PreprintCited by 17Information and Cyber SecurityIoT and Edge/Fog ComputingInformation Technology Governance and Strategy

Cyber Risk Management for the Internet of Things

Open access
Radanliev, Petar, Charles De Roure, David, R.C. Nurse, Jason, Burnap, Pete, Anthi, Eirini, Uchenna, Ani, Maddox, La’Treall, Santos, Omar +1 more·2019·Preprints.org

Abstract

The Internet-of-Things (IoT) enables enterprises to obtain profits from data but triggers data protection questions and new types of cyber risk. Cyber risk regulations for the IoT however do not exist. The IoT risk is not included in the cyber security assessment standards, hence, often not visible to cyber security experts. This is concerning, because companies integrating IoT devices and services need to perform a self-assessment of its IoT cyber security posture. The outcome of such self-assessment need to define a current and target state, prior to creating a transformation roadmap outlining tasks to achieve the stated target state. In this article, a comparative empirical analysis is performed of multiple cyber risk assessment approaches, to define a high-level potential target state for company integrating IoT devices and/or services. Defining a high-level potential target state represent is followed by a high-level transformation roadmap, describing how company can achieve their target state, based on their current state. The transformation roadmap is used to adapt IoT risk impact assessment with a Goal-Oriented Approach and the Internet of Things Micro Mart model. The main contributions from this paper represent a transformation roadmap for standardisation of IoT risk impact assessment; and transformation design imperatives describing how IoT companies can achieve their target state based on their current state with a Goal-Oriented approach. Verified by epistemological analysis defining a unified cyber risk assessment approach. These can be used for calculating the economic impact of cyber risk; for international cyber risk assessment approach; for quantifying cyber risk; and for planning for impact of cyber-attacks, e.g. cyber insurance. The new methods presented in this paper for applying the roadmap include: IoT Risk Analysis through Functional Dependency; Network-based Linear Dependency Modelling; IoT risk impact assessment with a Goal-Oriented Approach; and a correlation between the Goal-Oriented Approach and the IoTMM model.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.20944/preprints201904.0133.v1

Cites

101 of 101 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

7 of the 108 references couldn’t be matched to a known paper.

