# A Survey on Cyber Risk Management for the Internet of Things
## 5 Cyber Risk Treatment For IoT Survey Results
### IoT Risk Control
[67] explore the effectiveness of IoT security controls for smart home environments, assessing if controls are effective enough to reach an acceptable level of risk. Within the surveyed papers, the selection of risk controls are driven by literature and applied to IoT domains by means of discussion, exploring how these controls can be applied to reduce IoT risk [41; 47; 68; 70; 75]. For example, [PERSON] et al. [73] discuss controls that combat spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege in the context of IoT, while [PERSON] et al. [49] build a IoT risk catalogue using Deutsche Telekom's ISO/IEC 27001 certified privacy and security assessment document [93]. Controlling risks can support cyber resiliency, which is the ability to \"anticipate, withstand, recover from, and adapt to adverse conditions\". [PERSON] et al. [62; 63] focus on building IoT resiliency against attacks and assess how attacks can impact resiliency, for example, the number of services per actuator opens more entry points for attackers and can reduce actuation resiliency. One of the common suggestions within the surveyed papers is the use of hardening, which is a process that eliminates attacks by patching vulnerabilities and \"turning off non-essential services\" [94]. Despite IoT vulnerabilities often not being patchable, there associated IoT components that can be hardened, like mobile operating systems and physical access [48]. For IoT, [PERSON] et al. [51], focus on implementing hardening controls where possible, with IoT vulnerabilities being patched and ports being switched off to shrink a system's attack surface. [PERSON] and [PERSON] [53; 54] use graph modelling to propose algorithms uncover strategies to eliminate risk. These algorithms aim to reduce threats within network pathways by removing high threat paths, low hop paths, and the detection of high risk nodes [53] which can lead to the isolation of high risk devices [54]. Security control decision making is integral for IoT as it helps to select security controls based on control properties like strength and the degree risk is mitigated [45], for example security controls used to prevent risk occurrence [38]. Within [PERSON] et al. [66], an action Handling unit for security control decisions is used, which picks security actions based on the amount of risk that can be reduced. [PERSON] et al. [55] use a countermeasure selection module which implements vulnerability search algorithms to find intruders and prompt action to be taken, when an intruder is removed from the system, the risk level is minimised. Within [PERSON] et al. [46], dynamic decisions are used to adjust security levels to an acceptable level. The framework uses sensor behavioural patterns that have an associated risk thresholds (accepted level of risk) decided by security admins, where if a level is higher than the risk threshold for a device, it should switch on more effective security controls. In contrast, an Intrusion Prevention System (IPS) that can detect an intrusive activity and attempt to stop an attack from happening [95] is proposed by [PERSON] [56], which can be used to choose risk control strategies based on the causes of risk, with the system performing preventive actions once a strategy has been formed. IoT mitigation strategies are chosen using several distinct factors, e.g., the root of risks that have been evaluated, the common causes, suitability, and the required resources needed. Based on these factors, mitigation solutions are created based on the selection of controls [56; 57] An IoT strategy can be accepted, allowing for the control be implemented, or rejected, where evaluation will need to take place again [57]. _Insight 12:_ Within our discussion, we have shown that IoT risk control greatly relies on risk assessment results and the need to reduce risk to an acceptable level, thus a robust IoT risk control strategy needs to prioritise critical risks using reliable controls.