# A Survey on Cyber Risk Management for the Internet of Things
## 1 Introduction  
The commercial growth of the Internet of Things (IoT) technology has been exponential due to its benefits to multiple organisations and individuals in a vast number of environments. IoT is changing daily domestic life [1; 2; 3; 4]. However, the use of this technology comes at a potential cyber risk that can impact, harm, or damage systems and users negatively. In such cases, organisations may actively use IoT in a more regulated way; however, IoT is not just for organisations but individuals who may dwell within IoT domains that are not regulated. Unlike organisations with home workers, organisations that use IoT have more control over how risk is managed due to centralised cyber risk strategies built from standards, legislation, and regulations. Unfortunately, despite centralised strategies, IoT devices carry limited security capabilities due to processing constraints [5], which impacts the ability to accurately control devices at the same level as traditional IT devices. This problem supports the need for IoT cyber risk management methods that can function alongside traditional IT but consider IoT specific issues. At a very high level, cyber risk management is comprised of three main components: risk _identification_, risk _assessment_ and risk _control_[6]. The risk _identification_ phase gathers data needed for risk _assessment_, which aims to determine the value of risk. This determination is then used to establish risk _control_, which allows for the implementation and evaluation of cyber security controls to mitigate risk. Given the well-known nature of how risk management should function, many types of cyber risk management standards are available for organisations to ensure that their assets and employees are protected, with some of the most well known coming from NIST and ISO/IEC. In the context of IoT, some methodologies may not always be fit for this purpose but could be used to ensure a standardised system using well-known risk factors. According to NIST, cyber risk is defined as the \"risk of depending on cyber resources\" [7] and the IoT domain is no exception. In connection, cyber risk management is a \"comprehensive process that requires organisations to (i) frame risk; (ii) assess risk; (iii) respond to risk once determined; and (iv) monitor risk on an ongoing basis\" [7]. Meanwhile, an asset is anything that has value to an organisation or a person that needs to be protected against IoT attacks [8], where using a cyber risk management model can be used to minimise the impact on users and assets with the use of a formalised process. The problem with traditional static requirements is that security controls are deployed \"around the external facing nodes of a network\" [9] within unchanging network domains [10], something that is commonly dynamic within IoT. Due to this, static requirements applied to IoT security may not be most suitable due to the IoT scalability, with environments using a vast number of IoT nodes [9; 10]. Another factor of concern within the IoT domain is that of _users_, addressing not only how they are impacted by attacks but how they may become _human vulnerabilities_. The perspective of a human vulnerability within security research is often related to humans being the weakest security link, considering the potential manipulation from social engineering attacks. Figure 1 shows common user roles within various IoT domains, with such users having differing security responsibilities. While technical protection for systems is important, if not used correctly or the user is manipulated by an attacker, an attack may still be successful in achieving its goal [11]. It is argued that members of the public will often acknowledge the threat of cyber attacks but do not necessarily know the steps to mitigate them [12], and with many IoT threats, users that are not aware of how to use safeguards may be putting themselves at risk and possibly their employers too.