5 IOT SECURITY CHALLENGES This chapter articulates the 11 IoT security challenges in detail. For each challenge we describe the current landscape and recent developments to examine the gap between the challenge and the state of the art. The full set of findings for the 11 security challenges are input for the conclusions and recommendations to drive IoT cybersecurity forward. 5.1 CYBERSECURITY AND PRIVACY BY DESIGN To build cybersecurity and privacy by design into IoT, a set of security principles should be adopted and adhered to. These principles form the basis for standards, future-proof legislation, and operational security solutions. Strategic Principles by DHS The U.S. DHS describes the risks associated with IoT and provides a set of principles and best practices to build security into IoT.102 US Department of Homeland Security – Strategic Principles for Securing the IoT 1 Incorporate Security at the Design Phase 2 Advance Security Updates and Vulnerability Management 3 Build on Proven Security Practices 4 Prioritise Security Measures According to Potential Impact 5 Promote Transparency across IoT 5.1.1 Current Landscape and Recent Developments The United States Department of Homeland Security (DHS)98, OWASP 99, the Korea Internet & Security Agency100, and the Alliance for IoT Innovation (AIOTI)101 have all defined sets of IoT security and privacy principles. 6 Connect Carefully and Deliberately IoT Security Principles from South Korea The seven principles of common security for IoT as proposed by Korea Internet & Security Agency103 should be considered by the providers (developers) of IoT devices and services, and by users as well. Korea Internet and Security Agency – IoT Common Security Principles 1 Design IoT products and services in consideration of the need to protect information and strengthen privacy. 2 Apply and verify technologies for the development of safe software and hardware. 3 Provide a method of establishing safe initial security. 4 Comply with the security protocol and set safe parameters. 5 Update security patches against the weak points of IoT products and services continuously. 6 Provide a system for information protection and privacy to ensure safe operation and control. 7 Provide a system capable of coping with infringements of the IoT and a method of detecting the responsible entity. 98 https://www.dhs.gov/ 99 https://www.owasp.org/index.php/Main_Page 100 https://www.kisa.or.kr/eng/main.jsp 101 https://aioti.eu/ 102 https://www.dhs.gov/sites/default/files/publications/ Strategic_ Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL....pdf 103 IoT Common Security Principles v1.0, Korea Internet & Security Agency. 37