CoChat
Sign Up
Cited by 160Information and Cyber SecurityIoT and Edge/Fog ComputingInternet of Things and AI

IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process

Open access
Kandasamy, Kamalanathan, Srinivas, Sethuraman, Achuthan, Krishnashree, Rangan, Venkat P.·2020·EURASIP Journal on Information Security
DOI 10.1186/s13635-020-00111-0
Open this paper in CoChat — free accountOpen PDF

Abstract

Security vulnerabilities of the modern Internet of Things (IoT) systems are unique, mainly due to the complexity and heterogeneity of the technology and data. The risks born out of these IoT systems cannot easily fit into an existing risk framework. There are many cybersecurity risk assessment approaches and frameworks that are under deployment in many governmental and commercial organizations. Extending these existing frameworks to IoT systems alone will not address the new risks that have arisen in the IoT ecosystem. This study has included a review of existing popular cyber risk assessment methodologies and their suitability to IoT systems. National Institute of Standards and Technology, Operationally Critical Threat, Asset, and Vulnerability Evaluation, Threat Assessment & Remediation Analysis, and International Standards Organization are the four main frameworks critically analyzed in this research study. IoT risks are presented and reviewed in terms of the IoT risk category and impacted industries. IoT systems in financial technology and healthcare are dealt with in detail, given their high-risk exposure. Risk vectors for IoT and the Internet of Medical Things (IoMT) are discussed in this study. A unique risk ranking method to rank and quantify IoT risk is introduced in this study. This ranking method initiates a risk assessment approach exclusively for IoT systems by quantifying IoT risk vectors, leading to effective risk mitigation strategies and techniques. A unique computational approach to calculate the cyber risk for IoT systems with IoT-specific impact factors has been designed and explained in the context of IoMT systems.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper reviews major cyber risk assessment frameworks (NIST, OCTAVE, TARA, ISO) for IoT suitability and argues existing frameworks need customization because IoT risks are complex, heterogeneous, and often not quantified. It proposes a novel IoT risk-scoring method using IoT-specific impact and likelihood factors, demonstrated on IoMT devices such as pacemakers and blood sugar monitors.

Key findings

  • NIST, OCTAVE, TARA, and ISO are critically analyzed; all four cover CIA principles, but NIST, OCTAVE, and TARA do not quantify risk, while ISO promotes standardization and compliance.
  • In healthcare, NIST is the most used security framework at 57.9%, followed by HITRUST at 26.4%; a cited survey reports 82% of healthcare industries have undergone IoT-focused cyber attacks, with 230 of 700 respondents from healthcare.
  • The paper introduces risk ranking as `rr = impact × likelihood`, with risk rank ranges: 81–100 very high, 51–80 high, 21–50 medium, 5–20 low, and 0–4 very low.
  • The proposed IoT risk computation is `r(d) = w(d) × s(d)`, where impact `w(d) = [nwt + prt + het + des + cia]/5` and likelihood `S(d) = [pat + lyr + scr + drf]/4`; example scores are 72 (high) for a pacemaker side-channel attack and 36 (medium) for blood sugar monitor tampering.

Methods

  • Design: a review and critical analysis of existing cyber risk assessment frameworks and their suitability for IoT, plus a proposed computational risk-scoring model with IoT-specific impact and likelihood parameters.
  • Data/sample: literature-based analysis of frameworks, IoT/IoMT risk vectors, and illustrative IoMT device examples; no primary empirical dataset is collected.
  • Main analysis: qualitative comparison of NIST, OCTAVE, TARA, and ISO, followed by formula-based risk scoring applied to IoMT examples using weighted parameters such as network type, protocol susceptibility, heterogeneity, device security, CIA impact, past attacks, IoT layer, sector, and device risk factor.

Limitations

  • Stated: there are no standard IoT risk frameworks currently available; existing frameworks can be modified for IoT but most do not quantify risk, and more work is needed to enhance awareness of medical device cybersecurity risks.
  • Evident from the text: the proposed model is demonstrated only on selected IoMT examples, with weights and parameter values assigned in tables rather than empirically validated across a broader IoT dataset.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1186/s13635-020-00111-0

Cites

56 of 56 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 47 cited sources checked · 0 supported · 0 flagged

  • Findingcitation

    The network layer of IoT/IoMT undergoes a number of attacks.

