– Security Labels – Proven labels such as an ‘Energy efficiency label’ of appliances in order to classify the IoT device. – Preset Certified Security Structures – Encryption requirement for identities, access, communication channels and secure storage of keys and to store data at rest – also for secure boot process. – Security Rationale – Explanation of implemented security measures related to well understood hazards in order to define acceptable level security risks from any designer of IoT device, auditable by independent third party. – Information exchange – Sharing information about incidents/potential vulnerabilities between manufacturers. – Defined functions – IoT devices should only be able to perform documented functions, making sense for device/service. – Standardisation – Interoperability of components and communication protocols. NIST IoT Cybersecurity Program NIST’s Cybersecurity for the Internet of Things (IoT) Program122 is undertaking efforts to identify a core set of cybersecurity capabilities to form a baseline for IoT devices. In September 2018, NIST released a publication entitled “Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks” in order to help federal agencies and other organisations better understand and manage the cybersecurity and privacy risks associated with their IoT devices throughout device lifecycles123. This publication is intended to be an introductory foundation for a planned series of publications on more specific aspects of this topic. As of mid-2019, NIST is focusing on engaging 122 https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program 123 https://csrc.nist.gov/publications/detail/nistir/8228/final 124 https://www.nist.gov/blogs/i-think-therefore-iam/ lets-talk-about-iot-device-security 125 https://www.nist.gov/sites/default/files/documents/2019/02/01/final_ core_iot_cybersecurity_capabilities_baseline_considerations.pdf with stakeholders124 via workshops, seminars and a draft discussion paper125 in order to gather feedback for a Core IoT Cybersecurity Capabilities Baseline. Industrial Internet of Things Security Framework 126 Early IoT applications included industrial control systems, or Operational Technology (OT), that converged with IT to create an Industrial IoT. Such an IoT system connects and integrates industrial control systems with enterprise software and business processes and analytics to improve decision-making, operations and collaboration among a large number of increasingly autonomous control systems. The Industrial Internet Consortium’s IIoT Security Framework approaches IoT in a generic and detailed manner, and provides concrete recommendations for endpoint security, communications security, and data protection, making this report highly relevant for IoT device manufacturers. GSMA IoT Security Guidelines127 The telecommunications industry, which the GSMA represents, has a history of providing secure products and services to their customers at a very large scale. According to the GSMA, the provision of secure products and services is as much a process as it is a goal. Vigilance, innovation, responsiveness and continuous improvement are required to ensure that the solutions address the threats. To help ensure that the new IoT services coming to market are secure, the GSMA has created a comprehensive set of security guidelines128 for the benefit of service providers who are looking to develop new IoT services. Taking this a step further is GSMA’s assessment checklist129, which enables the suppliers of IoT products, 126 127 128 129 http://www.iiconsortium.org/pdf/IIC_PUB_G4_V1.00_PB-3.pdf https://www.gsma.com/iot/iot-security/iot-security-guidelines/ IoT Security Guidelines Overview Document, Version 2.0, 31 October 2017 https://www.gsma.com/iot/iot-security-assessment/ 43