IoT Security Principles from DCMS UK The U.K. Government’s Department for Digital, Culture, Media and Sport (DCMS) has published a report104 on IoT security in which five guiding principles are identified to inform future action. The report also describes the development of the U.K.’s Code of Practice105 on IoT Security. UK Government – Improving the Cyber Security of Consumer IoT 1 Reducing Burden – Many consumers struggle to understand what is required of them, or conducted on their behalf, to keep their products secure. Reducing the burden on consumers will likely require everyone in the supply chain to pay more attention to security. 2 Transparency – Greater transparency is an essential part of a secure by design approach. Being open and explicit about security mechanisms that have been put in place to secure a product or service, allows for accountability and scrutiny, thereby enabling others in the supply chain to make informed choices. 3 Measurability – A secure by design approach should not just be about putting in place good security mechanisms, but also being able to measure the effectiveness of those mechanisms. 4 Facilitating Dialogue – Facilitating dialogue means maintaining effective communication between all parties across the supply chain and with consumers. 5 Resilience – A secure by design approach should further have provisions to increase the resilience of critical functions and services. This includes conducting business continuity planning, establishing a “fallback framework” and undertaking regular risk assessments to anticipate and mitigate future problems. IoT Security Principles by OWASP OWASP states sixteen principles106 that cover the full spectrum of IoT from system hardening and lifecycle support to authentication and isolation. IoT Security Principles by OWASP 38 1 Assume a Hostile Edge – Edge components are likely to fall into adversarial hands. Assume attackers will have physical access to edge components and can manipulate them, move them to hostile networks, and control resources such as DNS, DHCP, and internet routing. 2 Test for Scale – The volume of IoT means that every design and security consideration must also consider scale. Simple bootstrapping into an ecosystem can create a self-denial of service condition at IoT scale. Security countermeasures must perform at volume. 104 Secure by Design: Improving the cyber security of consumer Internet of Things. Policy report UK Government, March 2018. 105 https://www.gov.uk/government/publications/secure-by-design/code-of-practice-for-consumer-iot-security 106 https://www.owasp.org/index.php/Principles_of_IoT_Security