Future developments in cyber risk assessment for the internet of things

TL;DR

This paper introduces a novel IoT MicroMort model for assessing cyber risk impact, combining established economic and mortality risk models, validated with real IoT device data to forecast current and future IoT cyber risks.

Contribution

It adapts and integrates the Cyber Value at Risk and MicroMort models specifically for IoT, providing a new framework for economic impact assessment of IoT cyber risks.

Findings

Validated IoT MicroMort model with real data from over 310,000 scans.

Developed current and future IoT cyber risk assessments.

Enhanced understanding of IoT cyber risk economic impacts.

Abstract

This article is focused on the economic impact assessment of Internet of Things (IoT) and its associated cyber risks vectors and vertices - a reinterpretation of IoT verticals. We adapt to IoT both the Cyber Value at Risk model, a well-established model for measuring the maximum possible loss over a given time period, and the MicroMort model, a widely used model for predicting uncertainty through units of mortality risk. The resulting new IoT MicroMort for calculating IoT risk is tested and validated with real data from the BullGuard's IoT Scanner - over 310,000 scans - and the Garner report on IoT connected devices. Two calculations are developed, the current state of IoT cyber risk and the future forecasts of IoT cyber risk. Our work therefore advances the efforts of integrating cyber risk impact assessments and offer a better understanding of economic impact assessment for IoT cyber risk.