Research works printed but not linked: 19

  1. Drath, R. & Horch, A. Industrie 4.0: Hit or Hype? [Industry Forum]. IEEE Ind. Electron. Mag. 8, 56-58 (2014).
  2. Carruthers, K. Internet of Things and Beyond: Cyber-Physical Systems -IEEE Internet of Things. IEEE Internet of Things (2016).
  3. Rutter, T. The rise of nudge -the unit helping politicians to fathom human behavior. Guard. 7, 2015 (2015).
  4. Ouyang, J., Lin, S., Jiang, S., Hou, Z., Wang, Y., Wang, Y., … Hou, Zhenyu; Wang, Yong; Wang, Y. SDF: software-defined flash for web-scale internet storage systems. in Proceedings of the 19th international conference on Architectural support for programming languages and operating systems -ASPLOS '14 42, 471-484 (ACM Press, 2014).
  5. Koch, R. & Rodosek, G. Proceedings of the 15th European Conference on Cyber Warfare and Security : ECCWS 2016 : hosted by Universität der Bundeswehr, Munich, Germany 7-8 July 2016. (2016).
  6. Kang, W., Kapitanova, K. & Son, S. H. RDDS: A Real-Time Data Distribution Service for Cyber-Physical Systems. IEEE Trans. Ind. Informatics 8, 393-405 (2012).
  7. Waslo, R., Lewis, T., Hajj, R. & Carton, R. Industry 4.0 and cybersecurity in the age of connected production | Deloitte University Press. Deloitte University Press (2017). Available at: https://dupress.deloitte.com/dup-us-en/focus/industry-4-0/cybersecurity- managing-risk-in-age-of-connected-production.html. (Accessed: 4th August 2017)
  8. Ruffle, S. J., Bowman, G., Caccioli, F., Coburn, A. W., Kelly, S., Leslie, B. & Ralph, D. Stress Test Scenario: Sybil Logic Bomb Cyber Catastrophe. Cambridge Risk Framew. Ser. Cent. Risk Stud. Univ. Cambridge. (2014).
  9. IVI. Industrial Value Chain Initiative. An Outline of Smart Manufacturing Scenarios 2016. in Monozukuri Nippon Conference (2016).
  10. Radanliev, P., Roure, D. C. De, Nurse, J. R. C., Burnap, P., Eirini Anthi, Ani, U., … Montalvo, R. M. Design principles for cyber risk impact assessment from Internet of Things (IoT). Wokring paper. (2019). doi:10.13140/RG.2.2.33014.86083 123. · DOI
  11. Radanliev, P., De Roure, D. C., Nurse, J. R. C. C., Nicolescu, R., Huth, M., Cannady, S. & Montalvo, R. M. New developments in Cyber Physical Systems, the Internet of Things and the Digital Economy -future developments in the Industrial Internet of Things and Industry 4.0. (2019). doi:10.13140/RG.2.2.14133.93921 130. · DOI
  12. Radanliev, P., Charles De Roure, D., Maple, C., Nurse, J. R. C., Nicolescu, R. & Ani, U. Cyber Risk in IoT Systems. Journal of Cyber Policy (2019). doi:10.13140/RG.2.2.29652.86404 132. · DOI
  13. Radanliev, P., DeRoure, D., Nurse, J. R. C., Burnap, P., Anthi, E., Ani, U., … Montalvo, R. M. Definition of Cyber Strategy Transformation Roadmap for Standardisation of IoT Risk Impact Assessment with a Goal-Oriented Approach and the Internet of Things Micro Mart. Working paper. (2019). doi:10.13140/RG.2.2.12462.77124 134. · DOI
  14. Radanliev, P., De Roure, D., Nurse, J. R. C. C., Nicolescu, R., Huth, M., Cannady, S. & Montalvo, R. M. Cyber risk impact assessment -assessing the risk from the IoT to the digital economy. (2019). doi:10.13140/RG.2.2.11145.49768 136. · DOI
  15. Radanliev, P., De Roure, D. C., Nurse, J. R. C., Montalvo, R. M. & Burnap, P. The Industrial Internet-of-Things in the Industry 4.0 supply chains of small and medium sized enterprises. Working paper. (2019). doi:10.13140/RG.2.2.14140.49283 137. · DOI
  16. Viljoen, T., Hobbis, D., Thomas, R., Stathos, G., Blatchford, I. & Maharaj, S. Cyber Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 11 April 2019 doi:10.20944/preprints201904.0133.v1
  17. Radanliev, P., De Roure, D., Cannady, S., Montalvo, R. M., Nicolescu, R. & Huth, M. Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 11 April 2019 doi:10.20944/preprints201904.0133.v1 Analysing IoT cyber risk for estimating IoT cyber insurance. (2019). doi:10.13140/RG.2.2.25006.36167 160. · DOI
  18. Radanliev, P., De Roure, D. C., Nurse, J. R. C., Montalvo, R. M. & Burnap, P. Standardisation of cyber risk impact assessment for the Internet of Things (IoT). (2019). doi:10.13140/RG.2.2.27903.05280 161. · DOI
  19. Radanliev, P., De Roure, D., Nurse, J. R., Burnap, P., Anthi, E., Ani, U., … Mantilla Montalvo, R. Cyber risk from IoT technologies in the supply chain-discussion on supply chains decision support system for the digital economy. Univ. Oxford (2019). doi:10.13140/RG.2.2.17286.22080 163. · DOI

Cited by

Sorted by citations

Authors
Radanliev, P., Charles De Roure, D., R.C. Nurse, J., Burnap, P., Anthi, E., Uchenna, A., Maddox, L., Santos, O., & Mantilla Montalvo, R.
Affiliations
  • University of Oxford (GB)
  • Cardiff University (GB)
  • Cisco Systems (United States) (US)
Corresponding author
Radanliev, Petar
Venue
Preprints.org
Publisher
MDPI AG
Published
2019-04-11
OpenAlex
W2946594951
Cited by
17
References
108
Citations by year
2024: 1 · 2023: 1 · 2022: 1 · 2021: 2 · 2020: 6 · 2019: 6
Type
posted content
Language
en
Open access
Locations
Preprints.org (acceptedVersion, cc-by)
Funders
Engineering and Physical Sciences Research Council (EP/N02334X/1)
Topics
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
  • Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
Keywords
Internet of Things, cyber risk management, cybersecurity risk assessment, transformation roadmap, goal-oriented approach, risk impact assessment, functional dependencies, cyber insurance

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review