14 Attackers Target Weakness – Ensure that security controls are equivalent across interfaces in an ecosystem. Attackers will identify the weakest component and attempt to exploit it. Mobile interfaces, hidden API's, or resource constrained environments must enforce security in the same way as more robust or feature rich interfaces. Using multi-factor authentication for a web interface is useless if a mobile application allows access to the same APIs with a four-digit PIN. 15 Transitive Ownership – IoT components are often sold or transferred during their lifespan. Plan for this eventuality and be sure IoT systems can protect and isolate data to enable safe transfer of ownership, even if a component is sold or transferred to a competitor or attacker. 16 N:N Authentication – Realise that IoT does not follow a traditional 1:1 model of users to applications. Each component may have more than one user and a user may interact with multiple components. Several users might access different data or capabilities on a single device, and one user might have varying rights to multiple devices. Multiple devices may need to broker permissions on behalf of a single user account, and so on. Be sure the IoT system can handle these complex trust and authentication schemes. AOITI Basic Privacy Principles The Alliance for IoT Innovation (AIOTI) organised a workshop in 2016 in Sophia Antipolis, France, to explore and identify design principles for IoT security.107 One of the workshops was dedicated to practical privacy in IoT, and participants identified the following principles. AIOTI Basic Requirements on Practical Privacy in IoT 40 1 Common Understanding – Design, manufacturer and assemble components of Things and IoT ecosystems with clear understanding of what means what, and to what extent there is consensus in the related complex value chain and ecosystems. Promoting the goals of data protection such as limiting the scope of data processing to the necessary level; data segmentation, mapping, categorisation, purpose limitation, data isolation, and data control and data access of personal data are seen as prerequisite elements. 2 No Personal Data by Default, ‘As-If’ by Design & De-Identification by Default – Data minimalisation starts with only requesting, collecting, obtaining, deriving and processing personal data to the extent necessary (need-toknow principle), and. The ‘As-If�� principle it to design and engineer ecosystems in IoT as if these will (now or in a later phase) process personal data. The As-If principle is closely related to the privacy by design and privacy by default principles. Design de-Identification capabilities so personal data is de-identified as soon as legally possible. 3 Manufacturer-Implemented Parametrisation – Rights management for accessing data controlled by the user based on the assessment where and when a Thing or IoT ecosystems in its life cycle comes into contact with personal data, creates/derives (new) personal data, or otherwise processes personal data, while keeping in my mind the contextuality of purposes and use, as well as multi-purpose Things and IoT ecosystems. 107 AIOTI Workshop On Security and Privacy in the Hyper-Connected World, Report, 2016