# A Survey on Cyber Risk Management for the Internet of Things
## 5 Cyber Risk Treatment For IoT Survey Results
### IoT Risk Control
#### 5.1.3 Optimise Control Strategies  
As defined by NIST, the optimisation of controls refers to the process of minimising negative and maximising positive consequences and probabilities depending on risks, costs, and legal obligations [35]. In practice, optimal decision making for cyber security involves a trade-off between available resources for risk control and the minimisation of risk [97, 98], which poses several issues when finding the best set of security controls. While the effectiveness of a control can be estimated in a probabilistic way [97, 98], controls do not always maintain maximum effectiveness [99] and may not always be an attack-preventive measure [97]. The analysis of how a control performs at different levels of implementation can aid in making long-term optimal decisions by estimating the amount of time for which maximum effectiveness can be maintained [99]. In turn, different controls can be used for different actions, such as prevention, detection, and recovery [97], with control classifications helping to distinguish between these. The optimisation of controls within IoT is integral to ensure a balance between resource spending and the minimisation of risk, based on context information and the need to prioritise security controls [64]. However, IoT domains can carry the burden of lacking resources and the potential negative cost benefits due to how cheap IoT devices are, with [45] concluding that to reach the optimal solution for IoT decision making, a cost model needs to be integrated into their framework to balance risk and costs. In turn, the implementation and modification of security controls need to be carried out quickly for controls to be the most optimal, given emerging risks and risk assessment results [49]. According to [PERSON] et al. [60], contextual information is required to optimise IoT decision making accuracy, alongside adaptive risk assessment. For [PERSON] et al. [60], an initial risk threshold is set by a security administrator to reflect anomalous scenarios, which is used to generate a risk value. [PERSON] et al. [74] suggest that IoT engineers need to assign weights to security controls to achieve the best trade-off between safety, reliability, resilience, and privacy. Here, this trade-off ensures that optimal controls are implemented based on a defined value, for example, the effectiveness of a control and the amount of money needed to implement it. When an IoT risk is to be mitigated, the trade-off between security effectiveness and network performance is integral to ensure safe usage, with little impact on performance, which is explicitly important within wireless body area networks. To optimise security controls, [PERSON] et al. [46] use a game theoretic approach based on IoT device capabilities and the quality of survive objectives to find the Nash equilibrium. This equilibrium reflects the most desirable IoT security outcome by following a strategy, being optimal based on decisions from other players. The authors define such a strategy via the use of adaptive risk assessment that assesses contextual information and a threat model, using a Markov decision process that is defined by the finite set of states, possible actions, probability, and reward obtained from the execution of an action. From this process, payoff functions can be determined to show increases in security versus performance degradation. Using graph modelling, [PERSON] and [PERSON] [53] consider the optimal set of vulnerabilities that should be healed while considering the constrains of IIoT networks, such as the lack of vulnerability patches and the cost of patching. To integrate this, the authors suggest risk mitigation strategies based on finding the number of vulnerabilities that can be patched considering constraints to improve IIoT security. Cost modelling within IIoT networks is circumstantial, with a lack of accepted standards to aid security administrators.