ARAM: Assets-based Risk Assessment Model for Connected Smart Homes

Connected smart homes (CSH) have benefited immensely from emerging Internet of Things (IoT) technology. CSH is intended to support everyday life in the private seclusion of the home, and typically covers the integration of smart devices such as smart meters, heating, ventilation, and air conditioning (HVAC), intelligent lightening, and voice-activated assistants among others. Nevertheless, the risks associated with CSH assets are often of high concern. For instance, energy consumption monitoring through smart meters can reveal sensitive information that may pose a privacy risk to home occupants if not properly managed. Existing risk assessment approaches for CSH tend to focus on qualitative risk assessment methodologies, such as operationally critical threat, asset, and vulnerability evaluation (OCTAVE). However, security risk assessment, particularly for IoT environments, demands both qualitative and quantitative risk assessment. This paper proposes assets-based risk assessment model that integrates both qualitative and quantitative risk assessment to determine the risk related to assets in CSH when a specific service is used. We apply fuzzy Analytic Hierarchy Process (fuzzy AHP) to address the subjective assessment of the IoT risk analysts and stakeholders. The applicability of the proposed model is illustrated through a use case that constitutes a scenario connected to service delivery in CSH. The proposed model provides a guideline to researchers and practitioners on how to quantify the risks targeting assets in CSH.