    “It is observed that the network layer of IoT/IoMT undergoes a number of attacks [77].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [77] S. Shiva et al, Security and privacy in the Internet of Medical Things: taxonomy and risk assessment, 2017, DOI: https://doi.org/10.1109/LCN.Workshops.2017.72 source

      Not checked in the free run.

  • Findingcitation

    There are four types of IoT risk vector classes: cloud-related, real time-oriented, autonomous, and recovery-related.

    “There are four types of IoT risk vector classes that have been identified: cloud-related, real time-oriented, autonomous, and recovery-related.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [36] Petar Radanliev, David C. De Roure et al, Standardisation of cyber risk impact assessment for the Internet of Things, Oxford e-Research Center, University of Oxford, 2018

      Not checked in the free run.

  • Findingnone given

    Though encryption is done, there are chances for some BLE devices to be affected by Man in the Middle (MitM) attacks.

    “Though encryption is done, there are chances for some BLE devices to be affected by Man in the Middle (MitM) attacks.”
    Quote in the paperNot a substantial claim
  • Findingnone given

    The proposed IoT risk computational model computes risk impact and risk likelihood, leading to a risk score.

    “The highpoint of this work is the introduction of a novel IoT risk computational model, that computes risk impact and risk likelihood, leading to risk score.”
    Quote in the paperSubstantial claim
  • Findingcitation

    Network traffic is intercepted by the attacker through impersonation.

    “Network traffic is intercepted by the attacker through impersonation [66].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [66] T. Melamed, An active man-in-the-middle attack on bluetooth smart devices (WIT Press, 2018). https://doi.org/10.2495/SAFE-V8-N2-200-211 source

      Not checked in the free run.

  • Classified as probably not a substantial claim. 77
  • May combine two claims. 35

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    IoMT has privacy and security issues in all layers like IoT.

    “IoMT has privacy and security issues in all layers like IoT.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    The risk rank for an IoT risk vector categorizes risks into low, medium, or high categories.

    “Risk rank for IoT risk vector categorizes the risks into low, medium, or high categories.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    If the risk rank is very high, then the risk has a severe impact.

    “If the risk rank is very high, then the risk has a severe impact.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingnone given

    BLE has risks including Man in the Middle (MitM) attacks, replay attacks, and network communication decryption.

    “BLE has risks including Man in the Middle (MitM) attacks, replay attacks, and network communication decryption.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    High and very high risks have high impacts.

    “High and very high risks need better treatment as their impacts are high.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Findingnone given

    There are heavy challenges in implementing IoMT devices including the high infrastructure cost, security concerns, load with the existing network, and lack of standardization.

    “There are heavy challenges in implementing IoMT devices including the high infrastructure cost, security concerns, load with the existing network, and lack of standardization.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    Risks with rank ≤ 10 come under a very low level.

    “There are risks with rank ≤ 10 and these risks come under a very low level since they are not worthy to be considered.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Findingown data

    As discussed in Table 4, the risk score range of 21-50 falls in medium risk level and the risk score range of 51-80 falls in high-risk level.

    “As discussed in Table 4, the risk score range of 21-50 falls in medium risk level and the risk score range of 51-80 falls in high-risk level.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    When the pacemaker undergoes side-channel attack, the risk score is 72, which represents a higher risk level compared to the tampering attack of the blood sugar monitor which comes under the medium risk level.

    “For example, when the pacemaker undergoes side-channel attack, we calculate the impact of the attack and its likelihood with the formulae explained above and derive the risk score to be 72, which represents a higher risk level when compared to the tampering attack of the blood sugar monitor which comes under the medium risk level.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    There are five levels shown for IoT risks based on the rank calculation.

    “There are five levels shown for IoT risks based on the rank calculation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Findingnone given

    Denial of service (DoS) attacks are also possible.

    “Denial of service (DoS) attacks are also possible.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning

    Tampering of blood sugar monitor leads to the risk impact factor of 6 and the risk likelihood factor of 6, and hence, the risk score is 36 which represents a medium risk level.

    “In the same way, tampering of blood sugar monitor leads to the risk impact factor of 6 and the risk likelihood factor of 6, and hence, the risk score is 36 which represents a medium risk level.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given

    When the IoT device does not support the use of strong credentials, weightage 95 is given to this IoT vector along with 0.9 as a risk score which calculates the risk rank as 85.

