# A Survey on Cyber Risk Management for the Internet of Things
## 4 Cyber Risk Assessment for IoT Survey Results
### IoT Cyber Risk Identification
#### 4.1.7 Identification of Likelihood  
In risk management, likelihood simply refers to the \"chance of something happening\" [7]. Likelihood can be represented in a qualitative, quantitative, or semi-qualitative way, with IoT cyber risk management frameworks commonly using numerical scales [45; 46; 49; 50; 53; 54; 58] and quantitative scales [64; 75; 76].  
In the IoT cyber risk management literature, the most used likelihood parameter is the probability of an attack occurring [40; 57; 63] to predict the change of an attack happening; given the configuration of a device, different attack capabilities can be used, which affects the likelihood of exploitation. This probability can be used to predict the likelihood of an attack happening, given the specific configuration of a device.  
[PERSON] et al. [44] utilise the likelihood of an IoT vulnerability being used to trigger a successful attack while also monitoring maintained behaviour over time, considering the probability that a node would be violated again based on prior behaviour. [PERSON] et al. [51] use the OWASP IoT Top 10 to predict the probability of an IoT threat occurring, while [PERSON] et al. [71] present the likelihood of attacks on each specific IoT network node.  
Rather than estimating the probability of an attack occurring, [PERSON] et al. [73] focus on the probability of an IoT vulnerability causing damage due to threat exploitation. Meanwhile, [PERSON] et al. [46] consider the frequency of an IoT system being targeted to better understand the number of times an attack may occur, and [PERSON] et al. [59] consider the probability that a vulnerable IoT node can be infected, recover, and become vulnerable again.  
Several factors can influence the probability of an IoT attack occurring. In some cases, researchers target IoT attributes that would allow an attacker to conduct an attack. [PERSON] et al. [48] use a methodology which assesses the skills, physical accessibility, logical accessibility, attack vector, and vulnerabilities that an IoT attacker would need to uncover the likelihood of potential threats. [PERSON] et al. [74] define the probability of an attack based on the IoT attacker's expertise, equipment, physical proximity to a system, device access time, and IoT device information.  
[PERSON] et al. [60], [PERSON] et al. [43] and [PERSON] et al. [52] assess the attacker capabilities (ease of attack) and motivation as well as the readiness of a healthcare provider to defend against attacks. Within the work of [PERSON] et al. [43], readiness is represented as a user's lack of training and knowledge as well as the degree to which a healthcare provider is prepared to \"detect, report, and respond\" to an attack. In turn, [PERSON] et al. [67] consider the risk appetite of users, referring to how high-risk behaviours can affect the likelihood of an attack happening and gauging whether users can effectively prevent and respond to attacks.  
_Insight 7:_ In line with RQ1, the probabilities surrounding threat events need to be identified. The IoT likelihood needs to be clearly defined, for example, the probability of an attack occurring [40; 57; 63] or the frequency of an IoT system being targeted [46]. Predicting attacker attributes allows for a better understanding of how easy an attack may be, with attributes such as accessibility, skills, and equipment being common themes within the surveyed papers. Overall, an IoT likelihood scale needs to be suitable for the assessed environment based on the types of attacks that can be faced; this also means identifying the factors which can affect the likelihood.