According to ABI Research, at this moment less than 4% of IoT devices are secure by design.24 The real-life incidents depicted in Figure 1 emphasise the urgency of improving IoT security. For IoT to be successful, useful and acceptable, the hazards that come with the widespread use of IoT must be managed to risk levels acceptable for society. 1.1 OBJECTIVES This study provides input to global efforts in creating a safe and secure cyberspace of things; a global approach is required, since IoT security is not limited by national boundaries. These efforts shall lead to a global platform to share ideas and experiences, shape technologies and architectures, and drive standards and collaboration in creating a next-generation, inherently secure IoT ecosystem that upholds security and privacy expectations. The objective of this study is to define the problem spaces, determine the security challenges and identify gaps based on the current technological and policy landscape for each challenge in order to present key findings and recomm­ endations, thus formulating the foundations for global actions and dialogue. In some industries, such an approach has been followed for decades: for example, the automotive industry develops designs in competition, while safety is based on common global standards (car safety certifications) and responsibilities (the manufacturer bears the cost of recalls). 1.2 PROBLEM STATEMENT The problem statement is formulated based on the following observations of the IoT ecosystem. 1. IoT is by definition vulnerable – IoT is a network of physical devices using open network standards and software. Recent history has shown that such a network is highly vulnerable, especially given the resourceconstrained nature of the devices and their oftenunsupervised operation. 2. IoT devices are deployed fast, on a global scale and with unknown lifespan – IoT is one of the main drivers of innovation in today’s world and, owing to the almost borderless digital economy, IoT solutions are developed for a global market. As a result, the pace of technology development is high and competition is fierce. At the same time, product lifecycles may be long, and devices can be used for a longer period than intended by the manufacturers. 3. No level playing field for IoT device manufacturers – Owing to the lack of legislations and the differences in legislative environments in different countries, there is no level playing field for vendors nor a common expectation of security functionality. 4. Lack of security in the IoT business equation – Time-tomarket, usability and cost are key considerations for many solutions, and the razor-thin margins for these devices leave manufacturers with less to spend on security with virtually no incentive25: indeed, an attack on a device may affect neither the manufacturer nor the user but heavily impact a third party target in a botnet scenario. 5. Lack of IoT security awareness26 – The current landscape is too complex for most end-users to really understand the risks to themselves and to others – for instance, few consumers would appreciate the very real risk of their refrigerators or smart TVs being used as part of a botnet in a DDoS attack. Given these observations, we formulate the following problem statement: Vulnerable IoT devices are deployed fast, globally and with unknown lifespan, while a level playing field on common standards and technical solutions for cybersecurity in IoT is lacking for the industry. This creates safety, environmental and social hazards that are not well understood and likely to be unacceptable for society. 24 IoT Security from Design to Lifecycle Management, An Embedded Perspective; ABI Research, 2018. 25 The economics of the security of consumer-grade IoT products and services, Internet Society / Plum Consulting, April 2019. 26 ‘Towards a secure connected digital society’ – Advice regarding cybersecurity of IoT, by Dutch Cyber Security Council, 2018. In Dutch. 13