# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 5 Discussion  
Including IoT is a relevant contribution to digital transformation processes, but its inherent characteristics, such as heterogeneity of technologies, limited computational resources, low levels of security and the dispersed location of IoT devices, generate new security issues. In this context, there arises the need to establish security strategies for IoT environments such as zero trust or security verification. One of the first steps to implementing security strategies is to develop a risk analysis, for which different established methodologies such as MAGERIT, TARA, ISO can be used. However, several researchers have pointed out that these risk methodologies were conceived considering the characteristics of traditional information system environments, and they do not consider the characteristics of IoT systems; thus, they need to be adapted. In this sense, several researchers have proposed risk analysis methodologies for IoT that consider these inherent characteristics of IoT systems. However, it can be observed that these proposed methodologies consider different elements so that the way of calculating risk varies from one methodology to another; it does not allow us to have a risk methodology that considers all factors. The aim of this work is focused on analyzing, grouping and proposing factors that allow us to evaluate risk in IoT systems. We have proposed grouping of the factors into seven constructs: Organization, Risk Behaviors, Dependency, Attack Surface, Susceptibility, Severity and Uncertainty. The organization construct suggests that the focus of the risk methodology should not be on the assets, but on the aspects of the domains and pillars to which the IoT solution is contributing. The IoT risk methodology should consider the impact--economic, social or environmental--that may be caused by a threat to IoT systems. Security risks are currently considered among the 10 threats that could generate a shock to the world economy in the so-called systemic risk, and the high interoperability and dependence between IoT/IT/OT systems increases the likelihood of this risk. In this sense, the IoT risk methodology should allow us to understand the risk behavior (impact, propagation time, coverage area) against the different dependencies and attack surfaces generated by IoT systems. A comparison of the traditional risk analysis methodology versus the IoT proposal is presented in Table 12. \begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Methodology**} & **Computer Security Risk** & **IoT Risk** \\  & **Analysis (MAGERIT)** & **IoT Risk** \\ \hline Focus on & Assets & \begin{tabular}{c} Context (social, \\ environmental, economic) \\ \end{tabular} \\ \hline Priority & Top of critical assets & Top of group of critical assets \\ \hline Dependency of & Assets & Assets/threats \\ \hline Type Assets & Individual critical assets & \begin{tabular}{c} Grouped critical assets (based \\ on classes or security levels) \\ \end{tabular} \\ \hline Security factors on the assets & \begin{tabular}{c} Confidentiality, Integrity, \\ Availability, Traceability and \\ Authenticity \\ \end{tabular} & \begin{tabular}{c} Confidentiality, integrity and \\ availability (Based on classes) \\ \end{tabular} \\ \hline Vulnerabilities & Overall approach & \begin{tabular}{c} Based on IoT layers \\ (application, communication, \\ and device) \\ \end{tabular} \\ \hline Attack surface & \
\begin{tabular}{c} Not included in the \\ methodology. \\ \end{tabular} &
\begin{tabular}{c} Based on relationships \\ among systems. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 12: Comparison of traditional methodologies versus the proposal of IoT security risk in the present study. **Author Contributions:** Conceptualization, R.O.A. and S.G.Y. ; methodology, R.O.A. and S.G.Y. ; formal analysis, R.O.A. and S.G.Y. ; investigation, R.O.A. and S.G.Y. ; writing--review and editing, R.O.A., S.G.Y. and J.B.; project administration, I.O.-G. All authors have read and agreed to the published version of the manuscript.