# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 2 Background and Related Works  
Risk analysis methodologies have been widely used in computer science to assess security risk in computer systems. Some of the most widely used risk methodologies are presented in Table 1 with their strengths and weaknesses. However, some researchers have mentioned that these traditional methodologies have some limitations for IoT systems. For instance, [PERSON] mentions that current risk assessment methods fail in the following aspects [10]:  
* Short assessment periods: Risk methodologies are not usually designed to be performed in short periods of time; however, the IoT ecosystem is continuously changing because of the addition of new devices. * Limited knowledge of IoT systems: Most risk assessments are focused on traditional systems and do not include the IoT ecosystem. * Connections to other systems: IoT devices connect to other systems or technologies such as cloud computing, big data and traditional systems. This situation expands the attack surface of IoT ecosystems. * Not considering the asset as an attack platform: IoT devices can perform new attacks. In this context, some research has been proposed for the development of risk analysis methodologies focused on IoT. [PERSON] proposes that the following parameters should be considered for assessing the security risk in IoT system network type (nwt), protocol type (prt), the heterogeneous system involved (het), device security (des) and CIA impact type (cia) [8]. From these criteria, the risk impact of a device would be given by Equation (1):  
\[\mathrm{w(d)}=\frac{1}{5}[\mathrm{nwt(d)}+\;\mathrm{prt}\;(d)+\;\mathrm{het} \;(d)+\;\mathrm{des(d)}+\mathrm{cia(d)}] \tag{1}\]  
where  
wd--level of risk impact;  
nwt--network type;  
prt--protocol type;  
het--heterogeneous systems involved;  
des--level of device security;  
cia--level of impact on cia components. The probability of risk would be given by the weight of past attacks (pat), the weight of the IoT layer with more attacks (lyr), the weight of the sector where the IoT solution is applied (scr) and the risk factor of the device according to its use (drf). Based on these criteria, the risk probability of a device would be given by Equation (2):  
\[\mathrm{S(d)}=\frac{1}{4}\;[\mathrm{pat(d)}+\;\mathrm{lyr(d)}+\;\mathrm{scr} \;(d)+\;\mathrm{drf(d)}] \tag{2}\]  
where \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Methodologies** & **Focus On** & **Strength** & **Weakness** \\ \hline NIST [11] & Security controls & Guidelines to execute security & Needs work with other standards \\  & & controls according to risk assessment. & to address compliance. \\ \hline ISO [12] & Compliance of security controls & Analysis of information security risks & Coordination and integration to \\  & & according to specific criteria. & remember to update the standard. \\ \hline  & & Assessments of critical assets, and the & \\  & & mitigation of threats and risks that & \\  & & could degrade them. & \\ \hline TARA [14] & Attacks & Definition of a list of attacks. & Does not quantify risk impact. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Strengths and weaknesses of risk methodologies used in computer science. pat--weight of past attacks;  
lyr--weight IoT layer;  
scr--weight of sector of IoT;  
drf--risk factor. Finally, the proposal presented by [PERSON] evaluates risk (Rs) as a function of impact by probability, denoted as the product of w(d) by S(d). The exploitation of this proposal is interesting because it includes characteristic aspects of IoT solutions, such as the application sector and the layered architecture of IoT. The proposal covers the components without discussing more details about the threats, attacks or vulnerabilities of IoT systems, allowing for the establishment of the weights for risk calculation. In addition, a method could be included to reduce subjectivity when considering the weights of each component.