###### Abstract  
Driven by the rapid escalation of its utilization, as well as ramping commercialization, Internet of Things (IoT) devices increasingly face security threats. Apart from denial of service, privacy, and safety concerns, compromised devices can be used as enablers for committing a variety of crime and e-crime. Despite ongoing research and study, there remains a significant gap in the thorough analysis of security challenges, feasible solutions, and open secure problems for IoT. To bridge this gap, we provide a comprehensive overview of the state of the art in IoT security with a critical investigation-based approach. This includes a detailed analysis of vulnerabilities in IoT-based systems and potential attacks. We present a holistic review of the security properties required to be adopted by IoT devices, applications, and services to mitigate IoT vulnerabilities and, thus, successful attacks. Moreover, we identify challenges to the design of security protocols for IoT systems in which constituent devices vary markedly in capability (such as storage, computation speed, hardware architecture, and communication interfaces). Next, we review existing research and feasible solutions for IoT security. We highlight a set of open problems not yet addressed among existing security solutions. We provide a set of new perspectives for future research on such issues including secure service discovery, on-device credential security, and network anomaly detection. We also provide directions for designing a forensic investigation framework for IoT infrastructures to inspect relevant criminal cases, execute a cyber forensic process, and determine the facts about a given incident. This framework offers a means to better capture information on successful attacks as part of a feedback mechanism to thwart future vulnerabilities and threats. This systematic holistic review will both inform on current challenges in IoT security and ideally motivate their future resolution. Internet of Things; analysis; security; communication security; device security; service security; forensic; threats; vulnerabilities; requirements; challenges; solutions; new perspectives +
Footnote †: journal:  
users and cloud services, through Internet connectivity. These services and data must be organized so that any form of access to the data is secure and limited to the parties involved. The security aspect of IoT emerges as the biggest concern; as the IoT spreads widely, digital mischief is likely to become a progressively physical threat [5; 6; 7; 8]. To comprehend the significance of IoT security, one can investigate the existing state of IoT devices that are currently in operation. It is reported that 80% of devices exposed users' private information, such as name and date of birth, according to an assessment survey on commercialized IoT devices conducted by Hewlett-Packard (HP) [9]. The survey also found that 70% of the devices surveyed did not apply any encryption during communication, and 80% of them used fragile passwords in terms of adequate complexity and length. Moreover, of the devices, 60% had come with various security vulnerabilities, including cross-site scripting (XSS) [10] in their interfaces. A summary of the survey findings is provided in Figure 1. A number of studies have demonstrated that it is possible to efficiently establish control over the operation of commercialized IoT devices and perform various illicit operations. Some of those findings are noted in Table 1.  
**A Deeper Look at Why IoT security is different:** The inherent heterogeneity in services [22], applications, and devices in IoT systems introduces multi-modal complexity to the IoT security solution architects and providers. The development of novel IoT security schemes faces further challenges because of the presence of diverse communication media and respective proprietary protocols.