{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:25:40Z","timestamp":1750220740988,"version":"3.41.0"},"reference-count":39,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2020,9,4]],"date-time":"2020-09-04T00:00:00Z","timestamp":1599177600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Interact. Mob. Wearable Ubiquitous Technol."],"published-print":{"date-parts":[[2020,9,4]]},"abstract":"<jats:p>Users of Internet of Things (IoT) devices are often unaware of their security risks and cannot sufficiently factor security considerations into their device selection. This puts networks, infrastructure and users at risk. We developed and evaluated SAFER, an IoT device risk assessment framework designed to improve users' ability to assess the security of connected devices. We deployed SAFER in a large multinational organization that permits use of private devices. To evaluate the framework, we conducted a mixed-method study with 20 employees. Our findings suggest that SAFER increases users' awareness of security issues. It provides valuable advice and impacts device selection. Based on our findings, we discuss implications for the design of device risk assessment tools, with particular regard to the relationship between risk communication and user perceptions of device complexity.<\/jats:p>","DOI":"10.1145\/3414173","type":"journal-article","created":{"date-parts":[[2020,9,4]],"date-time":"2020-09-04T21:39:45Z","timestamp":1599255585000},"page":"1-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":8,"title":["SAFER"],"prefix":"10.1145","volume":"4","author":[{"given":"Pascal","family":"Oser","sequence":"first","affiliation":[{"name":"Ulm University, Ulm, Germany, European Organization for Nuclear Research (CERN), Geneva, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sebastian","family":"Feger","sequence":"additional","affiliation":[{"name":"Ludwig Maximilian University of Munich, Munich, Germany, European Organization for Nuclear Research (CERN), Geneva, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Pawe\u0142 W.","family":"Wo\u017aniak","sequence":"additional","affiliation":[{"name":"Utrecht University, Utrecht, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jakob","family":"Karolus","sequence":"additional","affiliation":[{"name":"Ludwig Maximilian University of Munich, Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dayana","family":"Spagnuelo","sequence":"additional","affiliation":[{"name":"Vrije Universiteit Amsterdam, Amsterdam, Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Akash","family":"Gupta","sequence":"additional","affiliation":[{"name":"National University of Singapore, Singapore"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Stefan","family":"L\u00fcders","sequence":"additional","affiliation":[{"name":"European Organization for Nuclear Research (CERN), Geneva, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Albrecht","family":"Schmidt","sequence":"additional","affiliation":[{"name":"Ludwig Maximilian University of Munich, Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Frank","family":"Kargl","sequence":"additional","affiliation":[{"name":"Ulm University, Ulm, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2020,9,4]]},"reference":[{"key":"e_1_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00013"},{"key":"e_1_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.18637\/jss.v067.i01"},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30436-1_23"},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-02217-3"},{"key":"#cr-split#-e_1_2_2_5_1.1","doi-asserted-by":"crossref","unstructured":"David A. Borman Robert T. Braden and Van Jacobson. 1992. TCP Extensions for High Performance. RFC 1323. https:\/\/doi.org\/10.17487\/RFC1323 10.17487\/RFC1323","DOI":"10.17487\/rfc1323"},{"key":"#cr-split#-e_1_2_2_5_1.2","doi-asserted-by":"crossref","unstructured":"David A. Borman Robert T. Braden and Van Jacobson. 1992. TCP Extensions for High Performance. RFC 1323. https:\/\/doi.org\/10.17487\/RFC1323","DOI":"10.17487\/rfc1323"},{"key":"e_1_2_2_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3206505.3206587"},{"key":"e_1_2_2_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3173574.3173848"},{"key":"e_1_2_2_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3357767.3357774"},{"key":"e_1_2_2_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICONS.2009.8"},{"key":"e_1_2_2_10_1","volume-title":"Lorrie Faith Cranor, and Hanan Hibshi","author":"Emami-Naeini Pardis","year":"2020","unstructured":"Pardis Emami-Naeini , Yuvraj Agarwal , Lorrie Faith Cranor, and Hanan Hibshi . 