An Architectural Risk Analysis for Internet of Things (IoT) Services

The adoption of internet of things (IoT) services has accelerated enormously as multiple industries have recognized the extent to which IoT services can provide significant advantages to consumers, enterprises, and government institutions. Given the wide range of IoT-based services and products, their rapid entrenchment into daily life, and the increasingly sensitive and critical roles they can play, security must be a top consideration.

Protecting IoT services and applications requires a solid and well-founded set of security defenses that have been selected to provide the necessary (and—it is hoped—sufficient) safeguards against those threats deemed to pose the greatest risks to the service, its users, and the service providers. A risk assessment that identifies vulnerabilities in a quantifiable manner is a necessary first step in constructing a sensible IoT security posture. This paper has been written to address the fundamentals needed to perform risk assessments for IoT assets.