    “For example, when the IoT device does not support the use of strong credentials, weightage 95 is given to this IoT vector along with 0.9 as a risk score which calculates the risk rank as 85.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingnone given

    In the pacemaker scenario, when the pacemaker is not secured (des = 10) along with a few heterogeneous systems (het = 5), it undergoes side-channel attacks due to unsecured network (nwt = 10) and the protocols susceptible to attacks (prt = 10).

    “In the above scenario, when the pacemaker is not secured (des = 10) along with a few heterogeneous systems (het = 5), it undergoes side-channel attacks due to unsecured network (nwt = 10) and the protocols susceptible to attacks (prt = 10).”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingcitation

    Patients in general appear to be unaware of the dangers of cyber attacks, and they consider the security of their implanted medical devices (IMDs) as a secondary aspect.

    “Patients in general appear to be unaware of the dangers of cyber attacks, and they consider the security of their implanted medical devices (IMDs) as a secondary aspect [69] perhaps due to lack of adequate awareness.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [69] R. Altawy et al., Security tradeoffs in cyber physical systems: a case study survey on implantable medical devices, EEE, 2016. DOI: Digital Object Identifier. https://doi.org/10.1109/ACCESS.2016.2521727 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Dempster-Shafer Theory of Belief Functions is used to model uncertainties in the risk assessment process.

    “Dempster-Shafer Theory of Belief Functions is used to model uncertainties in the risk assessment process [21].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [21] R. Srivastava, An information systems security risk assessment model under Dempster-Shafer Theory of belief functions. Journal of Management Information Systems 22(4), 109–142 (2006) source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    CIA (confidentiality, integrity, availability) is compromised if IoT devices have insecure network services.

    “Confidentiality, integrity, and availability (CIA) will be compromised if the IoT devices have insecure network services.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The healthcare sector is the largest target of cybersecurity attacks in the USA, compared to industrial and financial institutions.

    “The healthcare sector is the largest target of cybersecurity attacks in the USA, compared to industrial and financial institutions [15].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [15] Marwedel, P. & Engel, M. Cyber-physical systems: opportunities, challenges and (some) solutions. in 1–30 (Springer International Publishing, 2016). doi:10.1007/978-3-319-26869-9_1

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    Security vulnerabilities of modern IoT systems are unique, mainly due to the complexity and heterogeneity of the technology and data.

    “Security vulnerabilities of the modern Internet of Things (IoT) systems are unique, mainly due to the complexity and heterogeneity of the technology and data.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    Common IoT vulnerabilities arise due to complex architecture, inappropriate security configuration, physical security, and insecure firmware or software.

    “Common IoT vulnerabilities arise due to the following factors: (a) complex architecture, (b) inappropriate security configuration, (c) physical security, and (d) insecure firmware or software [5].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [5] Minhaj Ahmad Khan, Khaled Salah, IoT Security: review, blockchain solutions, and open challenges, future generation computer systems, Nov 2017, doi: 10.1016/j.future.2017.11.022 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    Attacks on IoT devices are possible if firmware is not validated or anti-rollback mechanisms are not in place.

    “Attacks are possible if either the firmware on the device is not validated or if the anti-rollback mechanisms are not in place.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    If vulnerabilities in IoT devices or the IoT environment are exploited by threats in the system, it leads to IoT risks.

    “If the vulnerabilities in IoT devices (or the IoT environment) are exploited by threats in the system, it leads to IoT risks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    IoT attacks are classified based on IoT architecture and application scenarios.

    “IoT attacks are classified based on IoT architecture and application scenarios [10].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [10] K. Chen, S. Zhang, Z. Li, Y. Zhang, Q. Deng, S. Ray, Y. Jin, Internet-of-Things security and vulnerabilities: taxonomy, challenges, and practice. Journal of Hardware and Systems Security 2, 97–110 (2018) source

      Not checked in the free run.

  • May combine two claims.

    Premisenone given

    All three IoT layers-application, network, and hardware-have security issues.

    “All three IoT layers, namely application, network, and hardware layers, have security issues.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationnone given

    The constantly expanding IoT threat landscape warrants a study of IoT risks and its mitigation.

    “The constantly expanding IoT threat landscape warrants a study of IoT risks and its mitigation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    A multidimensional methodology that incorporates both FMEA and fuzzy set theory is utilized for the risk management process.

