CoChat
Sign Up
Cited by 91Information and Cyber SecurityIoT and Edge/Fog ComputingInternet of Things and AI

Future developments in standardisation of cyber risk in the Internet of Things (IoT)

Open access
Radanliev, Petar, De Roure, David C., Nurse, Jason R. C., Mantilla Montalvo, Rafael, Cannady, Stacy, Santos, Omar, Maddox, La’Treall, Burnap, Peter +1 more·2020·SN Applied Sciences
DOI 10.1007/s42452-019-1931-0

Published version of a preprint

Open this paper in CoChat — free accountOpen PDF

Abstract

In this research article, we explore the use of a design process for adapting existing cyber risk assessment standards to allow the calculation of economic impact from IoT cyber risk. The paper presents a new model that includes a design process with new risk assessment vectors, specific for IoT cyber risk. To design new risk assessment vectors for IoT, the study applied a range of methodologies, including literature review, empirical study and comparative study, followed by theoretical analysis and grounded theory. An epistemological framework emerges from applying the constructivist grounded theory methodology to draw on knowledge from existing cyber risk frameworks, models and methodologies. This framework presents the current gaps in cyber risk standards and policies, and defines the design principles of future cyber risk impact assessment. The core contribution of the article therefore, being the presentation of a new model for impact assessment of IoT cyber risk.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s42452-019-1931-0

Cites

2 of 2 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Legacy industrial control systems and new IP-enabled sensors, instruments, controllers, and appliances often lack basic safeguards such as encryption, rigorous access controls, and endpoint security.

    “Legacy industrial control systems and new IP-enabled sensors, instruments, controllers, and appliances often lack basic safeguards like encryption, rigorous access controls, and endpoint security.”

    From Seamless Industry 4.0 Integration: A Multilayered Cyber-Security Framework for Resilient SCADA Deployments in CPPS (2023) · cites this paper as [25]

    Section 2.1.1 says integrating less-secured systems creates cyber risk, and section 7.4 says IoT devices are unable to secure themselves. Those passages support the general security concern, but the paper does not identify legacy control systems and the listed IP-enabled devices as often lacking encryption, rigorous access controls, or endpoint security. (LLM, conf=0.84)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 77

