  We present a threat modelling approach to represent changes to the attack
paths through an Internet of Things (IoT) environment when the environment
changes dynamically, i.e., when new devices are added or removed from the
system or when whole sub-systems join or leave. The proposed approach
investigates the propagation of threats using attack graphs. However,
traditional attack graph approaches have been applied in static environments
that do not continuously change such as the Enterprise networks, leading to
static and usually very large attack graphs. In contrast, IoT environments are
often characterised by dynamic change and interconnections; different
topologies for different systems may interconnect with each other dynamically
and outside the operator control. Such new interconnections lead to changes in
the reachability amongst devices according to which their corresponding attack
graphs change. This requires dynamic topology and attack graphs for threat and
risk analysis. In this paper, we develop a threat modelling approach that cope
with dynamic system changes that may occur in IoT environments and enables
identifying attack paths whilst allowing for system dynamics. We develop
dynamic topology and attack graphs that are able to cope with the changes in
the IoT environment rapidly by maintaining their associated graphs. To motivate
the work and illustrate our approach we introduce an example scenario based on
healthcare systems. Our approach is implemented using a Graph Database
Management Tool (GDBM) -- Neo4j -- which is a popular tool for mapping,
visualising and querying the graphs of highly connected data, and is efficient
in providing a rapid threat modelling mechanism, which makes it suitable for
capturing security changes in the dynamic IoT environment.
