# Security Risk Analysis in IoT Systems through Factor Identification over IoT Devices
## 4 Results  
### Prescriptive Study  
Based on literature review and experiments from the previous phases of the DRM, we can understand the factors associated with IoT devices, which we represented in Figure 16, and make the following assumptions about their contribution to security risk:  
Figure 16: Extract of survey to obtain information from experts related to IoT security. Figure 15: Second reference model for risk analysis in IoT systems based on IoT device factors. Assumption 1: The risk value will depend on the probability that threats can capitalize on IoT systems, but also on related systems, such as IT and OT. The probability of threat impact will be a function of the contribution of the probability of its occurrence in each of the above systems. Assumption 2: The risk, severity and probability values will depend on the level of dependency and interdependency between IT, OT, and IoT systems. Assumption 3: Risk and severity values will depend on the relationship of IT, IoT and OT systems with the social, economic and environmental pillars supported by IoT solutions. Assumption 4: The value of the risk will depend on the type of information in the IoT device, its physical location and the application supporting the IoT solution. Assumption 5: The value of the risk will depend on the security controls in place. Assumption 6: The value of the risk will depend on the types of attacks on the social, economic and environmental pillars supported by the IoT solution. Assumption 7: The value of the risk will depend on the number of attacks on IoT systems and the relationship these attacks may have, to improve their effectiveness. Assumption 8: The value of the risk will depend on the value of the surface attack and the vulnerability score of the IoT system. However, we cannot quantitatively evaluate these assumptions, because we do not know the weight of the contribution of each of the factors proposed for the security risk. In this third phase of the DRM, the aim is to support this understanding and reduce the bias of the authors of this study in the assumptions about the contribution of these factors of IoT devices to security risk. For this reason, we validated our assumptions through the judgment of experts. Therefore, we conducted a survey to obtain the opinions of experts in security and, then, based on an exploratory analysis, observed the association of their opinions with the factors of IoT devices and their relationships with security risk. For the exploratory analysis, we propose Principal Component Analysis (PCA) in an exploratory approach, because the factors of IoT devices and survey are new proposals from this study and are not previously used. For future work, it is possible to take into consideration the development of a new survey and use PCA in a confirmatory approach; for that, it is necessary to increase the number of experts in the survey [43,44]. The survey was based on a 10-point Likert scale using Google Forms. The research items from Table 4 and the second reference model were used to build the 27 questions in the survey. According to [45], an acceptable exploratory analysis can be performed with a value of 10 variables per case. Therefore, our goal for the survey was the acquisition of the opinion of at least 10 experts in cybersecurity to validate the factors of IoT devices and their relations, which were identified in the previous phases 1 and 2 of DRM. An extract of survey questions is shown in Figure 16. We obtained thirteen responses from security experts: three from the academia sector, three from the enterprise sector, one from the government sector, one from the international security industry, one from the national security industry, one from international organizations related with security standards, one from national organizations focused on security standards, and two from a community organization focused on security.