations (c) Values of interdependency \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Performance indices for the benchmark of risk methodology. To validate the behavior of the nodes that build the risk analysis, a set of values was established for the input variables defined in the performance indices and we observed the output variables as shown in Table 11. We executed a Shapiro-Wilk test with the null hypothesis that a sample is from a normal distribution. We chose a significance level of 0.05 and had an alternative hypothesis that the distribution is not normal. Vulnerability, susceptibility, attack surface and interdependency nodes did not follow a normal distribution, while economic, social, and environmental nodes followed a normal distribution. Having a normal distribution in the values of the output variables allowed us, from a theoretical point of view, to satisfactorily approximate the value of the random variables to a real situation. The values obtained in the output variables did not present significant dispersions and had a tendency, in this case, to that of a normal distribution. In addition, a correlational analysis of the values generated and obtained was carried out, as shown in Figure 23, showing that the interdependence node is the one that generates the greatest contribution to the values of the economic, social and environmental impact nodes. This gives us a guideline for future work, to analyze the security aspects in the interdependence between IT, OT and IoT systems.