# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 4 Results
### Prescriptive Study
Regarding this, we expected to obtain more security experts for the survey; however, some of them mentioned that they did not have knowledge of IoT security, which would limit their participation in the survey. This is not a complete limitation for the study because our expectations were to obtain a minimum of 10 security experts to build a matrix of 10X 270 for the use of PCA (Principal Component Analysis) and MCDA (Multicriteria Decision Analysis) to continue our analysis; both types of analysis were used for the evaluation of factors for risk assessment in different fields, such as aeronautic or cloud computing [46]. From the data obtained, we developed Principal Component Analysis (PCA) using the statistical software SPSS (see Figure 17). The PCA was used for exploratory analysis. For this reason, the number of factors for extraction was 27, which is equal to the number of questions in the survey. Analyzing the graph of sedimentation in Figure 18, which was created for SPSS from our data, the number of relevant factors is equal to seven. This means that there are seven theoretical constructs which accumulated the total variance of our questions, in our case research items and assumptions. Table 7 was obtained from SPSS, and it shows the variance for the seven main components. From component numbers 8 to 27, the contribution of variance is poor; thus, they are not considered for the rest of the analysis. The first construct explains 54% of the variance, the second contributes to 12.39% of the variance, the third contributes to 11.92% of the variance, the fourth contributes to 7.18%, and so on, as show in Figure 19.  
Figure 17: Setup of factorial analysis in SPSS to extract principal components. Figure 18: Setup of factorial analysis in SPSS to extract principal components. The results did not change the proposals' risk factors related to IoT devices. All factors that were represented in the questions of the survey have relationships with one of the seven components. Based on the analysis of the seven theoretical constructs through the matrix of components of SPSS with the factors, we obtained the following results:  
**Component 1 (54.90% of weight): Application**  
* Effect on economic, social, environmental domains. * Number of IoT devices. * Effect of shock on the market. * Security configurations of IoT devices. * Vulnerabilities of IoT devices. **Component 2 (12.39% of weight): Scalability**  
* Effect of the relation between \(\Pi\)/OT/IoT systems. * Number of IoT devices increase the probability of attack. * Previous attacks allow new attacks. * Short times to propagate attacks. * Attacks from one layer to other layers of IoT system. **Component 3 (11.92% of weight): Attack Surface**  
* IoT devices number increase attack surface. * Attacks could be on different IoT layers. * Attacks could be on different domains. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{4}{c}{**Total Variance Explained**} \\
**Component** & \multicolumn{2}{c}{**Initial Eigenvalues**} & \multicolumn{2}{c}{**Extraction Sums of Squared**} \\  & **Total** & **\% of Variance** & **Cumulative \%** & **Total** & **\% of Variance** \\ \hline
1 & 14,822 & 54,895 & 54,895 & 14,822 & 54,895 \\
2 & 3344 & 12,385 & 67,280 & 3344 & 12,385 \\
3 & 3218 & 11,918 & 79,197 & 3218 & 11,918 \\
4 & 1938 & 7178 & 86,375 & 1938 & 7178 \\
5 & 1671 & 6190 & 92,565 & 1671 & 6190 \\
6 & 1219 & 4516 & 97,081 & 1219 & 4516 \\
7 & 0.788 & 2919 & 100,000 & 0.788 & 2919 \\
8 & \(1321\times 10^{-15}\) & 4892 \(\times 10^{-15}\) & 100,000 & \(1321\times 10^{-15}\) & \(4892\times 10^{-15}\) \\
9 & \(1228\times 10^{-15}\) & 4547 \(\times 10^{-15}\) & 100,000 & \(1228\times 10^{-15}\) & \(4547\times 10^{-15}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Variance distributed in components (factors) using SPSS. Figure 19: Setup of factorial analysis in SPSS to extract principal components. **Component 4 (7.18% of weight): Severity**  
* Effect on CIA. * Impact depends on type of attack. * Vulnerabilities in IoT devices.