Security and Privacy Guidelines for the Internet of Things

[steven36]

 

Lately, I have been collecting IoT security and privacy guidelines. Here's everything I've found:

1. "Internet of Things (IoT) Broadband Internet Technical Advisory Group, Broadband Internet Technical Advisory Group, Nov 2016.
2. "IoT Security Guidance," Open Web Application Security Project (OWASP), May 2016.
3. "Strategic Principles for Securing the Internet of Things (IoT)," US Department of Homeland Security, Nov 2016.
4. "Security," OneM2M Technical Specification, Aug 2016.
5. "Security Solutions," OneM2M Technical Specification, Aug 2016.
6. "IoT Security Guidelines Overview Document," GSM Alliance, Feb 2016.
7. "IoT Security Guidelines For Service Ecosystems," GSM Alliance, Feb 2016.
8. "IoT Security Guidelines for Endpoint Ecosystems," GSM Alliance, Feb 2016.
9. "IoT Security Guidelines for Network Operators," GSM Alliance, Feb 2016.
10. "Establishing Principles for Internet of Things Security," IoT Security Foundation, undated.
11. "IoT Design Manifesto," www.iotmanifesto.com, May 2015.
12. "NYC Guidelines for the Internet of Things," City of New York, undated.
13. "IoT Security Compliance Framework," IoT Security Foundation, 2016.
14. "Principles, Practices and a Prescription for Responsible IoT and Embedded Systems Development," IoTIAP, Nov 2016.
15. "IoT Trust Framework," Online Trust Alliance, Jan 2017.
16. "Five Star Automotive Cyber Safety Framework," I am the Cavalry, Feb 2015.
17. "Hippocratic Oath for Connected Medical Devices," I am the Cavalry, Jan 2016.
18. "Industrial Internet of Things Volume G4: Security Framework," Industrial Internet Consortium, 2016.
19. "Future-proofing the Connected World: 13 Steps to Developing Secure IoT Products," Cloud Security Alliance, 2016.

Other, related, items:

1. "We All Live in the Computer Now," The Netgain Partnership, Oct 2016.
2. "Comments of EPIC to the FTC on the Privacy and Security Implications of the Internet of Things," Electronic Privacy Information Center, Jun 2013.
3. "Internet of Things Software Update Workshop (IoTSU)," Internet Architecture Board, Jun 2016.
4. "Multistakeholder Process; Internet of Things (IoT) Security Upgradability and Patching," National Telecommunications & Information Administration, Jan 2017.

 

They all largely say the same things: avoid known vulnerabilities, don't have insecure defaults, make your systems patchable, and so on.

 

 

My guess is that everyone knows that IoT regulation is coming, and is either trying to impose self-regulation to forestall government action or establish principles to influence government action. It'll be interesting to see how the next few years unfold. If there are any IoT security or privacy guideline documents that I'm missing, please tell me in the comments.

 

 

EDITED TO ADD: Documents added to the list, above.

 

By Bruce Schneier

https://www.schneier.com/blog/archives/2017/02/security_and_pr.html

 

 

[CiscoLV21]

THANK YOU FOR THE INFORMATION!