2.1. Cybersecurity of IoT devices

There are many characteristics in the proposed and existing use cases of IoT devices that make it critical to ensure their cybersecurity. These characteristics include IoT devices being part of people’s homes, meaning compromised systems can be used to collect private or sensitive information, the IoT devices being critical cyber-physical systems that may cause harm in the real world through remote controlling (e.g. Rauti et al. (Reference Rauti, Laato and Pitkämäki2020)) and the increased power consumption of a compromised system, them being used in botnets (Vignau et al., Reference Vignau, Khoury and Hallé2019). In order to improve the cybersecurity of IoT devices, it is paramount to understand their key characteristics and how they differ from other software systems and technologies. Drawing from previous academic literature on the topic, we list the key cybersecurity characteristics of IoT devices in Table 1.

Table 1. Key cybersecurity characteristics of IoT devices

Implementing multilayered security measures is crucial to achieve effective protection of sensitive data and critical systems from advanced threats in all systems, not only IoT devices (Upadhyay et al., Reference Upadhyay, Zaman, Joshi and Sampalli2021; Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021; Bhatia et al., Reference Bhatia, Sehgal, Bhushan and Kaur2008). We understand multilayered security as using several software security techniques to make up multiple layers of security to form a robust and comprehensive defense strategy. A multilayered approach provides increased defense by having multiple barriers in place and addressing various attack vectors. The ability to detect and respond to security incidents is enhanced as a result. For IoT devices in particular, past research lists several software security measures that can be employed in a multilayered security scheme:

• • Data encryption: end-to-end encryption should be applied for all sensitive data that is stored or transmitted by IoT devices (Rajesh et al., Reference Rajesh, Paul, Menon and Khosravi2019). This way, the data is protected against interception and unauthorized access, both in transit and at rest. It is worth noting that in some low-resource IoT devices, encryption can be too performance-intensive to be a viable alternative as a security measure (Panahi et al., Reference Panahi, Bayılmış, Çavuşoğlu and Kaçar2021).

• • Access control: access control measures such as authentication and authorization restrict access to data and other resources based on user roles and privileges (Ravidas et al., Reference Ravidas, Lekidis, Paci and Zannone2019). Attention should be paid to appropriately setting default access permissions, as well as regularly reviewing and updating these permissions. Appropriate and strong authentication and authorization mechanisms need to be implemented to ensure that only trusted and authenticated devices or users can get access to an IoT device and critical resources (El-Hajj et al., Reference El-Hajj, Fadlallah, Chamoun and Serhrouchni2019). Authentication entails providing credentials like usernames and passwords to prove one’s identity. Authorization involves giving or denying access rights and permissions to users.

• • Software updates: IoT devices’ software should be kept up to date by applying the latest security patches and updates released by the vendors (Turner, Reference Turner2019). This is an important way to strengthen software security and address known vulnerabilities. It is worth noting, however, that in many IoT devices, updates are not applied regularly or the device is not meant to receive updates at all (Kaur et al., Reference Kaur, Dadkhah, Shoeleh, Neto, Xiong, Iqbal, Lamontagne, Ray and Ghorbani2023).

• • Secure configuration: attention should be paid to the secure configuration of IoT devices (Bellman and van Oorschot, Reference Bellman and van Oorschot2019). Unnecessary services should be disabled or turned off to minimize the attack surface. Securing configuration can also involve changing default credentials, securing remote access, and implementing multi-factor authentication, for example.

• • Virus, intrusion, and vulnerability monitoring: the IoT system can be regularly scanned for vulnerabilities, and possible malicious activity and intrusions can be monitored. However, these kinds of monitoring tools are usually overly resource-intensive to be used with IoT devices (Alrubayyi et al., Reference Alrubayyi, Goteng, Jaber and Kelly2021). Because of constraints in processing power, memory, and energy, robust malware monitoring and detection mechanisms are challenging to implement.

In addition to these, there are obfuscation and diversification approaches (Collberg, Reference Collberg2018; Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021, which are the main focus of this study, and which we discuss in further detail next.

2.2. Obfuscation and diversification to enhance the multilayered security of software systems

One of the important principles when developing software for IoT devices is to keep memory usage and computational requirements low so that IoT devices, with their limited memory and computation power, are able to operate smoothly (Hahm et al., Reference Hahm, Baccelli, Petersen and Tsiftes2015). This principle also holds for security solutions on IoT devices – performance, effectiveness, and power consumption should not be sacrificed for security when it can be avoided. This means many traditional solutions such as large anti-virus programs are not a reasonable security solution for most IoT devices and systems. Instead, computationally inexpensive and memory-efficient solutions are needed.

