Internet of Things (IoT) applications have become an integral part of our daily lives. However, due to the rising number of cybercrimes, ensuring cyberspace security has become essential. The security and privacy of IoT applications are fundamental as they are used in critical sectors, like healthcare, transportation systems, and energy production. As a result, many studies are focusing on the security and privacy of the IoT revolution. The need for assessing IoT security risks is increasing. This paper presents a survey and taxonomy of risk management, analysis, and evaluation methods applied to systems involving IoT devices. In particular, the paper reviews and categorizes existing IoT risk management and assessment frameworks, and the different assessments techniques, risk perspectives, and methodologies. The paper concludes with a deep analysis of these frameworks, solutions, and guidelines, and discusses future research directions.

Risk Assessment for IoT is important for analyzing the risks associated with deploying and using IoT technologies. A risk assessment framework helps organizations identify, assess, and manage the risks of IoT, which can range from data privacy and confidentiality to system integrity, availability, and performance. The significance of risk assessment in medical sectors, particularly in emergency rooms, is more imperative due to the criticality of the service. This paper presents an IoT risk assessment framework for the healthcare environment, in which we have improved upon existing methodologies. The proposed framework dynamically calculates the risk score for different device profiles, considering their population and other parameters, such as network protocols, device heterogeneity, device security updates, device physical security status, device history status, layer history status, and device criticality. We validate our proposed framework by simulating an emergency room environment, considering a variety of devices and parameters. The results show that our framework provides more insight into the overall risk assessment, as it takes into account the number of IoT devices and their relation to a threshold we introduce, which can be tuned by the security expert.