# A Survey on Cyber Risk Management for the Internet of Things
## 6 Recommendations
### Recommendations for IoT Cyber Risk Identification  
Being the first part of IoT cyber risk assessment, identifying IoT risk parameters accurately is integral to assessing risk. Our work shows that IoT assets, users, threats, vulnerabilities, controls, impact, and likelihood all need to be identified within an IoT cyber risk management framework. RQ1 provides insight into how identification processes may take place, which shows a number of areas that need to be considered within future IoT cyber risk management frameworks. Below, we suggest questions for future works and recommend ways to overcome problems within IoT cyber risk identification processes. _How can IoT assets be defined, given the constraints of an IoT domain?_ IoT is intertwined with traditional IT assets, with devices using conventional hardware like routers, and notably deviate in functionality and data use, for example sensors and actuators, as well as the data produced by them. Furthermore, researchers need to consider how IoT assets are classified and how this helps IoT cyber risk management, with the main point of contention being IoT devices. In this case, an IoT device can be targeted at various system components, with the most important being sensors and actuators; thus, we recommend that researchers at the very least consider sensors and actuators as individual assets from a device. By defining IoT assets, associated attributes and priorities can then be established, such as identifying the capabilities and limitations of IoT devices. Asset classifications need to be dynamic and suitable for IoT, challenging researchers to find a fitting method of classification for an IoT domain. Organisations may use IoT to assist business operations, with IoT devices becoming assets owned by the organisation. However for a smart home, assets may be personal belongings that dwell within a place of residence, with personal information assets being accessed on a daily basis, such as payment and account credentials. IoT devices serve as daily conveniences [22] (such as smart cameras, locks and fridges) that may produce private data, for example, a smart camera's visual and audio information. Within healthcare, medical records are lucrative assets for attackers to steal due to the increasingly high payoff [101]. IoT medical equipment assets are used to help patients, with devices like pacemakers helping patients to live. Complexly, IoT medical technologies may be taken home by a patient, which may produce private data about a patient's medical state. Alternatively, assets within smart cities and grids are heavily relied on and must be available to ensure operation. For a smart grid, the energy produced may be an asset, as well as the industrial control system (ICS) equipment used to create it, while smart city assets can include devices used for traffic and building management. How influential are users to IoT risk?_ Asset classifications may define users as assets; however, consider that users are not assets and should be treated differently due to the potential lack of IoT cyber hygiene. In unregulated IoT domains like smart homes, users could be viewed as having a high influence on risk values. We find that most researchers do not focus on users in regards to how they influence risk and the increased complexity of user interactions towards smart technology. For IoT users within an IoT domain, consider profiling users based on the risk actions and associated assets that they may use; this makes it easier to understand the links between users and assets, as well as users and security. Furthermore, researchers could pinpoint how users interact with device capabilities to better uncover threats. Users within IoT domains are culpable and accountable for ensuring that security is maintained. The importance of user interactions with device security as explored by [PERSON] et al. [44] can be applied to all IoT domains to comprehend complex relationships.