Multifaceted Risk Assessment and Risk Countermeasure Portfolio for Internet of Things

Abstract

As global businesses now extensively depend on data, Internet of Things (IoT) sensors have become the primary source of real-time data that enable the digital transformation. According to Bain’s Insight, the IoT market will grow to more than $520 billion by 2021. The technology has already been adopted for a wide array of use cases, but due to the ever-expanding threat landscape, many customers have indicated that security remains the primary barrier when it comes to their acceptance of IoT. The current security risk management methodologies focus mostly on the cyber view. In this work, we identify 28 risk factors extracted using the risk breakdown structure method and expand this traditional view to include others (physical, psychological) that are critical to business operations. Next, we proposed risk countermeasures for all the extracted risk factors using a risk matrix method. Further, from a practical point of view, a portfolio of the proposed risk countermeasures was clearly indicated to enable the gradual introduction of risk countermeasures. Finally, the effectiveness of the risk countermeasures was quantitatively evaluated on the basis of the risk values. Our findings help clarify IoT security and its relation to non-cyber risks for proper implementation of IoT systems.