# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Calculation
#### 4.2.4 Use of Weighted Risk Formulas  
Weighted risk calculations can be used to adjust the importance of a given risk parameter. Rather than simply using multiplying likelihood by impact, weighted formulas prioritise certain likelihood and impact metrics. As an example, [PERSON] et al. [44] form a quantitative assessment of IoT using security weightings for different IoT areas within smart cities, such as the economy, environment, and society, to be prioritised. The process of defining weighting provides freedom for users to easily modify risk scores. This allows the authors to consider the different needs of each smart city and the areas of security that city officials may want to prioritise. Therefore, the weighted sum of a smart city's security is the sum of all assigned weights of each factor. Meanwhile, [PERSON] et al. [43] states that a user needs to define the weights using a specific 1 to 10 scale, with worst-case scenarios being assigned a 10.  
An IoT cyber risk management framework may use different impact types to show how a smart domain is affected by an attack. For [PERSON] et al. [67], impact is defined as the weighted impact sum that represents types of impact for a smart home, such as the impact domestic lives of the smart home inhabitants and cyber impact on systems. Correspondingly, [PERSON] et al. [60] define weights as a scale from 1 to 10, with these weights reflect different impact types of financial risk, brand value loss, data theft, and threat to life. Here, risk is evaluated depending on the related vulnerabilities, threats, likelihood, and the impact of an attack, with risk impact using weights to associate classes of impacts.  
Unlike other papers, [PERSON] et al. [39] propose an initial attempt at an IoT-based smart home security assessment named SKIP (Self-assessment, Knowledge, Infrastructure, and Practices). They use self-assessment questionnaires (related to understanding IoT terminology, and assessing the understanding of IoT information systems, security, and cyber-attacks), knowledge (questioning the user on security systems, attack scenarios, legal issues and general IoT knowledge), details into the smart home infrastructure, and IoT practices (e.g., questioning users about how they use security systems). All this data is used to form a weighted composite score to estimate risk, with the weightings used to prioritise practices over knowledge and infrastructure, as the actions that users take are more important and better express high risk actions a user may be taking.  
Weighting can also work alongside graph modelling, with [PERSON] et al. [71] suggesting that users can signify paths of priority by factors like impact, generating weighted attack trees. Weighted graphs have assigned values that represent some form of cost, such as impact and likelihood. Finally, [PERSON] and [PERSON] [54] use weighted and directed graphs with weights representing the risk likelihood assigned to network pathways, with the total risk likelihood of a path being the product of all weights on all links.  
_Insight 11:_ Another solution for RQ2 is the use of IoT risk weighting which helps to prioritise impact, certain assets, and users etc. Weighting signifies that a given risk value is deemed as critical over other values, for example, an IoT domain may prioritise the potential impact to life within threat events over cyber impacts. This allows for an IoT cyber risk framework to assess risk based on criticality, as the weights will likely change the value of risk. Weighted scoring is also useful in assessing the security of users, with [PERSON] et al. [39] using weights to estimate risk using a questionnaire based approach. Not only this, but other methods of risk calculation (such as graphs and risk matrices) can use weightings, making this easy to implement to increase prioritisation on selected risk components.