# A Survey on Cyber Risk Management for the Internet of Things
## 6 Recommendations
### Recommendations for IoT Cyber Risk Identification
Vulnerability classifications should be specific yet leave ample room for unknown vulnerabilities to emerge. Significantly, IoT threat taxonomies are likely to identify common IoT vulnerabilities, for example, within the work of [PERSON] et al. [104] In tandem, we suggest that human vulnerabilities should be a primary focus within IoT cyber risk management frameworks to target preventable risks, with OWASP showing preventable vulnerabilities, such as the use of guessable or hardcoded passwords. We encourage researchers to focus on how human vulnerabilities can affect risk, given high-risk actions, security knowledge and awareness, susceptibility to social engineering, and misuse/misconfiguration. Part of this involves the question of how behaviour analysis can be integrated into models, and how this behaviour can affect risk factors like impact. This would require researchers to add behaviour analysis to each aspect of risk management, identifying risk factors and meaningful values as well as the assessment of risk with behaviour in mind. In turn, assessing the risk of a user and the potential increase in risk allows for the targeting of risk mitigation and training based on the user's security profile. The focus on human vulnerability is applicable to any IoT domain, with regulated IoT domains likely already having training schemes in place to ensure a secure workforce. In healthcare and smart grid domains, user responsibility of security is increasingly important due to the potential threat to life. For a smart home, users with a lack of cyber hygiene are especially vulnerable, which heightens the need to assess user behaviours since an attacker will want to exploit them. If a user at home has optimal cyber hygiene at work, it does not directly translate into smart home cyber hygiene. _How can existing IoT controls be used to assess risk more accurately?_ Both regulated and unregulated IoT domains are likely to contain several existing controls that can impact the likelihood of risk. We find that papers do not always consider control-based risk assessment, meaning that security controls are not explicitly factored into the risk assessment phase. Notably, in cases where an IoT risk assessment is taking place for the first time, uncovering existing controls is a necessary process to ensure that risk is assessed accurately, given an existing risk landscape. Such a process is applicable to all IoT domains, as traditional IT controls can partly control IoT risk, for example, firewalls and antivirus software. To include a process that finds existing controls, researchers could consider assessing the readiness of an IoT domain, which filters practical cyber controls and good practises, and estimating how effective these are. As an example, readiness within a smart home could refer to the use of good cyber hygiene practices. _How can the impact of an IoT threat event be defined?_ For the impact on IoT assets, CIA, as well as privacy, trust, accountability, and nonrepudiation, are all important factors that can be affected by an attack. However, cyber impact does not encompass the myriad of ways in which users can be impacted by an IoT attack. An IoT user may be directly affected by an attack, thus showing an impact of IoT risk in daily life. As an example, a medical IoT device may be exploited to cause physical harm to a user because of an attack on account access. Upon identifying impact types, researchers can map assets and users to the relevant impact types and prioritise the most important impact types within the IoT domain. Then, researchers can identify crucial impact types within an IoT domain and define a meaningful severity scale. For domains such as healthcare, smart grids, and smart cities, researchers could consider an impact scale of physical harm from no risk, harm, to life-threatening harm. In contrast, within a smart home, the loss of privacy and control could be more crucial.