Future developments in cyber risk assessment for the internet of things
Open accessAbstract
This article is focused on the economic impact assessment of Internet of Things (IoT) and its associated cyber risks vectors and vertices – a reinterpretation of IoT verticals. We adapt to IoT both the Cyber Value at Risk model, a well-established model for measuring the maximum possible loss over a given time period, and the MicroMort model, a widely used model for predicting uncertainty through units of mortality risk. The resulting new IoT MicroMort for calculating IoT risk is tested and validated with real data from the BullGuard's IoT Scanner (over 310,000 scans) and the Garner report on IoT connected devices. Two calculations are developed, the current state of IoT cyber risk and the future forecasts of IoT cyber risk. Our work therefore advances the efforts of integrating cyber risk impact assessments and offer a better understanding of economic impact assessment for IoT cyber risk.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
A new IoT MicroMort model for calculating IoT risk has been introduced which can test and validate IoT-connected devices.
“A new IoT MicroMort model for calculating IoT risk has been introduced [38] which can test and validate IoT-connected devices.”
From IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process (2020) · cites this paper as [38]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Internet of Things (IoT): A vision, architectural elements, and future directions
Gubbi, J., Buyya, R., Marusic, S., & Palaniswami, M. (2013) · Future Generation Computer Systems · doi:10.1016/j.future.2013.01.010 · Cited by 12,293 · see citing works
International Organization for Standardization
Gargaud, M., Irvine, W. M., Amils, R., Pinti, D. L., Cernicharo, J., Rouan, D., Spohn, T., Tirard, S., & Viso, M. (2015) · Encyclopedia of Astrobiology · doi:10.1007/978-3-662-44185-5_100574 · Cited by 6,716 · see citing works
ISO (International Organization for Standardization)
Nollet, L. M. L. (2019) · CRC Press eBooks · doi:10.1201/9781315178592-10 · Cited by 1,902 · see citing works
Industry 4.0 and the current status as well as future prospects on logistics
Hofmann, E., & Rüsch, M. (2017) · Computers in Industry · doi:10.1016/j.compind.2017.04.002 · Cited by 1,855 · see citing works
The industrial internet of things (IIoT): An analysis framework
Boyes, H. A., Hallaq, B., Cunningham, J., & Watson, T. (2018) · Computers in Industry · doi:10.1016/j.compind.2018.04.015 · Cited by 1,496 · see citing works
The economics of information security investment
Gordon, L. A., & Loeb, M. P. (2002) · ACM Transactions on Information and System Security · doi:10.1145/581271.581274 · Cited by 1,341 · see citing works
A survey on trust management for Internet of Things
Yan, Z., Zhang, P., & Vasilakos, A. V. (2014) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2014.01.014 · Cited by 1,155 · see citing works
Value at risk: the new benchmark for controlling market risk
Jorion, P. (1996) · Medical Entomology and Zoology · Cited by 1,038 · see citing works
The Economics of Information Security
Anderson, R., & Moore, T. (2006) · Science · doi:10.1126/science.1130992 · Cited by 859 · see citing works
Leitão, P., Colombo, A. W., & Karnouskos, S. (2015) · Computers in Industry · doi:10.1016/j.compind.2015.08.004 · Cited by 674 · see citing works
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Caralli, R. A., Stevens, J. F., Young, L. R., & Wilson, W. R. (2007) · doi:10.21236/ada470450 · Cited by 294 · see citing works
Security and privacy in the internet of things
Maple, C. R. (2017) · Journal of Cyber Policy · doi:10.1080/23738871.2017.1366536 · Cited by 293 · see citing works
Schwing, R. C. (1980) · Springer eBooks · doi:10.1007/978-1-4899-0445-4 · Cited by 215 · see citing works
Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process
Caralli, R. A., Stevens, J. F., Young, L. R., et al. (2007) · KiltHub Repository · doi:10.1184/r1/6574790.v1 · Cited by 203 · see citing works
Cohen, E. A., & Gershenfeld, N. (1999) · Foreign Affairs · doi:10.2307/20049565 · Cited by 202 · see citing works
Security Risk Assessment in Internet of Things Systems
Nurse, J. R. C., Creese, S., & Roure, D. D. (2017) · IT Professional · doi:10.1109/mitp.2017.3680959 · Cited by 199 · see citing works
Gershenfeld, N. (1999) · Works - Scholarship, Research, & Creative Expression (Swarthmore College) · Cited by 189 · see citing works
