# Security of IoT Application Layer Protocols: Challenges and Findings
## 2 Background  
The IoT threat landscape is extremely wide and complex. Gartner predicts that over a quarter of all cyber-attacks against businesses will be IoT-based by 2025. Nevertheless, presently the market prioritizes convenience and price over security that is seldom built by design. Moreover, there is a general lack of defense in aging firmware or architectures. Similarly, little consideration is given to promoting user awareness and education. Vulnerabilities of IoT devices are discovered with increasing frequency and their exploitation continues to accelerate and escalate. The evaluations of the security and privacy of consumer IoT devices presented in [4; 5] show that most devices display some form of vulnerability, although some devices have a better security posture than others. In 2016 the Mirai botnet used many thousands hijacked IoT devices (e.g., security cameras, DVRs) as attack vectors to engage in a huge Distributed Denial of Service (DDoS) attack whose peak traffic reached as many as 1 Tbps. In summer 2019, Armis discovered a batch of 11 zero-day vulnerabilities affecting VxWorks, a very popular real-time operating system used for a wide range of commercial and consumer IoT devices. Even though large-scale attacks cause big damages, small scale attacks can be even more dangerous since they often go unnoticed and undetected for quite a long time. Therefore, it is compelling to strengthen cybersecurity by identifying what needs to be secured and developingcountermeasures that take account of the specific characteristics and physical limitations of individual devices. It is worth noting that IoT security is not only a technical issue. Policy makers have acknowledged its importance for businesses, citizens and the whole society by supporting and pushing the definition of proper safety, security and privacy measures and practices to fight security threats. The European Cybersecurity Act--entered into force in June 2019--is a response to cybersecurity challenges. The act also envisions rules for EU-wide cybersecurity certification of products, processes and services. Similarly, the US Congress's Internet of Things (IoT) Cybersecurity Improvement Acts 2017 and 2019 specifically leverage the Federal Government procurement power to encourage minimal cybersecurity operational standards for Internet-connected devices purchased by Federal agencies and put forward some recommendations regarding the minimum information security requirements for managing cybersecurity risks associated with such devices. Another important issue to be addressed in the framework of IoT security refers to user awareness and education regarding the purchase and use of IoT devices. Although the use of default credentials associated with IoT devices represents one of the biggest security weaknesses, many users are not aware of this vulnerability and leave these passwords unchanged. The IOT Consumer TIPS Act of 2017 tries to respond to this issue by requiring the development of specific educational resources. IoT security has also been extensively analyzed in the literature. Research efforts studied this challenging topic under different perspectives. In recent years, several surveys aimed at reviewing and classifying these efforts have been published (see, e.g., [6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16]). More specifically, [PERSON] et al. [6] consider the layers of the IoT reference models and present a systematic literature review aimed at providing guidelines for researchers and practitioners interested in understanding security issues. The focus of [PERSON] et al. [7] is the security of IoT frameworks and platforms adopted to develop industrial and consumer applications. The study compares the architectures of the frameworks and discusses the approaches devised for ensuring security and privacy. [PERSON] and [PERSON] [10] present a detailed analysis of the vulnerabilities affecting the edge-side layer of IoT (i.e., edge node, communication and edge computing) and outline the possible countermeasures against these attacks.