    “A multidimensional methodology that incorporates both FMEA (Failure Mode and Effects Analysis) and fuzzy set theory is utilized for the risk management process [24].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [24] Maisa Mendonca Silva et al, A multidimensional approach to information security risk management using FMEA and fuzzy theory, International Journal of Information Management, 2014.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    NIST framework is well documented and provides guidance on risk assessment and management implementation.

    “The National Institute of Standards and Technology (NIST) [29] framework is well documented and provides guidance on risk assessment and management implementation [30]”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [29] NIST, C. Cybersecurity framework NIST. https://www.nist.gov

      Not checked in the free run.

    • cites [30] M. Barrett, J. Marron, V. Yan Pillitteri, J. Boyens, G. Witte, L. Feldman, Draft NISTIR 8170, The cybersecurity framework: implementation guidance for federal agencies (2017)

      Not checked in the free run.

  • May combine two claims.

    Premisecitation

    Threat Assessment & Remediation Analysis (TARA) facilitates system recovery but fails in addressing the cyber risk impact level.

    “Threat Assessment & Remediation Analysis (TARA) is one such example that facilitates system recovery but fails in addressing the cyber risk impact level [34].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [34] Wynn, J., Whitmore, G., Upton, L., Spriggs, D., McKinnon, R., McInnes, R., Clausen, J. Threat Assessment & Remediation Analysis (TARA) Methodology Description Version 1.0. (2011).

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    In IoT systems, failure can also happen when the assessment is done for the processes through which devices are bound, i.e., the connections that allow these devices to couple and operate.

    “In IoT systems, failure can also happen when the assessment is done for the processes through which devices are bound i.e., the connections that allow these devices to couple and operate.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Premisecitation

    OCTAVE helps to find out various security vulnerabilities of IoT-based smart homes, presents the risks on home inhabitants, and proposes approaches to mitigate the identified risks.

    “OCTAVE helps to find out various security vulnerabilities of IoT-based smart homes, presents the risks on home inhabitants, and proposes approaches to mitigate the identified risks.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [42] B. Ali et al., Cyber and physical security vulnerability assessment for IoT-based smart homes. Journal of Sensors 18, 817 (2018). https://doi.org/10.3390/s18030817 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Sensor nodes, smart devices, and wearable devices used in the IoT domain are resource-constrained devices.

    “Sensor nodes, smart devices, and wearable devices that are used in the IoT domain are resourceconstrained devices.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    New methodologies to assess risk considering the dynamics and uniqueness of IoT have been described elsewhere.

    “New methodologies to assess risk considering the dynamics and uniqueness of IoT have been described elsewhere [35].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [35] Jason R. C. Nurse et al, Security risk assessment in Internet of Things systems, University of Oxford, 2018

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    NIST has three goals concerning IoT risk management-to protect device security, data security, and privacy of individuals.

    “NIST has three goals concerning IoT risk management-to protect device security, data security, and privacy of individuals.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Premisenone given

    The IoT environment deals with a lot of heterogeneous devices, and these devices might be vulnerable to cyber attacks.

    “The IoT environment deals with a lot of heterogeneous devices, and these devices might be vulnerable to cyber attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    NIST is a widely used framework for risk management, and it is highly suited for disaster and recovery planning in domains involving IoT systems.

    “NIST is a widely used framework for risk management, and it is highly suited for disaster and recovery planning in domains involving IoT systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based). May combine two claims.

    Interpretationreasoning

    Vulnerabilities drastically increase the risks born due to IoT devices, thereby mandating the need for a structured risk assessment process that is usually part of risk assessment frameworks.

    “Vulnerabilities drastically increase the risks born due to IoT devices, thereby mandating the need for a structured risk assessment process that is usually part of risk assessment frameworks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    NIST IR 8228 documents the potential challenges with IoT devices and risk considerations in achieving device and data security.

    “NIST IR 8228 [31] documents the potential challenges with IoT devices and risk considerations in achieving device and data security.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] Katie Boeckl et al, NISTIR 8228, Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks, June 2019 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    Lack of firmware validation on a device can lead to CIA triad violation and non-compliance.

    “lack of firmware validation on a device can lead to CIA triad violation and non-compliance”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    The McAfee Mobile Threat Report 2019 highlights the increasing proliferation of IoT devices leading to possible points of attack at homes.

