Abstract:A user's devices such as their phone and computer are constantly bombarded by IoT devices and associated applications seeking connection to the user's devices. These IoT devices may or may not seek explicit user consent, thus leaving the users completely unaware the IoT device is collecting, using, and/or sharing their personal data or, only marginal informed, if the user consented to the connecting IoT device but did not read the associated privacy policies. Privacy policies are intended to inform users of what personally identifiable information (PII) data will be collected about them and the policies about how those PII data will be used and shared. This paper presents novel tools and the underlying algorithms employed by the Personal Privacy Assistant app (UTCID PPA) developed by the University of Texas at Austin Center for Identity to inform users of IoT devices seeking to connect to their devices and to notify those users of potential privacy risks posed by the respective IoT device. The assessment of these privacy risks must deal with the uncertainty associated with sharing the user's personal data. If privacy risk (R) equals the consequences (C) of an incident (i.e., personal data exposure) multiplied by the probability (P) of those consequences occurring (C × P), then efforts to control risks must seek to reduce the possible consequences of an incident as well as reduce the uncertainty of the incident and its consequences occurring. This research classifies risk according to two parameters: expected value of the incident's consequences and uncertainty (entropy) of those consequences. This research calculates the entropy of the privacy incident consequences by evaluating: (1) the data sharing policies governing the IoT resource and (2) the type of personal data exposed. The data sharing policies of an IoT resource are scored by the UTCID PrivacyCheck™, which uses machine learning to read and score the IoT resource privacy policies against metrics set forth by best practices and international regulations. The UTCID Identity Ecosystem uses empirical identity theft and fraud cases to assess the entropy of privacy incident consequences involving a specific type of personal data, such as name, address, Social Security number, fingerprint, and user location. By understanding the entropy of a privacy incident posed by a given IoT resource seeking to connect to a user's device, UTCID PPA offers actionable recommendations enhancing the user's control over IoT connections, interactions, their personal data, and, ultimately, user-centric privacy control.

Risk factors of enterprise internal control under the internet of things governance: A qualitative research approach

Governance of the Internet of Things (IoT)

Research on the application of enterprise internal control and risk management under the background of digital intelligence

When Your Thing Won't Behave: Security Governance in the Internet of Things

Risk Management for IoT Devices in Ports

Dynamic real-time risk analytics of uncontrollable states in complex internet of things systems, cyber risk at the edge

Refined Characterization of Internet of Things Applications in Power Systems

Internet of Things (IoT) Cybersecurity: Literature Review and IoT Cyber Risk Management

Security Risk Assessment in Internet of Things Systems

Research on the Impact of Board Governance Model Based on Multi-Internet of Things Perception System on System Risk of Large Business Institutions in China

IoT Health Devices: Exploring Security Risks in the Connected Landscape

The Challenges with Internet of Things for Business

If you can't understand it, you can't properly assess it! The reality of assessing security risks in Internet of Things systems

Trust Management for Internet of Things: A Comprehensive Study

IoT Privacy Risks Revealed

Risk assessment and control of agricultural supply chains under Internet of Things

Future developments in standardisation of cyber risk in the Internet of Things (IoT)

Human Factor, a Critical Weak Point in the Information Security of an Organization's Internet of Things

Access Control for IoT: A Survey of Existing Research, Dynamic Policies and Future Directions

Understanding data governance requirements in IoT adoption for smart ports – a gap analysis

Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be