# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 2 Background and Related Works
In the same vein, [PERSON] defines the cybersecurity performance algorithm, where Ef is the Efficiency; Dev is the number of devices connected to the network; Sor is the number of sensors; Svs is the number of services and processes; Int is the number of interfaces; Met is the number of reports, indicators or metrics; Dat is the number of data structures; Scf is the number of smart contract functions; and _Prot_ is the number of protocols or standards adopted [15]. \[\text{Ef}=100-(\frac{\sqrt{\text{Dev}\times\text{Sor}}}{\sqrt{\text{Det}\times \text{Scf}}}.\frac{(\text{Svs}+\text{Int}+\text{Met})}{(5\pi+Prot)} \tag{3}\]  
where  
Dev--number of devices connected to the network;  
Sor--number of sensors;  
Svs--number of services and processes;  
Int--number of interfaces;  
Met--number of reports;  
Dat--number of data structures;  
Scf--number of smart contract functions;  
_Prot_--number of protocols or standards adopted. Toapanta's proposal considers the characteristics of IoT systems from the perspective of the large number of devices, sensors, and processes. The proposal addresses the security aspects of the IoT in a general approach, without going into detail on how aspects of the IoT are affected by distinct threats. The proposal considers all IoT devices equally, which could limit the selection of security controls to reduce risk, because it does not detail the type of information on the IoT device or the criticality of the IoT device for health- or energy-related applications. In the same line, [PERSON] proposes that the risk assessment be based on a four-stage approach: (a) Measurement of threats to the layers; (b) processes/procedures for securing data in the layers; (c) third parties and human factors affecting layer security; and (d) criticality of the layers and the scale of the attack surface [16]. The model proposes a qualitative risk assessment based on three criticality scales: low, medium, and high. [PERSON], again, mentions the importance of considering in the risk assessment the heterogeneous systems involved in the IoT system and attacks on different layers of IoT systems. The proposal does not address how to establish component values to have a more accurate or focused risk value. From [PERSON]'s perspective, he proposes a risk management strategy reference model (IoTSRM2) based on six domains: Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy, and Supply Chain Risk Management. Within the domains are included aspects such as hardware inventory, software inventory, critical dependencies and functions, resilience of critical services, security-related policies, structures and responsibilities, regulatory requirements, governance and risk management plans, vulnerability discovery, threat identification, risk analysis and risk responses [17]. The framework establishes a set of security criteria that could improve the security level of IoT systems based on the analysis of 25 international security frameworks. A potential drawback of the proposal is that it does not present a detailed operational process for developing each of the security criteria proposed in the framework. Finally, [PERSON] proposes a risk assessment on IoT devices using scores between 0 and 1 for subcomponents of five different attack categories on an IoT device (Physical, Network, Mobile, Web, Unknown Risk) [18]. [PERSON] defines the risk \"ri\" for each category based on normalizing the sum of each of the subcomponents ci and dividing by the value of S, which is the total score of all subcomponents of an attack category. \[\text{ri }=\frac{1}{S}\sum_{i=1}^{n}Ci \tag{4}\]  
where  
ri--level of risk;  
\(S\)--total weight of score of all components;  
\(Ci\)--subcomponents of IoT system.