    “The McAfee Mobile Threat Report 2019 [27] highlights the increasing proliferation of IoT devices leading to possible points of attack at homes.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [27] McAfee Mobile Threat Report, https://www.mcafee.com/enterprise/en-us/.../reports/rp-mobile-threat-report-2019.pdf

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Cyber Security Game (CSG) is a method to distinguish digital security hazards quantitatively and use this measurement to decide the ideal use of safety techniques for any specified systems for any predetermined venture level.

    “Cyber Security Game (CSG) [23] is a method to distinguish digital security hazards quantitatively and use this measurement to decide the ideal use of safety techniques for any specified systems for any predetermined venture level.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [23] Scott Musman et al, A game theoretic approach to cyber security risk management, Journal of DefenseModeling and Simulation: Applications, Methodology, Technology, 2018, Vol 15(2). source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    The IoT environment deals with various connectivity models and devices which may not support the CIA triad.

    “The IoT environment deals with various connectivity models and devices which may not support the CIA triad.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisereasoning

    Though IoT devices are flexible and interoperable, they increase the attack surface.

    “Though IoT devices are flexible and interoperable, they increase the attack surface.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning

    IoT systems have to be continuously assessed.

    “IoT systems have to be continuously assessed.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    Qualitative and quantitative methods are combined in a few systems.

    “Qualitative and quantitative methods are combined in a few systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    NIST has special considerations for IoT risk management.

    “However, NIST has special considerations for IoT risk management.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    OCTAVE is a qualitative risk assessment framework that proposes eight steps.

    “OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is another qualitative risk assessment framework that proposes eight steps [32].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [32] R.A. Caralli, J.F. Stevens, L.R. Young, W.R. Wilson, Introducing OCTAVEAllegro: improving the information security risk assessment process (2007) source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    Use of insecure OS platforms and use of components from a compromised supply chain could allow the device to be compromised.

    “use of insecure OS platforms and the use of components from a compromised supply chain could allow the device to be compromised”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    A Core Unified Risk Framework (CURF) compares different existing methods and provides a measure of completeness.

    “A Core Unified Risk Framework (CURF) [41] compares different existing methods and provides a measure of completeness.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [41] Gaute Wangen, ChristofferHallstensen, and Einar Snekkenes. A framework for estimating information security risk assessment method completeness - Core Unified Risk Framework, 2017, Springer International Journal of Information Security. source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    A new IoT MicroMort model for calculating IoT risk has been introduced which can test and validate IoT-connected devices.

    “A new IoT MicroMort model for calculating IoT risk has been introduced [38] which can test and validate IoT-connected devices.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [38] Petar Radanliev, David Charles De Roure et al, Future developments in cyber risk assessment for the internet of things, Elsevier, Computers in Industry 2018. source

      Not checked in the free run.

  • Classified as probably not a substantial claim.

    Premisenone given

    Assets are treated as values of organizations in traditional risk assessment approaches.

    “Assets are treated as values of organizations in traditional risk assessment approaches”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    An IoT security certification methodology for assessing security solutions in an automated way has also been proposed.

    “An IoT security certification methodology for assessing security solutions in an automated way has also been proposed [39].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [39] Sara N. Matheu-Garcia, José L. Hernández-Ramos, Antonio F. Skarmeta, Risk-based automated assessment and testing for the cybersecurity certification and labelling of IoT devices, GianmarcoBaldini Computer Standards & Interfaces, 2018, DOI : https://doi.org/10.1016/j.csi.2018.08.003 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    Lack of hardening of devices leads to vulnerabilities.

    “lack of hardening of devices (hardening is the process of securing a system by reducing its surface of vulnerability) lead to vulnerabilities.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    ISO includes cyber risk standards, and it promotes the standardization of cyber risk.

    “ISO (International Standards Organization) includes cyber risk standards, and it promotes the standardization of cyber risk [33].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [33] ISO. ISO - International Organization for Standardization. (2017). https://www.iso.org/home.html.

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    In all the above frameworks, the risk vectors specific for IoT systems are considered to mitigate and manage the risks materialized by IoT devices.

    “In all the above frameworks, the risk vectors specific for IoT systems are considered to mitigate and manage the risks materialized by IoT devices.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Existing risk assessment frameworks can be slightly modified to handle the IoT risks.

