Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Petar Radanliev; David De Roure; Pete Burnap; Omar Santos

doi:10.1007/s12626-021-00086-5

Epistemological Equation for Analysing Uncontrollable States in Complex Systems: Quantifying Cyber Risks from the Internet of Things

Rev Socionetwork Strateg. 2021;15(2):381-411. doi: 10.1007/s12626-021-00086-5. Epub 2021 Jul 22.

Authors

Petar Radanliev¹, David De Roure¹, Pete Burnap², Omar Santos³

Affiliations

¹ Department of Engineering Sciences, Oxford e-Research Centre, University of Oxford, Oxford, England, UK.
² School of Computer Science and Informatics, Cardiff University, Cardiff, Wales, UK.
³ Cisco Research Centre, Research Triangle Park, Durham-Raleigh, NC USA.

Abstract

The Internet-of-Things (IoT) triggers data protection questions and new types of cyber risks. Cyber risk regulations for the IoT, however, are still in their infancy. This is concerning, because companies integrating IoT devices and services need to perform a self-assessment of its IoT cyber security posture. At present, there are no self-assessment methods for quantifying IoT cyber risk posture. It is considered that IoT represent a complex system with too many uncontrollable risk states for quantitative risk assessment. To enable quantitative risk assessment of uncontrollable risk states in complex and coupled IoT systems, a new epistemological equation is designed and tested though comparative and empirical analysis. The comparative analysis is conducted on national digital strategies, followed by an empirical analysis of cyber risk assessment approaches. The results from the analysis present the current and a target state for IoT systems, followed by a transformation roadmap, describing how IoT systems can achieve the target state with a new epistemological analysis model. The new epistemological analysis approach enables the assessment of uncontrollable risk states in complex IoT systems-which begin to resemble artificial intelligence-and can be used for a quantitative self-assessment of IoT cyber risk posture.

Keywords: Cyber risk regulations; Cyber risk self-assessment; Cyber risk target state; Empirical analysis; Epistemological analysis; Internet of Things; Risk transformation roadmap.