# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 1 Introduction  
Digital transformation is used in organizations to improve their strategic and operational processes by incorporating \"Smart\" concepts [1]. Currently, this \"Smart\" concept can be implemented in agriculture, transportation, energy, homes and cities [2]. Implementing the smart concept from a technological perspective is based on the use of emerging technologies such as artificial intelligence (AI), big data, machine learning (ML), Internet of Things (IoT) and the cloud [3]. However, including these technologies has introduced additional aspects related to cybersecurity. The IoT has certain particularities in relation to security in contrast with AI, big data, ML and cloud; this is because of factors such as location in less protected environments such as streets, traffic lights and agricultural fields, among others [4]. IoT devices have inherent characteristics, such as heterogeneity of technologies and protocols, reduced computational capacity and limited security mechanisms [5]. This aspect of IoT systems has motivated the development of several works of research related to IoT security. Some contributions have focused on establishing security strategies, such as the zero trust model for IoT [6] and security verification on IoT systems [7]. These strategies have two aspects in common. The first one is related to the fact that they focus on establishing phases or procedures based on the security level of the IoT device. For instance, \"Zero-trust\" establishes a minimum-security level that an IoT device must meet to join the network, while \"Security Verification\" requires evaluating, as a first step, the compliance of IoT devices based on risk profiles. The second aspect is related to the requirements of these two strategies for their first step in developing \"Risk analysis\", which is often based on the identification and evaluation of critical assets (IoT devices) [8]. In relation to this second aspect, applying a security risk analysis method in an IoT context has been discussed by some researchers in recent years, because of the argument that IoT systemshave characteristics and behaviors of IT (Information Technology) systems. For instance, [PERSON] et al. [9] mentions that the complexity and heterogeneity of the technology and data of IoT systems create additional issues related to security risk that cannot easily fit in the existing risk frameworks. In the same vein, [PERSON] et al. [10] mentions that risk analysis methodologies must adapt to dynamic IoT scenarios, as well as consider the possibility of limited historical data related with attacks on IoT devices and the interconnection of IoT with other non-IoT systems. In this context, some proposed security risk methodologies focused on IoT have been developed. These proposals include features of IoT systems, such as heterogeneity, a layered model, and several IoT devices. However, each proposed method uses different factors or characteristics of IoT systems in comparison with the others, and sometimes, there is not a rational justification about the selection of the specific factors used. The analysis, in conjunction with the factors used by the different methodologies, could contribute to a deeper calculation of IoT security risk. Thus, there is a gap in relation to having a formal IoT security risk analysis method, and in relation to the factors that could contribute to more accurate and effective construction of a security risk analysis method for the IoT. This context allows us to define our primary research question: How can we develop an effective security risk assessment in IoT systems? Based on this primary research question, we propose the following objectives for this study:  
1. Identify the most relevant factors that allow the definition of the security risk level of an Internet of Things system. 2. Evaluate the relationships between the factors of the Internet of Things. 3. Establish a method to calculate an approximate value of the security risk level of an IoT system.