    “But the existing risk assessment frameworks can be slightly modified to handle the IoT risks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Game-theoretic computing is used for quantitative risk assessment in different fields, including information security.

    “Indeed, game-theoretic computing is used for quantitative risk assessment in different fields, including information security [22].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [22] Mehmet Sahinoglu, Luis Cueva-Parra and David Ang, Game-theoretic computing in risk analysis, 2012 Wiley Periodicals, Inc. source

      Not checked in the free run.

  • Classified as probably not a substantial claim. May combine two claims.

    Premisenone given

    Interconnected assets with the Internet can bring in new risks and device compromise in the IoT environment.

    “Interconnected assets with the Internet can bring in new risks and device compromise in the IoT environment.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    Radanliev et al. have built a model to identify and capture IoT cyber risk from the derived risk vectors that offer new design principles for assessing cyber risk.

    “Radanliev et al. [36] have built a model to identify and capture IoT cyber risk from the derived risk vectors that offer new design principles for assessing cyber risk.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [36] Petar Radanliev, David C. De Roure et al, Standardisation of cyber risk impact assessment for the Internet of Things, Oxford e-Research Center, University of Oxford, 2018

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Radanliev et al. performed an empirical analysis of different risk assessment methods to define a target state for companies integrating IoT devices with services.

    “They also performed an empirical analysis of different risk assessment methods to define a target state for companies integrating IoT devices with services [37].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [37] Petar Radanliev, David Charles De Roure et al, Cyber risk management for the Internet of Things, Oxford e-Research Center, University of Oxford, 2019, doi:10.20944/preprints201904.0133.v1 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisereasoning

    Device firmware updates, protocol updates, and the applications lead to increased attack surface that needs to be secured.

    “Device firmware updates, protocol updates, and the applications again lead to increased attack surface that needs to be secured.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    NIST's Cybersecurity for IoT program has created and connected norms, rules, and related tools to improve the security of associated gadgets and the conditions where they are.

    “NIST's Cybersecurity for IoT program [31] has created and connected norms, rules, and related tools to improve the security of associated gadgets and the conditions where they are.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] Katie Boeckl et al, NISTIR 8228, Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks, June 2019 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    In most cases, TARA is used along with the NIST framework and the IoT considerations of NIST are applicable here also.

    “In most of the cases, TARA is used along with the NIST framework and the IoT considerations of NIST are applicable here also.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    NIST has come up with three main goals for IoT risk assessment: device protection, data protection, and user privacy.

    “NIST has come up with three main goals for IoT risk assessment: (a) device protection, (b) data protection, and (c) user privacy.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] Katie Boeckl et al, NISTIR 8228, Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks, June 2019 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationreasoning

    An unsecured network provides no security and exposes all open traffic, and hence, the risk impact would be maximum.

    “Type of the network: An unsecured network provides no security and exposes all open traffic, and hence, the risk impact would be maximum.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    Device protection has four risk mitigation areas: asset management, vulnerability management, access management, and incident detection.

    “Device protection has four risk mitigation areas including asset management, vulnerability management, access management, and incident detection.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [31] Katie Boeckl et al, NISTIR 8228, Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks, June 2019 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    If there is a history of past attacks, then it is more likely that the device gets attacked again.

    “Count of past attacks for the device (pat): If there is a history of past attacks, then it is more likely that the device gets attacked again.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    TARA improves the quality of risk and control evaluations and communicates risks and recommendations to the organization.

    “It improves the quality of risk and control evaluations and communicates risks and recommendations to the organization.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationnone given

    All layers of IoT undergo cyber attacks and whichever layer undergoes more attacks gets more weight.

    “IoT layer that undergoes lots of attacks (lyr): As discussed earlier, all layers of IoT undergo the cyber attacks and whichever layer undergoes more attacks gets more weight.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    A side-channel attack is a network attack (lyr = 10).

    “A side-channel attack is a network attack (lyr = 10)”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning

    Control of the pacemaker remotely by attackers can be fatal, and hence, it is classified under the high-risk factor (drf = 10) in the healthcare sector (scr = 8).

    “Control of the pacemaker remotely by attackers can be fatal, and hence, it is classified under the high-risk factor (drf = 10) in the healthcare sector (scr = 8).”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Interpretationreasoning

    This rank comes under high priority since the chances of unauthorized access and tampering through credential misuse are more.