  1. Ezell BC, Bennett SP, von Winterfeldt D, Sokolowski J, Collins AJ (2010) Probabilistic risk analysis and terrorism risk. Risk Anal 30(4):575-589
  2. Davis G, Garcia A, Zhang W (2009) Empirical analysis of the effects of cyber security incidents. Risk Anal 29(9):1304-1316
  3. Ganin AA, Quach P, Panwar M, Collier ZA, Keisler JM, Marchese D, Linkov I (2017) Multicriteria decision framework for cyber- security risk assessment and management. Risk Anal. https :// doi.org/10.1111/risa.12891 · DOI
  4. Choi T-M, Lambert JH (2017) Advances in risk analysis with big data. Risk Anal 37(8):1435-1442
  5. Gisladottir V, Ganin AA, Keisler JM, Kepner J, Linkov I (2017) Resilience of cyber systems with over-and underregulation. Risk Anal 37(9):1644-1651
  6. Andrijcic E, Horowitz B (2006) A macro-economic framework for evaluation of cyber security risks related to protection of intellectual property. Risk Anal 26(4):907-923
  7. Henry MH, Haimes YY (2009) A comprehensive network security risk model for process control networks. Risk Anal 29(2):223-248
  8. Haimes YY (2018) Risk modeling of interdependent complex systems of systems: theory and practice. Risk Anal 38(1):84-98
  9. Santos JR, Haimes YY, Lian C (2007) A framework for linking cybersecurity metrics to the modeling of macroeconomic interdependencies. Risk Anal 27(5):1283-1297
  10. Nurse J, Creese S, De Roure D (2017) Security risk assessment in internet of things systems. IT Prof 19(5):20-26
  11. Mitic P (2019) Adaptive risk consensus models: simulations and applications. SN Appl Sci 1(12):1743
  12. Ortiz AM, Hussein D, Park S, Han SN, Crespi N (2014) The cluster between internet of things and social networks: review and research challenges. IEEE Internet Things J 1(3):206-215
  13. Paté-Cornell M-E, Kuypers M, Smith M, Keller P (2018) Cyber risk management for critical infrastructure: a risk analysis model and three case studies. Risk Anal 38(2):226-241
  14. Khorshidi E, Ghezavati VR (2019) Application of mathematical modeling value-at-risk (VaR) to optimize decision making in distribution networks. SN Appl Sci 1(12):1671
  15. Radanliev P et al (2019) Definition of cyber strategy transforma- tion roadmap for standardisation of IoT risk impact assessment with a goal-oriented approach and the internet of things micro mart. University of Oxford combined working papers and pro- ject reports prepared for the PETRAS National Centre of Excel- lence and the Cisco Research Centre, Oxford
  16. Wan J, Chen M, Xia F, Di L, Zhou K (2013) From machine-to- machine communications towards cyber-physical systems. Comput Sci Inf Syst 10(3):1105-1128
  17. Stojmenovic I (2014) Machine-to-machine communications with in-network data aggregation, processing, and actuation for large-scale cyber-physical systems. IEEE Internet Things J 1(2):122-128
  18. Drath R, Horch A (2014) Industrie 4.0: hit or hype? [industry forum]. IEEE Ind Electron Mag 8(2):56-58
  19. Marwedel P, Engel M (2016) Cyber-physical systems: oppor- tunities, challenges and (some) solutions. Springer, Berlin, pp 1-30
  20. Posada J et al (2015) Visual computing as a key enabling tech- nology for Industrie 4.0 and industrial internet. IEEE Comput Graph Appl 35(2):26-40
  21. Rodewald G (2005) Aligning information security investments with a firm's risk tolerance. In: Proceedings of the 2nd annual conference on information security curriculum development- InfoSecCD'05, p 139
  22. DiMase D, Collier ZA, Heffner K, Linkov I (2015) Systems engi- neering framework for cyber physical security and resilience. Environ Syst Decis 35(2):291-300
  23. Radanliev P, De Roure DC, Nurse JRC, Montalvo RM, Burnap P (2019) Standardisation of cyber risk impact assessment for the Internet of Things (IoT). University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford
  24. Radanliev P et al (2019) Cyber risk from IoT technologies in the supply chain-decision support system for the Industry 4.0. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford 40. Axon L, Alahmadi B, Nurse JRC, Goldsmith M, Creese S (2018) Sonification in security operations centres: what do security practitioners think?. In: Proceedings of the workshop on usable security (USEC) at the network and distributed system security (NDSS) symposium, pp 1-12
  25. Radanliev P et al (2019) New developments in cyber physical systems, the internet of things and the digital economy- future developments in the industrial internet of things and Industry 4.0. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford (preprints)
  26. Radanliev P et al (2019) Design principles for cyber risk impact assessment from Internet of Things (IoT). University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford
  27. Radanliev P et al (2019) Cyber risk impact assessment-assess- ing the risk from the IoT to the digital economy. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford (preprints)
  28. Radanliev P, De Roure D, Nicolescu R, Huth M (2019) A refer- ence architecture for integrating the Industrial Internet of Things in the Industry 4.0. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford
  29. Radanliev P et al (2019) Definition of internet of things (IoT) cyber risk-discussion on a transformation roadmap for stand- ardisation of regulations, risk maturity, strategy design and impact assessment. Oxford, preprints, arXiv :20190 3.0080.v1
  30. Radanliev P, Charles De Roure D, Nurse JRC, Burnap P, Montalvo RM (2019) Methodology for designing decision support supply chain systems for visualising and mitigating cyber risk from IoT technologies. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford
  31. Amintoosi H, Taresh AJ (2019) Sparse coding-based feature extraction for biometric remote authentication in Internet of Things. SN Appl Sci 1(9):1098
  32. Ribeiro L, Barata J, Ferreira J (2010) An agent-based interaction- oriented shop floor to support emergent diagnosis. In: 2010 8th IEEE international conference on industrial informatics, pp 189-194
  33. Weyer S, Schmitt M, Ohmer M, Gorecky D (2015) Towards Industry 4.0-standardization as the crucial challenge for highly modular, multi-vendor production systems. IFAC-PapersOnLine 48(3):579-584
  34. Hussain F (2017) Internet of things. Building blocks and busi- ness models. SpringerBriefs in Electrical and Computer Engi- neering (BRIEFSELECTRIC). https ://doi.org/10.1007/978-3-319- 55405 -1 · DOI
  35. Wang L (2013) Machine availability monitoring and machining process planning towards Cloud manufacturing. CIRP J Manuf Sci Technol 6(4):263-273
  36. Sokolov B, Ivanov D (2015) Integrated scheduling of material flows and information services in industry 4.0 supply networks. IFAC-PapersOnLine 48(3):1533-1538
  37. Benveniste A (2010) Loosely time-triggered architectures for cyber-physical systems. In: 2010 design, automation and test in Europe conference and exhibition Dresden, pp 3-8
  38. Benveniste A, Bouillard A, Caspi P (2010) A unifying view of loosely time-triggered architectures. In: Proceedings of the tenth ACM international conference on embedded software- EMSOFT'10, p 189
  39. Evans PC, Annunziata M (2012) Industrial internet: pushing the boundaries of minds and machines. General Electric 63. Banjanovic-Mehmedovic L, Zukic M, Mehmedovic F (2019) Alarm detection and monitoring in industrial environment using hybrid wireless sensor network. SN Appl Sci 1(3):263
