Skip to main page content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Access keys NCBI Homepage MyNCBI Homepage Main Content Main Navigation
Review
. 2024 Oct 10:7:1402745.
doi: 10.3389/fdata.2024.1402745. eCollection 2024.

AI security and cyber risk in IoT systems

Petar Radanliev  1   2 , David De Roure  3 , Carsten Maple  4 , Jason R C Nurse  5 , Razvan Nicolescu  6 , Uchenna Ani  7
Affiliations
Review

AI security and cyber risk in IoT systems

Petar Radanliev et al. Front Big Data. .

Abstract

Internet-of-Things (IoT) refers to low-memory connected devices used in various new technologies, including drones, autonomous machines, and robotics. The article aims to understand better cyber risks in low-memory devices and the challenges in IoT risk management. The article includes a critical reflection on current risk methods and their level of appropriateness for IoT. We present a dependency model tailored in context toward current challenges in data strategies and make recommendations for the cybersecurity community. The model can be used for cyber risk estimation and assessment and generic risk impact assessment. The model is developed for cyber risk insurance for new technologies (e.g., drones, robots). Still, practitioners can apply it to estimate and assess cyber risks in organizations and enterprises. Furthermore, this paper critically discusses why risk assessment and management are crucial in this domain and what open questions on IoT risk assessment and risk management remain areas for further research. The paper then presents a more holistic understanding of cyber risks in the IoT. We explain how the industry can use new risk assessment, and management approaches to deal with the challenges posed by emerging IoT cyber risks. We explain how these approaches influence policy on cyber risk and data strategy. We also present a new approach for cyber risk assessment that incorporates IoT risks through dependency modeling. The paper describes why this approach is well suited to estimate IoT risks.

Keywords: AI security; Internet-of-Things (IoT); artificial intelligence; cyber risk assessment; cyber risk estimation; cyber risk insurance; cyber risk management; risk impact assessment.

PubMed Disclaimer

Conflict of interest statement

The authors declare that the research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.

Figures

Figure 1
Figure 1
The IoT risk assessment process.
Figure 2
Figure 2
Dependency modeling for IoT risk assessment. (A) Dependency relationships among IoT components (C1, C2, C3, C4, C5, C6). The circles (C1, C2, C3, etc.) represent different IoT components. The directional arrows (t1, t2, t3, etc.) represent dependency flows between components. For example: t1 is the dependency flow from component C1 to component C3. t2 is the dependency flow from component C1 to C4. t4 represents a dependency from C2 to C4. This structure shows how the functioning of one IoT component is dependent on the successful function of another connected component. (B) Layer-based dependencies in an IoT system. AL (Application Layer), Represents higher-level software components and services (e.g., analytics functions or cloud services); NL (Network Layer), Represents components such as communication switches or Programmable Logic Controllers (PLCs), through which data (t1, f1, etc.) is transmitted; PL (Perception Layer), Represents sensors or actuators, such as photoelectric sensors or conveyor belt switches, which interact with the physical world. The arrows in this part show how dependencies flow through these layers, with t1 and f1 representing different types of functional or data dependencies between the layers.
Figure 3
Figure 3
Connection configured.
Figure 4
Figure 4
Worst-case dependency impact.
Figure 5
Figure 5
The new emerging security incident response approach.
Figure 6
Figure 6
Simulation of the goal-oriented approach.
See this image and copyright information in PMC

References

    1. Adams J. (1995). Risk. Chicago: Questia.
    1. Aggarwal V. K., Reddie A. W. (2018). Comparative industrial policy and cybersecurity: a framework for analysis. J. Cyber Policy 3, 291–305. 10.1080/23738871.2018.1553989 - DOI
    1. Allodi L., Massacci F. (2017). Security events and vulnerability data for cybersecurity risk estimation. Risk Analy. 37, 1606–1627. 10.1111/risa.12864 - DOI - PubMed
    1. Alpcan T., Bambos N. (2009). “Modeling dependencies in security risk management,” in Post-Proceedings of the 4th International Conference on Risks and Security of Internet and Systems, CRiSIS 2009 (Toulouse, France: IEEE Xplore; ), 113–16.
    1. Anthi E., Williams L., Burnap P. (2018). “Pulse: an adaptive intrusion detection for the internet of things,” in Living in the Internet of Things: Cybersecurity of the IoT (London: Institution of Engineering and Technology; ).

LinkOut - more resources