While many of the above standards include a security component, this section focuses on recommendations that deal with IoT security in general. Technical networking standards (including security aspects) are discussed in the section on Secure Communications and Infrastructure. The UK Department for Digital, Culture, Media & Sport (DCMS), the EU Agency for Network and Information Security (ENISA), the Alliance for IoT Innovation (AIOTI), and GSMA 115 have released recommendations, guidelines or good practices specifically for IoT security. We briefly discuss these below. UK Code of Practice DCMS UK has proposed a Code of Practice116 for the security of consumer IoT products and associated services. The Code identifies that many severe security issues stem from poor security design and bad practice in products sold to consumers. The guidance is listed in order of importance and, according to DCMS, the top three should be addressed as a matter of priority. 1. No default passwords, 2. Implement a vulnerability disclosure policy, 3. Keep software updated, 4. Securely store credentials and security-sensitive data, 5. Communicate securely, 6. Minimise exposed attack surfaces, 7. Ensure software integrity, 8. Ensure that personal data is protected, 9. Make systems resilient to outages, 10. Monitor system telemetry data, 11. Make it easy for consumers to delete personal data, 12. Make installation and maintenance of devices easy, 13. Validate input data. 42 115 https://www.gsma.com/ 116 https://www.gov.uk/government/publications/ code-of-practice-for-consumer-iot-security 117 https://www.petrashub.org/ 118 https://www.etsi.org/newsroom/ press-releases/1549-2019-02-etsi-releases-first-globally-applicablestandard-for-consumer-iot-security The Code of Practice is based on IoT security recomm­ endations from the PETRAS IoT Hub117. In February 2019, the European Standards Organisation ETSI launched a globally-applicable industry standard for IoT devices based on the Code of Practice.118 It is expected that CEN/ CENELEC will also be involved in the further development and dissemination of this standard (see https://www. cencenelec.eu/standards/Sectorsold/DefenceSecurity Privacy/Security/Pages/Cybersecurity.aspx). ENISA Security Recommendations The Baseline Security Recommendations for IoT from ENISA 119 include a number of policy, organisational and technical measures. Technical measures include the use of a hardware-based immutable root of trust, and security features such as specialised security chips / coprocessors that integrate security at the transistor level providing trusted storage of device identity, protecting keys at rest and in use, and preventing unprivileged access to security sensitive code. The overwhelming breadth and depth of coverage make this inventory impressive, but at the same time possibly challenging to implement in practice. AIOTI Recommendations for Standards AIOTI has done considerable work in this area, as referenced by the activity underway within the AIOTI Standards Working Group120 (WG03). According to AIOTI, basic requirements for IoT devices include121: – Testing and Certifying Security – Using existing, proven certifications recognised as state-of-the-art based on assessed risk level; additional introduction of a classification system to certify devices for particular use-case scenarios depending on the level of risk. 119 ENISA ‘Baseline Security Recommendations for IoT’, November 2017 120 https://ec.europa.eu/digital-single-market/en/news/ internet-things-platforms-and-standardisation-workshop 121 AIOTI Workshop On Security and Privacy in the Hyper Connected World Report 20160616