    “This rank comes under high priority since the chances of unauthorized access and tampering through credential misuse are more.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    TARA does not promote the defense against vulnerability.

    “and does not promote the defense against vulnerability.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Premisenone given

    IoT is used widely in industries, financial sectors, and healthcare sectors.

    “Type of sector using IoT (scr): IoT is used widely in industries, financial sectors, and healthcare sectors.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    If there are more intermediate systems involved, the impact of the risk would be huge.

    “If there are more intermediate systems involved, the impact of the risk would be huge.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisenone given

    TARA can enhance outcomes, decrease the general effort of risk analysis, and help to make better decisions.

    “It can enhance outcomes, decrease the general effort of risk analysis, and help to make better decisions.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    TARA was developed for a big, highly precious, and diverse environment within Intel (R) in response to a need to assess the security risks of a very complicated, quickly evolving threat landscape.

    “It was developed for a big, highly precious, and diverse environment within Intel (R) in response to a need to assess the security risks of a very complicated, quickly evolving threat landscape.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationcitation

    If there is going to be a replay attack (confidentiality and integrity are affected) and DoS attack (affects availability), then the impact of the risk is high and this could happen in the network layer of the implantable devices.

    “If there is going to be a replay attack (confidentiality and integrity are affected) and DoS attack (affects availability), then the impact of the risk is high and this could happen in the network layer of the implantable devices [77].”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [77] S. Shiva et al, Security and privacy in the Internet of Medical Things: taxonomy and risk assessment, 2017, DOI: https://doi.org/10.1109/LCN.Workshops.2017.72 source

      Not checked in the free run.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    Quantifying risk assessment of IoT security enables an accurate and credible risk assessment process.

    “Quantifying risk assessment of IoT security enables an accurate and credible risk assessment process.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    All security controls in CPS systems may be easily extended to IoT systems.

    “Furthermore, all the security controls in CPS systems may be easily extended to the IoT systems.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    If an attack affects confidentiality, integrity, and availability, then this will create a huge risk impact.

    “If an attack affects confidentiality, integrity, and availability, then this will create a huge risk impact.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    IoT requires lightweight protocols such as 6LoWPAN and IEEE 802.15.4.

    “IoT requires lightweight protocols such as 6LoWPAN and IEEE 802.15.4.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    OCTAVE uses a standardized questionnaire for categorizing recovery impact portions.

    “OCTAVE uses a standardized questionnaire for categorizing recovery impact portions”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    Ranking can be calculated for risk in any category including data security and privacy.

    “Like this example, ranking can be calculated for risk in any category including data security and privacy.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    TARA breaks down prospective attacks to a manageable list of probable attacks.

    “It breaks down prospective attacks to a manageable list of probable attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    TARA does not quantify the impact of risks.

    “TARA does not quantify the impact of risks”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Premisenone given

    TARA is a predictive framework for the most crucial exposures.

    “TARA is a predictive framework for the most crucial exposures.”
    Quote in the paperNot a substantial claim
86 of 86

  • The paper relies on this without support.

    There are no standard IoT risk frameworks currently available.

    “There are no standard IoT risk frameworks that are currently available.”

  • The paper relies on this without support.

    IoT systems can undergo drastic changes in a short period due to the interoperability of IoT devices.

    “IoT systems can undergo drastic changes in a short period due to the interoperability of IoT devices”

  • The authors state this as an assumption.

    The pacemaker has undergone side-channel attacks in the past (pat = 10).

    “we assume that the pacemaker has undergone such attacks in the past (pat = 10)”

  • The paper relies on this without support.

    It is not possible to build a perfect risk assessment system for IoT devices unless the risk vectors or risk attributes are identified.

    “It is indeed evident that it is not possible to build a perfect risk assessment system for IoT devices unless the risk vectors or risk attributes are identified.”

  • The paper relies on this without support.

    Pacemaker and insulin pumps can cause death to patients if they are controlled remotely by attackers.

    “pacemaker and insulin pumps can cause death to patients if they are controlled remotely by attackers.”
5 of 5

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Regular assessments of IoT systems have limitations due to the drastic changes that can take place in such a system in a short period.

