An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUES <s> A reversible, side mounted rearview mirror for vehicles adapted to be mounted at the exterior of the vehicle and having opposed reflective surfaces one of which is suitable for daytime use and the other which is suitable for nighttime use. The mirror is supported within the housing for rotation about a horizontal axis and for swinging movement about a vertical axis at one end of the mirror to provide a full range of adjustment and to permit selecting one or the other of the reflective surfaces. <s> BIB001 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUES <s> A statistical method is proposed for quantifying the impact of factors that influence the quality of the estimation of costs for IT-enabled business projects. We call these factors risk drivers as they influence the risk of the misestimation of project costs. The method can effortlessly be transposed for usage on other important IT key performance indicators (KPIs), such as schedule misestimation or functionality underdelivery. We used logistic regression as a modeling technique to estimate the quantitative impact of risk factors. We did so because logistic regression has been applied successfully in fields including medical science, e.g. in perinatal epidemiology, to answer questions that show a striking resemblance to the questions regarding project risk management. In our study we used data from a large organization in the financial services industry to assess the applicability of logistic modeling in quantifying IT risks. With this real-world example we illustrated how to scrutinize the quality and plausibility of the available data. We explained how to deal with factors that cannot be influenced, also called risk factors, by project management before or in the early stage of a project, but can have an influence on the outcome of the estimation process. We demonstrated how to select the risk drivers using logistic regression. Our research has shown that it is possible to properly quantify these risks, even with the help of crude data. We discussed the interpretation of the models found and showed that the findings are helpful in decision making on measures to be taken to identify potential misestimates and thus mitigate IT risks for individual projects. We proposed increasing the auditing process efficiency by using the found cost misestimation models to classify all projects as either risky projects or non-risky projects. We discovered through our analyses that projects must not be overstaffed and the ratio of external developers must be kept small to obtain better cost estimates. Our research showed that business units that report on financial information tend to be risk mitigating, because they have more cost underruns in comparison with business units without reporting; the latter have more cost overruns. We also discovered a maturity mismatch: an increase from CMM level 1 to 2 did not influence the disparity between a cost estimate and its actual if the maturity of the business is not also increased. <s> BIB002 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUES <s> Cloud computing is a distributed computing model that still faces problems. New ideas emerge to take advantage of its features and among the research challenges found in the cloud, we can highlight Identity and Access Management. The main problems of the application of access control in the cloud are the necessary flexibility and scalability to support a large number of users and resources in a dynamic and heterogeneous environment, with collaboration and information sharing needs. This paper proposes the use of risk-based dynamic access control for cloud computing. The proposal is presented as an access control model based on an extension of the XACML standard with three new components: the Risk Engine, the Risk Quantification Web Services and the Risk Policies. The risk policies present a method to describe risk metrics and their quantification, using local or remote functions. The risk policies allow users and cloud service providers to define how to handle risk-based access control for their resources, using different quantification and aggregation methods. The model reaches the access decision based on a combination of XACML decisions and risk analysis. A prototype of the model is implemented, showing it has enough expressivity to describe the models of related work. In the experimental results, the prototype takes between 2 and 6 milliseconds to reach access decisions using a risk policy. A discussion on the security aspects of the model is also presented. <s> BIB003 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUES <s> Many traditional authentication and access control mechanisms do not use context-aware approach, i.e., those mechanisms do not incorporate context parameters while mak- ing authentication and authorisation decisions. The context unaware mechanisms can be inadequate for the Internet of Things due to its dynamic and heterogeneous environment. The context information can be used to reconfigure security mechanisms and adjust security parameters. The contextual information can be integrated into various security mecha- nisms such as authentication, access control, encryption, etc. The context-aware security is the dynamic adjustment of secu- rity policy based on the context. In this paper, we discuss the context-awareness techniques for authentication and access control mechanisms. We present the concepts of context, con- text- awareness, and context based security and highlight con- textual attributes that can be used to support and enhance authentication and access control mechanisms for the Internet of Things. <s> BIB004
The security risk can be used as an access control feature where a risk analysis is performed on each access request to make the access decision (Dos BIB003 . The security risk can be defined as the potential damage that can emerge from an operation and is generally represented by the probability of occurrence of an undesired incident multiplied by its impact. Clearly, the essential stage of developing a riskbased access control model in the IoT is the risk estimation process that based on the possibility of an information leakage in the future and the value of this information. The risk is estimated in different ways. The objective of the risk estimation operation is to create a way of arranging risks in the order of importance and use risk numeric values for making the decision. The risk estimation process can be qualitative or quantitative BIB001 . In this paper, only quantitative risk estimation techniques will be discussed. Quantitative risk estimation attempts to attach specific numerical or linguistic values to risks. These values can be like very risky, not so risky; high, low, medium, high medium, and low medium. Numerical techniques for decision analysis are used in this approach BIB002 . Quantitative risk estimation techniques are preferred since it results in a numeric value for the risk. Risk estimation process faces many challenges for various reasons. For instance, the goal of the risk estimation process is to predict the future possibility of information disclosure that results from the current access. Determining such a possibility is not an easy task BIB004 . Moreover, if the estimation has relied on incomplete or imprecise information and knowledge about relevant risk features, it will result in difficulties in identifying the value of information (Ni et al., 2010) . Therefore, a complete investigation about different risk estimation techniques that are related to dynamic access control models needs to be performed so as to select the appropriate risk estimation technique for the IoT. An overview of the most common risk estimation techniques is provided in this section. These techniques are as follows: