# A Survey on Cyber Risk Management for the Internet of Things
## 5 Cyber Risk Treatment For IoT Survey Results
### Risk Monitoring
#### 5.2.1 Ensure Continuous Risk Monitoring  
For IoT, risk monitoring involves observing key risks to find vulnerabilities that may arise, for example systems that monitor authentication attempts [68]. The regular monitoring of IoT networks also allows for suspicious behaviours to be uncovered [70] and the anticipation of future risks, given the development of IoT technology, with new vulnerabilities being discovered [74]. Not only this but well-known cyber risk management frameworks use continuous risk monitoring, with [PERSON] et al. [44] exploring the NIST cyber framework and ISO 3100 in the context of smart cities. Monitoring IoT risks can be process that IoT cyber risk management frameworks use to ensure dynamic decision making and continuous risk management. As part of managing risks, [PERSON] et al. [74] specify that risk factors (like threats, vulnerabilities, device capabilities, and attacker motivations) should be monitored for changes that could affect security, which can then be used to update risk assessments. Meanwhile, [PERSON] et al. [40] propose a monitor and anticipate risks step within their model with the goal of ensuring that the risk response is correctly implemented, determining the effectiveness of responses, and uncovering changes that cause the risk parameter to transpose. In doing this, the authors ensure that IoT devices are as up to date as possible to maintain a satisfactory level of security. [PERSON] et al. [60] suggest the use of a risk-adaptation phase, which monitors risk rates, allowing for the adjustment of security controls depending on the risks. Rather than being a phase within a model, monitoring could be seen as a security objective, where processes, infrastructures, and logs must be monitored to ensure that unauthorised actions are detected [47]. In contrast, monitoring can be viewed as a type of security control, with [PERSON] et al. [51] suggesting the use of the network monitoring and defence control from CIS controls to ensure IoT audit log management by the use of maintenance, monitoring, and analysis. Within the work of [PERSON] et al. [52], monitoring and reviewing risks is considered an additional support activity to ensure that risk management is continuously \"controlling, reacting, and improving\" [52] the information needed by the risk management process. Considering that IoT risks can change quickly, continuous risk management processes that work dynamically are important. [PERSON] et al. [38] suggest that the ASRAaaS responsive IoT risk assessment allows for continual monitoring based on preventive risk analysis, with this not being in real time. Regardless, the monitoring and reviewing of IoT risks dynamically in real time may require supplementary data and an increased set of computing resources. For example, [PERSON] et al. [58] require supplementary training samples based on IoT scenarios within dynamic networks to ensure high accuracy for risk assessment. [PERSON] et al. [69] envision the use of a smart phone application within the smart home, which allows users to quickly monitor IoT devices and view the security state of the home. [PERSON] et al. [46] apply the continuous monitoring of device channel attributes, such as traffic nature and device capability, to continuously estimate risk to find the best security controls dynamically. Monitoring IoT behaviour is key to finding security risks that may develop over time. In the context of smart grids, operations are monitored by the National Control Centre (NCC) and the Regional Control Centre (RCC), with servers monitoring and managing consumption patterns, which allows for differences in behaviours to be spotted [76]. In the same vein, [PERSON] et al. [45] use assurance techniques to monitor the  
Figure 7: A visual breakdown of the number of papers per IoT risk control concept. For example, of the 39 collected papers, 13 of them fit into our survey’s continuous risk management section. behaviour of devices to ensure that device behaviour is legitimate with all mechanisms implemented acting as expected.