As the number of Internet of Things (IoT) devices continues to grow, understanding and mitigating potential vulnerabilities and threats is crucial. With IoT devices becoming ubiquitous in critical sectors like healthcare, transportation, energy, and industrial automation, identifying and addressing risks is increasingly important. A comprehensive risk management approach enables IoT stakeholders to safeguard user data and privacy, as well as system integrity. Existing risk assessment frameworks focus on qualitative risk analysis methodologies, such as operationally critical threat, asset, and vulnerability evaluation (OCTAVE). However, security risk assessment, particularly for IoT ecosystem, demands both qualitative and quantitative risk assessment. This paper proposes RAM-IoT, a risk assessment model for IoT-based critical assets that integrates qualitative and quantitative risk assessment approaches. A multi-criteria decision making (MCDM) approach based on fuzzy Analytic Hierarchy Process (fuzzy AHP) is proposed to address the subjective assessment of the IoT risk analysts and their corresponding stakeholders. The applicability of the proposed model is illustrated through a use case connected to service delivery in the IoT. The proposed model provides a guideline to researchers and practitioners on how to quantify the risks targeting assets in IoT, thereby providing adequate support for protecting IoT ecosystems.

The benefit associated with the deployment of Internet of Things (IoT) technology is increasing daily. IoT has revolutionized our ways of life, especially when we consider its applications in smart connected homes. Smart devices at home enable the collection of data from multiple sensors for a range of applications and services. Nevertheless, the security and privacy issues associated with aggregating multiple sensors’ data in smart connected homes have not yet been sufficiently prioritized. Along this development, this paper proposes HOMEFUS, a privacy and security-aware model that leverages information theoretic correlation analysis and gradient boosting to fuse multiple sensors’ data at the edge nodes of smart connected homes. HOMEFUS employs federated learning, edge and cloud computing to reduce privacy leakage of sensitive data. To demonstrate its applicability, we show that the proposed model meets the requirements for efficient data fusion pipelines. The model guides practitio ners and researchers on how to setup secure smart connected homes that comply with privacy laws, regulations, and standards.

The smart home technology market is witnessing rapid growth due to the advent of more advanced, intuitive, and affordable solutions. As the adoption of these technologies becomes more prevalent, there is a need for research to explore potential avenues for pervasive smart living. This study aims to review the available literature and industry studies, along with our own experiences in the field, to identify and discuss potential future research in the smart home. We observe that the future of the smart home will likely be focused on improving the user experience, with a greater emphasis on personalization, automation, and Artificial intelligence (AI)-driven technologies, leading to what we call the "Green Intelligent Home". Through this analysis, this study aims to offer insights into how the development of smart homes could shape society in the future and the potential implications of such a development. This study concludes by suggesting a framework for knowledge development in the smart home domain.

A security-enhanced agile software development process, SEAP, is introduced in the development of a mobile money transfer system at Ericsson Corp. A specific characteristic of SEAP is that it includes a security group consisting of four different competences, i.e., Security manager, security architect, security master and penetration tester. Another significant feature of SEAP is an integrated risk analysis process. In analyzing risks in the development of the mobile money transfer system, a general finding was that SEAP either solves risks that were previously postponed or solves a larger proportion of the risks in a timely manner. The previous software development process, i.e., The baseline process of the comparison outlined in this paper, required 2.7 employee hours spent for every risk identified in the analysis process compared to, on the average, 1.5 hours for the SEAP. The baseline development process left 50% of the risks unattended in the software version being developed, while SEAP reduced that figure to 22%. Furthermore, SEAP increased the proportion of risks that were corrected from 12.5% to 67.1%, i.e., More than a five times increment. This is important, since an early correction may avoid severe attacks in the future. The security competence in SEAP accounts for 5% of the personnel cost in the mobile money transfer system project. As a comparison, the corresponding figure, i.e., For security, was 1% in the previous development process.