# IoT Security Risk Management Strategy Reference Model (IoTSRM2)
## 2 Materials and Methods
### Overview of IoT Security Best Practices
#### 2.1.2 General IoT Security Best Practices
In addition, it provides references for each recommended security measure/good practice and for each threat group [55];
* **ENISA's Good Practices for Security of IoT Secure Software Development Lifecycle:** Provides guidelines for IoT software developers, IoT integrators, platform and system engineers, and consumers for securing the Software Development Lifecycle (SDLC) of IoT systems and services. First, it provides the key cybersecurity challenges and considerations for IoT SDLC by describing each SDLC phase (i.e., requirements analysis, software design, development/implementation, testing and acceptance, deployment and integration, and maintenance and disposal). Then, it provides asset and threat taxonomies related to the IoT SDLC along with the mapping of the identified threats against IoT assets. Furthermore, it provides a set of IoT SDLC related security measures which are grouped into three categories (i.e., people, processes, and technologies). In addition, it provides a table for each category of measures that captures the recommended security measures mapped against the identified threats, secure SDLC phases, and corresponding references [56];
* **ENISA's Guidelines for Securing the Internet of Things Secure Supply Chain for IoT:** This report provides guidelines for securing the IoT supply chain and applies to a wide range of profiles including IoT software developers and manufacturers, information security experts, IT/security solutions architects, Chief Information Security Officers (CISOs), Critical Information Infrastructure Protection (CIIP) experts, project managers, and procurement teams. First, it addresses the cybersecurity challenges related to each of the IoT supply chain stages (i.e., conceptual, development, production, utilization, support, and retirement), and it provides the related threats. Furthermore, it provides security good practices which are classified into three groups (i.e., actors, processes, and technologies). In addition, it includes references for each recommended security good practice and outlines the mapping of related threats and supply chain stages to good practices for each group of secure IoT supply chain good practices [58]. **General IoT Security Frameworks**  
The selected general IoT security frameworks provide strategic IoT security principles [40; 54] or trustworthiness requirements [48]. These frameworks are outlined below:  
* **AgeLight's IoT Safety Architecture and Risk Toolkit v4.0:** Provides 44 principles which are grouped into four categories (i.e., security by design, user identity and authentication, privacy, disclosures and transparency, related safety, privacy and usability enhancing principles) and are mapped to some related best practices and regulations. It also provides rating values from \"1\" (i.e., low impact) to \"10\" (i.e., high impact) to be used by organizations for rating their risk (i.e., user benefit, ecosystem impact, financial impact, hazardization, development effort and costs, regulatory risk) while performing risk assessments against these recommended principles [40];
* **IIC's Industrial Internet of Things Volume G4: Security Framework:** This framework [48] provides business, functional, and implementation viewpoints for enabling trustworthy Industrial Internet of Things (IIoT) systems by explaining the ways to deal with security and privacy risks through technologies and processes. This framework is intended for a diverse audience spanning from IIoT owners to any stakeholder interested in security and trustworthiness of an IIoT deployment [48]. ECSO [24] also describes this framework, and concentrates on outlining the focus of the framework, pointing the existence of the IIC's testbeds for its improvement, and on the relationship of this framework with other best practices;
* **OTA's IoT Security and Privacy Trust Framework v2.5:** The framework [54] is intended to serve as a risk assessment guide for developers, purchasers, and retailers [18].