  40. Medina-García J, Sánchez-Rodríguez T, Galán JAG, Delgado A, Gómez-Bravo F, Jiménez R (2017) A wireless sensor system for real-time monitoring and fault detection of motor arrays. Sensors (Switzerland) 17(3):469
  41. Feroz Khan AB, Anandharaj G (2019) A cognitive key man- agement technique for energy efficiency and scalability in securing the sensor nodes in the IoT environment: CKMT. SN Appl Sci 1(12):1575
  42. Giordano A, Spezzano G, Vinci A (2016) A smart platform for large-scale cyber-physical systems. Springer, Berlin, pp 115-134
  43. Waslo R, Lewis T, Hajj R, Carton R (2017) Industry 4.0 and cybersecurity in the age of connected production | Deloitte University Press. Deloitte University Press. https ://dupre ss.deloi tte.com/dup-us-en/focus /indus try-4-0/cyber secur ity-manag ing-risk-in-age-of-conne cted-produ ction .html. Accessed 04 Aug 2017
  44. Bhave A, Krogh B, Garlan D, Schmerl B (2010) Multi-domain modeling of cyber-physical systems using architectural views. In: Proc. Anal. Virtual Integr. Cyber-Physical Syst. Work
  45. Zhu Q, Rieger C, Basar T (2011) A hierarchical security archi- tecture for cyber-physical systems. In: 2011 4th international symposium on resilient control systems, pp 15-20
  46. Gladson SC, Narayana AH, Bhaskar M (2019) An ultra-low- power low-noise amplifier using cross-coupled positive feed- back for 5G IoT applications. SN Appl Sci 1(11):1418
  47. Niggemann O, Biswas G, Kinnebrew JS, Khorasgani H, Vol- gmann S, Bunte A (2015) Data-driven monitoring of cyber- physical systems leveraging on big data and the internet-of- things for diagnosis and control. In: International workshop on the principles of diagnosis (DX), pp 185-192
  48. Almeida L, Santos F, Oliveira L (2016) Structuring communica- tions for mobile cyber-physical systems. Springer, Berlin, pp 51-76
  49. Nicolescu R, Huth M, Radanliev P, De Roure D (2018) Map- ping the values of IoT. J Inf Technol 33(4):345-360. https :// doi.org/10.1057/s4126 5-018-0054-1 · DOI
  50. Taylor P, Allpress S, Carr M, Lupu E, Norton J, Smith L et al (2018) Internet of things realising the potential of a trusted smart world. Royal Academy of Engineering, London 75. Nicolescu R, Huth M, Radanliev P, De Roure D (2018) State of the Art in IoT-beyond economic value, London 76. Ruffle SJ et al (2014) Stress test scenario: sybil logic bomb cyber catastrophe. Cambridge risk framework series. Center for Risk Studies, University of Cambridge, Cambridge
  51. Ibrahim H et al (2019) A layered IoT architecture for green- house monitoring and remote control. SN Appl Sci 1(3):223
  52. Van Kleek M et al (2018) X-ray refine. In: Proceedings of the 2018 CHI conference on human factors in computing sys- tems-CHI'18, pp 1-13
  53. Hermann M, Pentek T, Otto B (2016) Design principles for Industrie 4.0 scenarios. In: 2016 49th Hawaii international conference on system sciences (HICSS), 2016, pp 3928-3937
  54. Anthonysamy P, Rashid A, Chitchyan R (2017) Privacy require- ments: present and future. In: 2017 IEEE/ACM 39th interna- tional conference on software engineering: software engi- neering in society track (ICSE-SEIS), 2017, pp 13-22
  55. Esteve A (2017) The business of personal data: Google, Face- book, and privacy issues in the EU and the USA. Int Data Priv Law 7(1):36-47
  56. Hindman M (2018) How Cambridge Analytica's Facebook tar- geting model really worked-according to the person who built it
  57. Arnold CC, Teppler SW (2018) Class action complaint against defendants Facebook, Inc. and Cambridge analytica, pp 1-15
  58. Wan J, Cai H, Zhou K (2015) Industrie 4.0: enabling technolo- gies. In: Proceedings of 2015 international conference on intel- ligent computing and internet of things, 2015, pp 135-140
  59. Kolberg D, Zühlke D (2015) Lean automation enabled by Indus- try 4.0 Technologies. IFAC-PapersOnLine 48(3):1870-1875
  60. Steup M (2005) Epistemology: Stanford encyclopedia of phi- losophy. Stanford University, Center for the Study of Language and Information (U.S.), Stanford 91. Wenning CJ (2009) Scientific epistemology: how scientists know what they know. J Phys Teach Educ Online 5(2):3-16 92
  61. Liao Y, Deschamps F, Loures EDFR, Ramos LFP (2017) Past, pre- sent and future of Industry 4.0-a systematic literature review and research agenda proposal. Int J Prod Res 55(12):3609-3629
  62. IVI. Industrial Value Chain Initiative (2016) An outline of smart manufacturing scenarios 2016. In: Monozukuri Nippon conference 110. AMP (2013) Advanced manufacturing partnership 111. METI (2015) NRS, new robot strategy-vision strategy and action plan; ministry of economy trade and industry of Japan 112. METIJ (2015) RRI, robot revolution initiative-summary of Japan's robot strategy-it's vision, strategy and action plan. Ministry of Economy, Trade and Industry of Japan 113.
  63. Radanliev P, De Roure DC, Nurse JRC, Montalvo RM, Burnap P (2019) The industrial internet-of-things in the Industry 4.0 sup- ply chains of small and medium sized enterprises. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford 122.
  64. Radanliev P (2015) Green-field architecture for sustainable supply chain strategy formulation. Int J Supply Chain Manag 4(2):62-67 123.
  65. Radanliev P (2015) Architectures for green-field supply chain integration. J Supply Chain Oper Manag 13(2):56-78 124.
  66. Radanliev P (2015) Engineering design methodology for green- field supply chain architectures taxonomic scheme. J Oper Sup- ply Chain Manag 8(2):52-66 125.
  67. Radanliev P, Rowlands H, Thomas A (2014) Supply chain para- dox: green-field architecture for sustainable strategy formula- tion. In: Cardiff: sustainable design and manufacturing 2014, part 2, international conference, 2014, pp 839-850 126.
  68. Radanliev P, De Roure DC, Nurse JRC, Rafael MM, Burnap P (2019) Supply chain design for the industrial internet of things and the Industry 4.0. University of Oxford combined working papers and project reports prepared for the PETRAS National Centre of Excellence and the Cisco Research Centre, Oxford 127.
  69. Radanliev P (2016) Supply chain systems architecture and engi- neering design: green-field supply chain integration. Oper Sup- ply Chain Manag Int J 9(1):22-30 128.
  70. Allodi L, Massacci F (2017) Security events and vulner- ability data for cybersecurity risk estimation. Risk Anal 37(8):1606-1627 137.
  71. Öğüt H, Raghunathan S, Menon N (2011) Cyber security risk management: public policy implications of correlated risk, imperfect ability to prove loss, and observability of self-pro- tection. Risk Anal 31(3):497-512 138.
  72. U.S. Department of Commerce. https :// doi.org/10.6028/NIST.SP.800-150 139. · DOI
  73. Conee E, Feldman R (2004) Evidentialism. Oxford University Press, Oxford 140.
  74. Pugh S (1991) Total design: integrated methods for successful product engineering. Addison-Wesley Publishing Company, p 278 142.
  75. Eggenschwiler J, Agrafiotis I, Nurse JR (2016) Insider threat response and recovery strategies in financial services firms. Comput Fraud Secur 2016(11):12-19 143.
  76. de Reuver M, Sørensen C, Basole RC (2017) The digital plat- form: a research agenda. J Inf Technol 33(2):1-12. https ://doi. org/10.1057/s4126 5-016-0033-3 144. · DOI · Paper page
  77. Strader TJ, Lin F-R, Shaw MJ (1999) Business-to-business elec- tronic commerce and convergent assembly supply chain man- agement. J Inf Technol 14(4):361-373 147.