    “Kandasamy et al. [54] warn that regular assessments of IoT systems have their limitations due to the drastic changes that can take place in such a system in a short period.”

    From Mapping of Industrial IoT to IEC 62443 Standards (2025) · cites this paper as [54]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Rank 56 is labeled medium rather than high

    Minor

    Table 5 labels rank 56 as medium, although Table 4 places ranks 51-80 in the high category.

  • Pacemaker device-risk factor differs between the worked example and its weights table

    Minor

    The worked pacemaker example uses a device-risk factor of 10, but Table 7 assigns pacemakers a weight of 9. The example presents this factor as an input to its conclusion-bearing risk score.

  • Rank 60 is labeled medium rather than high

    Minor

    Table 5 labels rank 60 as medium, although Table 4 places ranks 51-80 in the high category.

  • Rank 85 is labeled high rather than very high

    Minor

    Table 5 labels rank 85 as high, although Table 4 places ranks 81-100 in the very-high category.

  • Very-low risk threshold conflicts with Table 4

    Minor

    The text assigns every rank of 10 or less to the very-low level. Table 4 instead assigns ranks 5-20 to the low level, so ranks 5-10 fall into both descriptions.

  • Rank 72 is labeled medium rather than high

    Minor

    Table 5 labels rank 72 as medium, although Table 4 places ranks 51-80 in the high category.

  • Rank 30 is labeled low rather than medium

    Minor

    Table 5 labels rank 30 as low, although Table 4 places ranks 21-50 in the medium category.

7 of 7

Cites

Flagged first, then by citations

Research works printed but not linked: 8

  1. Mark Hung, Gartner insights on how to lead in a connected world, 2017. https://www.gartner.com/imagesrv/books/iot/iotEbook_digital.pdf
  2. J. McCarthy, O. Alexander, S. Edwards, D. Faatz, C. Peloquin, S. Symington, A. Thibault, J. Wiltberger, K. Viani, Situational awareness for electric utilities, NIST SP 1800–7 practice guide. NIST Special Publication 1800-7, 1–241 (2017)
  3. A. Zhou, Analysis of the Volkswagen Scandal Possible Solutions for Recovery (School of Global Policy and Strategy, UC at San Diego, 2016)
  4. Manos Antonakakis et al, Understanding the MiraiBotnet, Proceedings of 26th USENIX Security Symposium, 2017
  5. Jason R. C. Nurse et al, Security risk assessment in Internet of Things systems, University of Oxford, 2018
  6. Petar Radanliev, David C. De Roure et al, Standardisation of cyber risk impact assessment for the Internet of Things, Oxford e-Research Center, University of Oxford, 2018
  7. F. Den Braber et al., The CORAS model-based method for security risk analysis (SINTEF, Oslo, 2006)
  8. How to do a complete automated risk assessment: a methodology review. Riskwatch White Paper, http://www.riskwatch.com/news/whitepapers/How to do a complete automated risk assessment_10-02RW.pdf; 2002

Cited by

Sorted by citations

Related

Authors
Kandasamy, K., Srinivas, S., Achuthan, K., & Rangan, V. P.
Affiliations
  • Amrita Vishwa Vidyapeetham (IN)
  • IBM (United States) (US)
Corresponding author
  • Kandasamy, Kamalanathan
  • Srinivas, Sethuraman
  • Achuthan, Krishnashree
  • Rangan, Venkat P.
ORCID
Venue
EURASIP Journal on Information Security
Publisher
Springer Science and Business Media LLC
Published
2020-05-26
Volume
2020
Issue
1
ISSN
  • 1687-4161 (ISSN-L)
  • 2510-523X
DOI
10.1186/s13635-020-00111-0
OpenAlex
W3032033268
Semantic Scholar
c974e373fb3b34f47c1e82605cd05ee367b09799
Cited by
160
References
56
Citations by year
2026: 15 · 2025: 29 · 2024: 49 · 2023: 27 · 2022: 17 · 2021: 19 · 2020: 4
FWCI
15.76
Type
journal article
Language
en
Open access
Licence
Locations
  • EURASIP Journal on Information Security (publishedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
  • Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
Keywords
Internet of Things, cybersecurity risk assessment, risk assessment framework, risk prioritization, Internet of Medical Things, NIST framework, Octave, ISO 31000, fintech, health care, risk mitigation, IoT vulnerabilities

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-09.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-09.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review