# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.4 Identification of Vulnerabilities  
Vulnerabilities are the weaknesses in \"information systems, system security procedures, internal controls, or implementation\" that could be exploited by a threat source [16]. Within an overwhelming number of IoT cyber risk management papers, the identification of vulnerabilities is simply a phase within the framework and is not often expanded on [38,41,43,44,45,47,52,55,60,65,66,70,74,76, 43,7], with more emphasis on using vulnerabilities for threat modelling. For example, the use of a threat modelling phase requires exploitable vulnerabilities and how these link to threat actors [40]. In other papers, vulnerability identification is undertaken by using various knowledge bases and methodologies that may also be used for threats, such as OWASP [51,64], NVD [50], CRAMM (CCTA Risk Analysis and Management Method) [49], the MITRE CVE list [53,54], and STRIDE [42,59,71]. Risk-related attributes can be used to indicate vulnerabilities [69] as well as contextual information gathered by monitoring an IoT system [46] that could make it easier to find weaknesses. [PERSON] and [PERSON] [61] link vulnerabilities to IoT security requirements, tools for testing vulnerabilities, and threat models to formulate an attack surface. Not only this but vulnerabilities can be linked to attributes like external entities, trust boundaries, data flows, and entry points [73]. Part of this information may relate to the prioritisation of vulnerabilities due to their criticality based on the potential impact [68] or an increased likelihood of being targeted [56,62]. The commonality of vulnerabilities may also be prioritised due to the potential ease of exploit [48]. Vulnerabilities may be simplified into classifications based on risk-related attributes. For example, [PERSON] and [PERSON] [53; 54] categorise vulnerabilities into software weaknesses and insecure configurations for devices and networks, while [PERSON] et al. [52] propose eight vulnerability types for general IoT domains. Within the work of [PERSON] [57], vulnerabilities are associated within a single or multi-state state attack, where more complex attacks exploit vulnerabilities to have multiple outcomes. In contrast, [PERSON] et al. [68] uncover vulnerabilities for several devices, these being smart pacemakers, IP cameras, and radio frequency identification devices (RFIDs). [PERSON] et al. [75] propose a classification approach for identifying and assessing cyber risks in IoT systems. The approach categorises threats and vulnerabilities into different risk categories based on attacker factors, such as cyber, physical, and psychological. In addition, the approach also considers the specific IoT components that an attacker might target, such as software or hardware, and breaks down vulnerabilities based on these targets. An attacker's capabilities may also play a part in identifying vulnerabilities [63]. One subset of IoT vulnerabilities relates to human vulnerability/human weaknesses in relation to IoT systems. Human vulnerabilities express the ways that humans can be vulnerable to IoT attacks, which is increasingly more concerning with the large amount of personal information and increased attack surface brought by IoT technology [83]. While an IoT device's software can be updated and patched, humans are not as simple. Humans may be susceptible to psychological attacks or simply not be aware that their actions could lead to an attack. For example, if a user were to fall victim to social engineering, the reason may be a lack of training and awareness of what social engineering is and how it can compromise a system. This notable increase is due to there being more mediums for social engineering than before [84], with IoT devices carrying more capabilities than traditional IT. Risky user actions can pose as IoT weaknesses, where users with a higher risk appetite can increase the likelihood of an attack happening due to the lack of cyber hygiene.