2020 . Ask the Experts : What Should Be on an IoT Privacy and Security Label ? arXiv preprint arXiv:2002.04631 (2020). Pardis Emami-Naeini, Yuvraj Agarwal, Lorrie Faith Cranor, and Hanan Hibshi. 2020. Ask the Experts: What Should Be on an IoT Privacy and Security Label? arXiv preprint arXiv:2002.04631 (2020)."},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3290605.3300764"},{"key":"e_1_2_2_12_1","unstructured":"ENISA. 2017. ENISA Baseline Security Recommendations for IoT. https:\/\/www.enisa.europa.eu\/publications\/baseline-security-recommendations-for-iot  ENISA. 2017. ENISA Baseline Security Recommendations for IoT. https:\/\/www.enisa.europa.eu\/publications\/baseline-security-recommendations-for-iot"},{"key":"e_1_2_2_13_1","unstructured":"ENISA. 2019. ENISA IoT Security Standards Gap Analysis. https:\/\/www.enisa.europa.eu\/publications\/iot-security-standards-gap-analysis  ENISA. 2019. ENISA IoT Security Standards Gap Analysis. https:\/\/www.enisa.europa.eu\/publications\/iot-security-standards-gap-analysis"},{"key":"e_1_2_2_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3314397"},{"key":"e_1_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3173574.3173876"},{"key":"e_1_2_2_16_1","unstructured":"Gartner. 2019. Gartner Says 5.8 Billion Enterprise and Automotive IoT Endpoints WillBe in Use in 2020. https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2019-08-29-gartner-says-5-8-billion-enterprise-and-automotive-io  Gartner. 2019. Gartner Says 5.8 Billion Enterprise and Automotive IoT Endpoints WillBe in Use in 2020. https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2019-08-29-gartner-says-5-8-billion-enterprise-and-automotive-io"},{"volume-title":"Information Technology-New Generations","author":"Girma Anteneh","key":"e_1_2_2_17_1","unstructured":"Anteneh Girma . 2018. Analysis of Security Vulnerability and Analytics of Internet of Things (IOT) Platform . In Information Technology-New Generations . Springer , 101--104. Anteneh Girma. 2018. Analysis of Security Vulnerability and Analytics of Internet of Things (IOT) Platform. In Information Technology-New Generations. Springer, 101--104."},{"key":"e_1_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.1002\/bimj.200810425"},{"key":"e_1_2_2_19_1","volume-title":"SecIoT: a security framework for the Internet of Things. Security and communication networks 9, 16","author":"Huang Xin","year":"2016","unstructured":"Xin Huang , Paul Craig , Hangyu Lin , and Zheng Yan . 2016. SecIoT: a security framework for the Internet of Things. Security and communication networks 9, 16 ( 2016 ), 3083--3094. Xin Huang, Paul Craig, Hangyu Lin, and Zheng Yan. 2016. SecIoT: a security framework for the Internet of Things. Security and communication networks 9, 16 (2016), 3083--3094."},{"key":"e_1_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287049"},{"volume-title":"Subjective Logic:A Formalism for Reasoning Under Uncertainty","author":"J\u00f8sang Audun","key":"e_1_2_2_21_1","unstructured":"Audun J\u00f8sang . 2016. Subjective Logic:A Formalism for Reasoning Under Uncertainty . Springer International Publishing Switzerland . https:\/\/doi.org\/10.1007\/978-3-319-42337-1 10.1007\/978-3-319-42337-1 Audun J\u00f8sang. 2016. Subjective Logic:A Formalism for Reasoning Under Uncertainty. Springer International Publishing Switzerland. https:\/\/doi.org\/10.1007\/978-3-319-42337-1"},{"key":"e_1_2_2_22_1","first-page":"20","article-title":"Educating Consumers on the Security and Privacy of Internet of Things (IoT) Devices","volume":"5","author":"Khadeer Mahmood","year":"2018","unstructured":"Mahmood Khadeer , Marc Dupuis , and Samreen Khadeer . 2018 . Educating Consumers on the Security and Privacy of Internet of Things (IoT) Devices . In Journal of The Colloquium for Information System Security Education , Vol. 5. 20 -- 20 . Mahmood Khadeer, Marc Dupuis, and Samreen Khadeer. 2018. Educating Consumers on the Security and Privacy of Internet of Things (IoT) Devices. In Journal of The Colloquium for Information System Security Education, Vol. 5. 20--20.","journal-title":"Journal of The Colloquium for Information System Security Education"},{"key":"e_1_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-07620-1_7"},{"key":"e_1_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3287054"},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3139937.3139938"},{"key":"e_1_2_2_26_1","volume-title":"Proc. of CryptoForma","author":"Martina Jean Everson","year":"2010","unstructured":"Jean Everson Martina and Marcelo Carlomagno Carlos . 