4 KEY INITIATIVES 4.1 INVENTORY OF KEY INITIATIVES Numerous IoT security initiatives have emerged in recent years. We have identified 25 major initiatives for further examination; each initiative is described in more detail in Annex B. The initiatives have been chosen based on their focus on and contributions to IoT security rather than IoT in general. These initiatives contribute to and, to some extent, define the state of the art in IoT security. The initiatives broadly fall within the below categories. – IoT-focused groups formed by standards development organisations (SDOs) such as ETSI, the International Telecommunications Union (ITU)64 and the Internet Engineering Task Force (IETF)65. – Professional bodies such as the Industrial Internet Consortium (IIC)66, the IoT Security Foundation67, and the Cloud Security Alliance68. – Governmental initiatives such as the IoT security divisions of NIST69 and ENISA70, and the Alliance for IoT Innovation (AIOTI)71. – Alliances focused on networking standards, such as GSMA72, Zigbee73 and LoRa74. – Initiatives dedicated to hardware platforms, such as the Trusted Computing Group (TCG)75, UEFI76 and GlobalPlatform77. comparatively less focus (in terms of number of initiatives) on supply chain and lifecycle. It is noted that several of the initiatives are dedicated chiefly to a single challenge: Wi-SUN78, Zigbee, LoRa and IETF are focused primarily on IoT networking and communications (and the accompanying standards), the Global Cyber Alliance79 deals with threat analytics and intelligence, and UEFI and GlobalPlatform largely address hardware security. Some bodies, such as the IoT Security Foundation (IoTSF) and the Industrial Internet Consortium (IIC), have a much wider focus. Table 2 indicates the IoT security challenge/s primarily addressed by each key initiative. The table reveals a strong emphasis on standards as well as connectivity, and Table 3 describes the primary membership of each initiative in terms of professional domain (government, industry or academia) and geographical region. We observe that government involvement is limited, particularly for nonEuropean initiatives. Also, there is a strong tendency towards continental initiatives, focusing on the Americas or Europe. Only the IoT Acceleration Consortium80 and Wi-SUN are oriented towards Asia, specifically Japan. Given that Asia is a manufacturing hub for computer hardware and microelectronics, we would expect to find more IoT security activity in this region – although it is possible that we have been unable to identify Asian initiatives owing to language barriers. We were also unable to find major initiatives operating in Africa, although we note that the IoT Forum Africa81 is held annually in Johannesburg. Table 4 reiterates that global governmental initiatives are lacking – the sole international government-driven initiative appears to be the ITU-T Study Group 2082. 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 https://www.itu.int/en/ITU-T/studygroups/2017-2020/20/Pages/default.aspx https://www.ietf.org/topics/iot/ https://www.iiconsortium.org/ https://www.iotsecurityfoundation.org/ https://cloudsecurityalliance.org/ https://www.nist.gov/topics/internet-things-iot https://www.enisa.europa.eu/topics/iot-and-smart-infrastructures/iot https://aioti.eu/ https://www.gsma.com/iot/ https://www.zigbee.org/ https://lora-alliance.org/ https://trustedcomputinggroup.org/ https://uefi.org/ https://globalplatform.org/ https://www.wi-sun.org/ https://www.globalcyberalliance.org/smart-cities-and-iot/ http://www.iotac.jp/en/ http://iotforumafrica.com/ https://www.itu.int/en/ITU-T/about/groups/Pages/sg20.aspx 31