Autonomic schemes for threat mitigation in Internet of Things
Ashraf, Q. M., & Habaebi, M. H. (2014) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2014.11.011 · Cited by 148 · see citing works
Risk-Based Adaptive Security for Smart IoT in eHealth
Abie, H., & Balasingham, I. (2012) · International Conference on Body Area Networks · doi:10.4108/icst.bodynets.2012.250235 · Cited by 132 · see citing works
Systems engineering framework for cyber physical security and resilience
DiMase, D., Collier, Z. A., Heffner, K., & Linkov, I. (2015) · Environment Systems & Decisions · doi:10.1007/s10669-015-9540-y · Cited by 129 · see citing works
On Making Life and Death Decisions
Howard, R. A. (1980) · Springer eBooks · doi:10.1007/978-1-4899-0445-4_5 · Cited by 126 · see citing works
Penas, O., Plateaux, R., Patalano, S., & Hammadi, M. (2016) · Computers in Industry · doi:10.1016/j.compind.2016.12.001 · Cited by 120 · see citing works
Introducing cybernomics: A unifying economic framework for measuring cyber risk
Ruan, K. (2016) · Computers & Security · doi:10.1016/j.cose.2016.10.009 · Cited by 91 · see citing works
Risk-based adaptive security for smart IoT in eHealth
Abie, H., & Balasingham, I. (2012) · International Conference on Body Area Networks · doi:10.5555/2442691.2442752 · Cited by 87 · see citing works
Johnson, L. R. (2019) · Elsevier eBooks · doi:10.1016/b978-0-12-818427-1.00012-4 · Cited by 84 · see citing works
A game-theoretic approach to model and quantify the security of cyber-physical systems
Orojloo, H., & Azgomi, M. A. (2017) · Computers in Industry · doi:10.1016/j.compind.2017.03.007 · Cited by 65 · see citing works
Sieber, D. A., & Adams, W. P. (2017) · Aesthetic Surgery Journal · doi:10.1093/asj/sjx127 · Cited by 55 · see citing works
A Survey of Trust Management for Internet of Things
Konsta, A.-M., Lafuente, A. L., & Dragoni, N. (2023) · IEEE Access · doi:10.1109/access.2023.3327335 · Cited by 50 · see citing works
Radanliev, P., Roure, D. D., Nurse, J. R. C., Nicolescu, R., Huth, M., Cannady, S., & Montalvo, R. M. (2018) · Living in the Internet of Things: Cybersecurity of the IoT · doi:10.1049/cp.2018.0041 · Cited by 41 · see citing works
Self-citationThe Economics of Information Security Investment
Gordon, L. A., & Loeb, M. P. (2006) · Kluwer Academic Publishers eBooks · doi:10.1007/1-4020-8090-5_9 · Cited by 39 · see citing works
2020 Cybercrime Economic Costs: No Measure No Solution
Armin, J., Thompson, B., Ariu, D., et al. (2015) · doi:10.1109/ares.2015.56 · Cited by 36 · see citing works
Cyber-Physical Systems: Opportunities, Challenges and (Some) Solutions
Marwedel, P., & Engel, M. (2016) · Internet of things · doi:10.1007/978-3-319-26869-9_1 · Cited by 27 · see citing works
A holistic roadmap for survivable infrastructure systems
Longstaff, T. A., & Haimes, Y. Y. (2002) · IEEE Transactions on Systems Man and Cybernetics - Part A Systems and Humans · doi:10.1109/tsmca.2002.1021113 · Cited by 26 · see citing works
Nurse, J. R. C., Radanliev, P., Creese, S., & Roure, D. D. (2018) · Living in the Internet of Things: Cybersecurity of the IoT · doi:10.1049/cp.2018.0001 · Cited by 26 · see citing works
Self-citationCybercrime Economic Costs: No Measure No Solution
Armin, J., Thompson, B., & Kijewski, P. (2016) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-319-38930-1_8 · Cited by 26 · see citing works
Internet of Things: realising the potential of a trusted smart world
Taylor, P. J., Allpress, S., Carr, M., Lupu, E., Norton, J., Smith, L., Blackstock, J. J., Boyes, H. A., Hudson‐Smith, A., Brass, I., et al. (2018) · Cited by 24 · see citing works
Self-citationThreat Assessment & Remediation Analysis (TARA): Methodology Description Version 1.0
Wynn, J., Whitmore, J. D., Upton, G., Spriggs, L., McKinnon, D., McInnes, R., Graubart, R. D., & Clausen, L. (2011) · Cited by 23 · see citing works
Risk information formalisation with graphs
Kamsu-Foguem, B., & Tiako, P. (2017) · Computers in Industry · doi:10.1016/j.compind.2016.12.004 · Cited by 22 · see citing works
González-Rojas, O., & Ochoa, L. (2017) · Computers in Industry · doi:10.1016/j.compind.2017.08.004 · Cited by 21 · see citing works
Schackelford, S. J. (2016) · Chapman University Digital Commons (Chapman University) · Cited by 21 · see citing works
Value analysis of cyber security based on attack types
Roumani, M. A., Fung, C., Rai, S., & Xie, H. (2015) · Murdoch University Research Portal · Cited by 14 · see citing works
Micromorts - what is the risk?
