# Tradeoffs in Key Rotation Strategies for Industrial Internet of Things Devices and Firmware
## 4 Recommendations and Conclusions
* Look for, and utilize, suppliers that include key management solutions as part of their offering to accelerate secure IIOT implementation. Specifically, by leveraging shared services, additional value might be unlocked. * Take advantage of IIOT services when the assurance of network latency or tolerance for retry is at least moderate. For example, reliance on shared connectivity channels could result in unplanned interruptions and intermittent signals. Where possible, couple connectivity with redundant or alternate connectivity channels such as wired and wireless should be used. Last, but not least, it is important to always consider the long-term impact and the bigger picture. Selecting a viable rotation approach is not just about building a cybersecure system based on technical considerations. It is about building systems, that intended stakeholders consider trustworthy, which is the ultimate form of validation that the right rotation approach has been chosen. In conclusion, selecting a certificate and key rotation approach depends on various factors tied to each organization's overarching goals and objectives. Technical considerations are one, but not the only, element involved in arriving at the right approach. Specifically, only when multiple factors are considered can a truly adaptive security approach be realized. Also, the emerging trends in using artificial intelligence show two facets. One side of AI is being widely explored by adversaries to weaken the traditional compensating controls [26]. From the defensive perspective, AI is emerging in the threat detection and mitigation [27]; however, there are many limitations that need a significant amount of work before it can be relied upon. From both of these perspectives, i.e., counteracting offensive artificial intelligence and the limitations in utilizing defensive artificial intelligence, it is important to have more evolutionary systems, and making key rotation the integral part of the system elevates the cybersecurity of the system to a significantly better posture. Future work will be required to steer chip vendors to provide first-class utilities readily provided that support advanced cryptography methods. Signed Certificate with Immutable Bootloader (E) is based on the assumption of immutable Root Certificate, which will need further research and experimentation to address root certificate refresh in case of CA compromise, or post-quantum crypto challenges. There are several outcomes that are impacted by key rotation architecture and methodology (see Table 1 and Figure 5). Experimentation will need to consider many of these measures as the application of key rotation impacts a wide range of outcomes from both security and development efficiency. More research and experimentation is required on architectures to address key revocation. Further, this work should be connected to the overall software supply chain to derive more novel approaches to the overall problem, which is a subject worthy of a separate paper. Conceptualization: [PERSON], [PERSON] and [PERSON]; methodology: [PERSON] and [PERSON]; software: [PERSON]; validation: [PERSON]; formal analysis: [PERSON]; investigation: [PERSON] and [PERSON]; resources: [PERSON] and [PERSON]; data curation: [PERSON] and [PERSON]; writing--original draft preparation: [PERSON], [PERSON] and [PERSON]; writing--review and editing: [PERSON], [PERSON] and [PERSON]; visualization: [PERSON] and [PERSON]; supervision: [PERSON]; project administration: [PERSON]; funding acquisition: [PERSON]. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. Data Availability Statement:No new data were created or analyzed in this study. Data sharing is not applicable to this article. We would like to acknowledge [PERSON] and the key rotation best practices document written for internal consumption for several product teams across Xylem--that inspired this evaluation.