2010 . Why should we analyse security ceremonies . Proc. of CryptoForma (2010). Jean Everson Martina and Marcelo Carlomagno Carlos. 2010. Why should we analyse security ceremonies. Proc. of CryptoForma (2010)."},{"key":"e_1_2_2_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1985347.1985353"},{"key":"e_1_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/MITP.2012.93"},{"key":"e_1_2_2_29_1","unstructured":"MITRE. 2019. Common Vulnerabilities and Exposures. www.cve.mitre.org  MITRE. 2019. Common Vulnerabilities and Exposures. www.cve.mitre.org"},{"key":"e_1_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.18637\/jss.v060.i02"},{"key":"e_1_2_2_31_1","unstructured":"National Institute of Standards and Technology. 2005. Common Vulnerability Scoring System v2.0. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss  National Institute of Standards and Technology. 2005. Common Vulnerability Scoring System v2.0. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss"},{"volume-title":"International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage","author":"Oser Pascal","key":"e_1_2_2_32_1","unstructured":"Pascal Oser , Frank Kargl , and Stefan L\u00fcders . 2018. Identifying Devices of the Internet of Things Using Machine Learning on Clock Characteristics . In International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage . Springer , 417--427. Pascal Oser, Frank Kargl, and Stefan L\u00fcders. 2018. Identifying Devices of the Internet of Things Using Machine Learning on Clock Characteristics. In International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage. Springer, 417--427."},{"key":"e_1_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/2523501.2523503"},{"key":"e_1_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/2494091.2499770"},{"key":"e_1_2_2_35_1","volume-title":"R: A Language and Environment for Statistical Computing","author":"Team R Core","year":"2020","unstructured":"R Core Team . 2020 . R: A Language and Environment for Statistical Computing . R Foundation for Statistical Computing , Vienna, Austria . https:\/\/www.R-project.org\/ R Core Team. 2020. R: A Language and Environment for Statistical Computing. R Foundation for Statistical Computing, Vienna, Austria. https:\/\/www.R-project.org\/"},{"key":"e_1_2_2_36_1","unstructured":"Dark Reading. 2018. Internet-Connected CCTV Cameras Vulnerable to 'Peekaboo' Hack. https:\/\/www.darkreading.com\/iot\/internet-connected-cctv-cameras-vulnerable-to-peekaboo-hack\/d\/d-id\/1332841  Dark Reading. 2018. Internet-Connected CCTV Cameras Vulnerable to 'Peekaboo' Hack. https:\/\/www.darkreading.com\/iot\/internet-connected-cctv-cameras-vulnerable-to-peekaboo-hack\/d\/d-id\/1332841"},{"key":"e_1_2_2_37_1","unstructured":"Los Angeles Times. 2016. Our privacy is losing out to Internet-connected household devices. https:\/\/www.latimes.com\/business\/la-filazarus-20160115-column.html  Los Angeles Times. 2016. Our privacy is losing out to Internet-connected household devices. https:\/\/www.latimes.com\/business\/la-filazarus-20160115-column.html"},{"key":"e_1_2_2_38_1","unstructured":"WIRED. 2019. Don't Get Your Valentine an Internet-Connected Sex Toy. https:\/\/www.wired.com\/story\/internet-connected-sex-toys-security\/  WIRED. 2019. Don't Get Your Valentine an Internet-Connected Sex Toy. https:\/\/www.wired.com\/story\/internet-connected-sex-toys-security\/"}],"container-title":["Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3414173","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3414173","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:38:38Z","timestamp":1750199918000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3414173"}},"subtitle":["Development and Evaluation of an IoT Device Risk Assessment Framework in a Multinational Organization"],"short-title":[],"issued":{"date-parts":[[2020,9,4]]},"references-count":39,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2020,9,4]]}},"alternative-id":["10.1145\/3414173"],"URL":"https:\/\/doi.org\/10.1145\/3414173","relation":{},"ISSN":["2474-9567"],"issn-type":[{"type":"electronic","value":"2474-9567"}],"subject":[],"published":{"date-parts":[[2020,9,4]]},"assertion":[{"value":"2020-09-04","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}