Fry, A. M., Harrison, A., & Daigneault, M. (2015) · British Journal of Oral and Maxillofacial Surgery · doi:10.1016/j.bjoms.2015.11.023 · Cited by 12 · see citing works
Biener, C., Eling, M., & Wirfs, J. H. (2014) · Alexandria (UniSG) (University of St.Gallen) · Cited by 12 · see citing works
Security, privacy and trust management in the internet of things era – SePriT
Sicari, S., Hailes, S. M. V., Turgut, D., Sharafeddine, S., & Desai, U. B. (2013) · Ad Hoc Networks · doi:10.1016/j.adhoc.2013.06.006 · Cited by 10 · see citing works
Radanliev, P. (2018) · SSRN Electronic Journal · doi:10.48550/arxiv.1810.10322 · Cited by 7 · see citing works
Self-citationSecurity and Privacy in the Internet of Things
(2020) · Chapman & Hall/CRC eBooks · doi:10.1201/9781003016304 · Cited by 5 · see citing works
Flagged first, then by citations
Research works printed but not linked: 4
- R. Koch and G. Rodosek, Proceedings of the 15th European Conference on Cyber Warfare and Security : ECCWS 2016 : hosted by Universitaẗ der Bundeswehr, Munich, Germany 7-8 July 2016. 2016.
- S. J. Ruffle, G. Bowman, F. Caccioli, A. W. Coburn, S. Kelly, B. Leslie, and D. Ralph, 'Stress Test Scenario: Sybil Logic Bomb Cyber Catastrophe,' Cambridge Risk Framew. Ser. Cent. Risk Stud. Univ. Cambridge., 2014.
- R. Rajkumar, I. Lee, L. Sha, J. Stankovic, Proceedings of the 47th Design Automation Conference on -DAC' 10, (2010) , pp. 731.
- G. Rodewald, Proceedings of the 2nd Annual Conference on Information Security Curriculum Development -InfoSecCD' 05, (2005) , pp. 139.
Cited by
Sorted by citations
Corallo, A., Lazoi, M., & Lezzi, M. (2020) · Computers in Industry · doi:10.1016/j.compind.2019.103165 · Cited by 298 · see citing works
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P. (2020) · EURASIP Journal on Information Security · doi:10.1186/s13635-020-00111-0 · Cited by 160 · see citing works
Wai, E., & Lee, C. K. M. (2023) · Applied Sciences · doi:10.3390/app132112008 · Cited by 29 · see citing works
“However, many legacy industrial devices were designed without basic security features in mind to protect these connections [25].”
Cyber Risk Management for the Internet of Things
Radanliev, P., Charles De Roure, D., R.C. Nurse, J., Burnap, P., Anthi, E., Uchenna, A., Maddox, L., Santos, O., & Mantilla Montalvo, R. (2019) · doi:10.20944/preprints201904.0133.v1 · Cited by 17 · see citing works
Self-citation
- Authors
- Radanliev, P., De Roure, D. C., Nicolescu, R., Huth, M., Montalvo, R. M., Cannady, S., & Burnap, P.
- Affiliations
- University of Oxford (GB)
- Imperial College London (GB)
- Cisco Systems (United States) (US)
- Corresponding author
- Radanliev, Petar
- Huth, Michael
- Montalvo, Rafael Mantilla
- Cannady, Stacy
- Venue
- Computers in Industry
- Publisher
- Elsevier BV
- Published
- 2018-11
- Volume
- 102
- Pages
- 14-22
- ISSN
- 0166-3615 (ISSN-L)
- OpenAlex
- W2887645765
- Cited by
- 162
- References
- 48
- Citations by year
- 2026: 9 · 2025: 6 · 2024: 14 · 2023: 29 · 2022: 17 · 2021: 29 · 2020: 28 · 2019: 30
- FWCI
- 35.10
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Computers in Industry (publishedVersion, cc-by)
- Munich Personal RePEc Archive (Ludwig Maximilian University of Munich) (acceptedVersion)
- ORCA Online Research @Cardiff (Cardiff University) (acceptedVersion)
- arXiv (Cornell University) (submittedVersion)
- Spiral (Imperial College London) (submittedVersion, other-oa)
- Funders
- UK EPSRC (EP/N02334X/1, EP/N023013/1)
- Cisco Research Centre (2017-169701 (3696))
- Fulbright Commission
- Topics
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Keywords
- Internet of Things, cybersecurity risk assessment, economic impact assessment, mortality risk, Internet of Things security, risk prediction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
