TY - GEN
T1 - An Exploratory Analysis of the Security Risks of the Internet of Things in Finance
AU - Shepherd, Carlton
AU - Petitcolas, Fabien
AU - Akram, Raja
AU - Markantonakis, Konstantinos
AU - Lopez, Javier
AU - Lambrinoudakis, Costas
A2 - Fischer-Hübner, Simone
N1 - Acknowledgements: The authors would like to thank those at Vasco Data Security, who initiated and supported this work; the participants of the user survey for their time and consideration; and the anonymous reviewers who provided their insightful and helpful comments. Carlton Shepherd is supported by the EPSRC and the UK government as part of the Centre for Doctoral Training in Cyber Security at Royal Holloway, University of London (EP/K035584/1).
PY - 2017
Y1 - 2017
N2 - The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.
AB - The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.
U2 - 10.1007/978-3-319-64483-7_11
DO - 10.1007/978-3-319-64483-7_11
M3 - Published conference contribution
SN - 978-3-319-64482-0
T3 - Lecture Notes in Computer Science
SP - 164
EP - 179
BT - 14th International Conference on Trust, Privacy & Security in Digital Business
PB - Springer Verlag
ER -