An Exploratory Analysis of the Security Risks of the Internet of Things in Finance

Carlton Shepherd; Fabien Petitcolas; Raja Naeem Akram; Konstantinos Markantonakis

doi:10.1007/978-3-319-64483-7_11

An Exploratory Analysis of the Security Risks of the Internet of Things in Finance

Carlton Shepherd, Fabien Petitcolas, Raja Naeem Akram, Konstantinos Markantonakis

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.

Original language	English
Title of host publication	Trust, Privacy and Security in Digital Business
Subtitle of host publication	14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings
Editors	Javier Lopez, Simone Fischer-Hübner, Costas Lambrinoudakis
Publisher	Springer-Verlag
Pages	164-179
Number of pages	16
ISBN (Electronic)	978-3-319-64483-7
ISBN (Print)	978-3-319-64482-0
DOIs	https://doi.org/10.1007/978-3-319-64483-7_11
Publication status	E-pub ahead of print - 27 Jul 2017
Event	14th International Conference on Trust, Privacy & Security in Digital Business - Jean Moulin University Lyon III, Lyon, France Duration: 28 Aug 2017 → 31 Aug 2017 http://www.ds.unipi.gr/trustbus2017/

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer, Cham
Volume	10442
ISSN (Print)	0302-9743

Conference

Conference	14th International Conference on Trust, Privacy & Security in Digital Business
Abbreviated title	TrustBus 2017
Country/Territory	France
City	Lyon
Period	28/08/17 → 31/08/17
Internet address	http://www.ds.unipi.gr/trustbus2017/

Access to Document

10.1007/978-3-319-64483-7_11

Cite this

Shepherd, C., Petitcolas, F., Akram, R. N., & Markantonakis, K. (2017). An Exploratory Analysis of the Security Risks of the Internet of Things in Finance. In J. Lopez, S. Fischer-Hübner, & C. Lambrinoudakis (Eds.), Trust, Privacy and Security in Digital Business: 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings (pp. 164-179). (Lecture Notes in Computer Science; Vol. 10442). Springer-Verlag. Advance online publication. https://doi.org/10.1007/978-3-319-64483-7_11

Shepherd, Carlton ; Petitcolas, Fabien ; Akram, Raja Naeem et al. / An Exploratory Analysis of the Security Risks of the Internet of Things in Finance. Trust, Privacy and Security in Digital Business: 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings. editor / Javier Lopez ; Simone Fischer-Hübner ; Costas Lambrinoudakis. Springer-Verlag, 2017. pp. 164-179 (Lecture Notes in Computer Science).

@inproceedings{39269ad2d0af41eeb4d5f8ffdb33b4e5,

title = "An Exploratory Analysis of the Security Risks of the Internet of Things in Finance",

abstract = "The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.",

author = "Carlton Shepherd and Fabien Petitcolas and Akram, {Raja Naeem} and Konstantinos Markantonakis",

year = "2017",

month = jul,

day = "27",

doi = "10.1007/978-3-319-64483-7_11",

language = "English",

isbn = "978-3-319-64482-0",

series = "Lecture Notes in Computer Science",

publisher = "Springer-Verlag",

pages = "164--179",

editor = "Javier Lopez and Simone Fischer-H{\"u}bner and Costas Lambrinoudakis",

booktitle = "Trust, Privacy and Security in Digital Business",

note = "14th International Conference on Trust, Privacy & Security in Digital Business, TrustBus 2017 ; Conference date: 28-08-2017 Through 31-08-2017",

url = "http://www.ds.unipi.gr/trustbus2017/",

}

Shepherd, C, Petitcolas, F, Akram, RN & Markantonakis, K 2017, An Exploratory Analysis of the Security Risks of the Internet of Things in Finance. in J Lopez, S Fischer-Hübner & C Lambrinoudakis (eds), Trust, Privacy and Security in Digital Business: 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings. Lecture Notes in Computer Science, vol. 10442, Springer-Verlag, pp. 164-179, 14th International Conference on Trust, Privacy & Security in Digital Business, Lyon, France, 28/08/17. https://doi.org/10.1007/978-3-319-64483-7_11

An Exploratory Analysis of the Security Risks of the Internet of Things in Finance. / Shepherd, Carlton; Petitcolas, Fabien; Akram, Raja Naeem et al.
Trust, Privacy and Security in Digital Business: 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings. ed. / Javier Lopez; Simone Fischer-Hübner; Costas Lambrinoudakis. Springer-Verlag, 2017. p. 164-179 (Lecture Notes in Computer Science; Vol. 10442).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - An Exploratory Analysis of the Security Risks of the Internet of Things in Finance

AU - Shepherd, Carlton

AU - Petitcolas, Fabien

AU - Akram, Raja Naeem

AU - Markantonakis, Konstantinos

PY - 2017/7/27

Y1 - 2017/7/27

N2 - The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.

AB - The Internet of Things (IoT) is projected to significantly impact consumer finance, through greater customer personalisation, more frictionless payments, and novel pricing schemes. The lack of deployed applications, however, renders it difficult to evaluate potential security risks, which is further complicated by the presence of novel, IoT-specific risks absent in conventional systems. In this work, we present two-part study that uses scenario planning to evaluate emerging risks of IoT in a variety of financial products and services, using ISO/IEC 20005:2008 to assess those risks from related work. Over 1,400 risks were evaluated from a risk assessment with 7 security professionals within the financial industry, which was contrasted with an external survey of 40 professionals within academia and industry. From this, we draw a range of insights to advise future IoT research and decision-making regarding potentially under-appreciated risks. To our knowledge, we provide the first empirical investigation for which threats, vulnerabilities, asset classes and, ultimately, risks may take precedence in this domain.

U2 - 10.1007/978-3-319-64483-7_11

DO - 10.1007/978-3-319-64483-7_11

M3 - Conference contribution

SN - 978-3-319-64482-0

T3 - Lecture Notes in Computer Science

SP - 164

EP - 179

BT - Trust, Privacy and Security in Digital Business

A2 - Lopez, Javier

A2 - Fischer-Hübner, Simone

A2 - Lambrinoudakis, Costas

PB - Springer-Verlag

T2 - 14th International Conference on Trust, Privacy & Security in Digital Business

Y2 - 28 August 2017 through 31 August 2017

ER -

Shepherd C, Petitcolas F, Akram RN, Markantonakis K. An Exploratory Analysis of the Security Risks of the Internet of Things in Finance. In Lopez J, Fischer-Hübner S, Lambrinoudakis C, editors, Trust, Privacy and Security in Digital Business: 14th International Conference, TrustBus 2017, Lyon, France, August 30-31, 2017, Proceedings. Springer-Verlag. 2017. p. 164-179. (Lecture Notes in Computer Science). Epub 2017 Jul 27. doi: 10.1007/978-3-319-64483-7_11