3.1 PRINCIPLES, GOVERNANCE AND LEGISLATION IoT security needs to be based upon fundamentally sound cybersecurity principles. To achieve security in practice, these principles should lead to concrete guidelines and standards. Standards are used as a basis for evaluation and certification. For certification schemes to be successful, there must either be demand for certification from customers/users or governmental legislation mandating a minimum assurance level. Finally, since IoT is a global phenomenon and is not limited by national boundaries, it is essential to align country-specific legislations and adopt a coherent global approach to IoT security to drive standards and collaboration in creating an IoT environment that upholds security and privacy expectations. We identified the following challenges in this problem space. 1. Cybersecurity and Privacy by Design – To identify and define foundational principles to build cybersecurity and privacy by design for IoT devices. 2. IoT Security Standards and Guidelines – To set and harmonise IoT security standards and recommen­ dations over different application domains. 3. Evaluation and Certification – To develop globally recognised and adopted cybersecurity evaluation and certification regimes for IoT devices. 4. Future-Proof Legislation – To develop regulatory policies that are sufficiently flexible to deal with societal security needs and a constantly evolving industry. 3.2 ECOSYSTEM DEVELOPMENT As mentioned in the introduction to this document, timeto-market, usability and cost are key considerations for IoT solutions, and the razor-thin margins for devices leave suppliers with less to spend on security. Besides incentivising manufacturers to implement security, it is important to cultivate an ecosystem that fosters security in IoT supply chains and throughout device lifecycles. This 26 study identified the following challenges in this problem space56. 5. Responsible Industry Ecosystem – To transform to a responsible industry that proactively implements cybersecurity in IoT devices. 6. Supply Chain Security – To create a framework for all suppliers and service providers involved in the supply chain to adopt security principles and to deliver secure IoT components. 7. Product Lifecycle Support – To implement a framework for secure device lifecycle management and patching that is adopted by all parties involved. 3.3 TECHNICAL REFERENCES AND STANDARDS Finally, this study examines the security challenges in the IoT technologies themselves: the devices and firmware, the operating systems and applications on the devices and back-end servers, and the communication infrastructure connecting devices to gateways and back-ends. The identified technical challenges are aligned with “the four cornerstones of security” identified by Symantec57. 8. Device Identity and Root of Trust – To establish a chain of trust from a root of trust on resource-constrained IoT devices to develop foundationally secure devices. 9. Secure OS, Cloud and Applications – To provision security controls in device OSes as well as cloud and back-end applications to guarantee security within the IoT ecosystem. 10. Secure Communications and Infrastructure – To ensure data and source integrity in the communication networks of resource-constrained IoT devices. 11. Security Monitoring and Analytics – To detect vulnerabilities, anomalies and threats in IoT deployments and to quickly respond, recover and remediate. 56 Numbering of the challenges continues from 1 to 11 over the three problem spaces. 57 Smart Nation: Cloud Delivery of Managed Security Services, Brian Witten, Symantec. Delivered during SICW International IoT Security Roundtable 2017.