Cited by

Sorted by citations

Authors
Radanliev, P., De Roure, D. C., Nurse, J. R. C., Mantilla Montalvo, R., Cannady, S., Santos, O., Maddox, L., Burnap, P., & Maple, C.
Affiliations
  • University of Oxford (GB)
  • University of Kent (GB)
  • University of Warwick (GB)
Corresponding author
Radanliev, Petar
ORCID
Venue
SN Applied Sciences
Publisher
Springer Science and Business Media LLC
Published
2020-01-08
Volume
2
Issue
2
ISSN
  • 2523-3963 (ISSN-L)
  • 2523-3971
DOI
10.1007/s42452-019-1931-0
OpenAlex
W2922525752
Cited by
91
References
2
Citations by year
2026: 4 · 2025: 6 · 2024: 8 · 2023: 10 · 2022: 9 · 2021: 25 · 2020: 22 · 2019: 7
FWCI
15.52
Type
journal article
Language
en
Open access
Licence
Locations
  • SN Applied Sciences (publishedVersion, cc-by)
  • Preprints.org (acceptedVersion, cc-by)
  • Kent Academic Repository (University of Kent) (acceptedVersion)
  • Warwick Research Archive Portal (University of Warwick) (acceptedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
  • Engineering and Physical Sciences Research Council
  • Cisco Systems
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
Keywords
Internet of Things, cybersecurity risks, risk assessment standards, economic impact assessment, design process, grounded theory, constructivist epistemology, risk management model

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review