One such solution is interface diversification, which is an approach based on creating unique instances of software interfaces (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021. The program code is diversified so that different instances are syntactically different but functionality is not affected. Interface diversification can be achieved by employing various different source code obfuscation techniques (Collberg et al., Reference Collberg, Thomborson and Low1997). Cohen presented one obfuscation approach in 1993 and proposed creating diversified versions of operating systems (Cohen, Reference Cohen1993). After this, there has been a large body of research concerning interface diversification (Hosseinzadeh et al., Reference Hosseinzadeh, Rauti, Laurén, Mäkelä, Holvitie, Hyrynsalmi and Leppänen2018), and in recent years, the idea has also been increasingly been applied to software running on IoT devices (Hosseinzadeh et al., Reference Hosseinzadeh, Hyrynsalmi and Leppänen2016; Koivunen et al., Reference Koivunen, Rauti and Leppänen2016; Mäki et al., Reference Mäki, Rauti, Hosseinzadeh, Koivunen and Leppänen2016).

Although there are billions of IoT devices connected to the internet, only a relatively small set of different operating systems and programs are being used on these devices. This monoculture is not unique only to IoT devices but is a key reason why obfuscation and diversification approaches hold so much potential in improving system security (Collberg, Reference Collberg2018). In other words, due to the identical design and well-known interfaces, large groups of IoT devices are susceptible to the same vulnerabilities and security attacks. Therefore, a malicious adversary can compromise a huge number of systems with a single attack, as evidenced by e.g., the Mirai botnet attacks (Kolias et al., Reference Kolias, Kambourakis, Stavrou and Voas2017). Interface diversification is a way to add multiculturalism to the software design, which mitigates opportunities for non-targeted large-scale attacks (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021. Assuming a malicious attacker discovers how one unique IoT device is diversified, the other devices are still safe due to their unique and secret diversification. It would take more time and resources for the attacker to reverse engineer the diversification procedure, significantly slowing down the attacker. In the best scenario, the attacker is forced to build system-specific attack models, which renders various currently existing botnet approaches obsolete.

One of the main advantages of diversification is that the technique can improve system security without a significant increase in resource consumption (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021. For instance, using simple obfuscation techniques such as changing the names and parameter order of functions does not lead to increased computational power or memory usage. This makes the techniques particularly suitable for IoT devices that run preferably on low power and computational resources (Hosseinzadeh et al., Reference Hosseinzadeh, Hyrynsalmi and Leppänen2016; Koivunen et al., Reference Koivunen, Rauti and Leppänen2016; Mäki et al., Reference Mäki, Rauti, Hosseinzadeh, Koivunen and Leppänen2016). With the continuously increasing number of IoT devices, the incentives to attack the devices with bulk attacks also increase. For this reason, proactive protection techniques, in particular those addressing the monoculture issue of IoT (Collberg, Reference Collberg2018), should be given careful consideration. Here, obfuscation and diversification appear as the most promising solutions.

2.3. Benefits and shortcomings of enhancing IoT security through diversification

Recent studies have emphasized that since IoT devices are relatively seldom updated and run a very limited and rather static set of software, which can further fuel the monoculture problem (Collberg, Reference Collberg2018). To address this, internal interface diversification solutions may be particularly relevant and effective (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021, as well as other approaches discussed under the term “moving target defense” (Ge et al., Reference Ge, Cho, Kim, Dixit and Chen2021; Navas et al., Reference Navas, Cuppens, Cuppens, Toutain and Papadopoulos2020) e.g., in the popular IoT cybersecurity policy of NIST (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021). Interface diversification has the following favorable properties:

Proactiveness. Interface diversification can be considered a proactive security measure: unlike many traditional security solutions, diversification does not assume that the exploit works in a certain way or that the malicious binary follows a specific pattern. Previously unknown zero-day exploits will be rendered useless if they try to use well-known interfaces (Cohen, Reference Cohen1993; Koivunen et al., Reference Koivunen, Rauti and Leppänen2016).

Passiveness. Interface diversification passively waits for the malware to make its move. The solution does not waste resources in trying to prevent malware from infiltrating the system or executing. However, the harmful software is prevented from working in an intended manner.

Low-performance requirements. When the diversification solution is kept relatively simple, for example by only diversifying system call numbers or names of library functions, the effects on the system performance are negligible or modest (Collberg et al., Reference Collberg, Thomborson and Low1997). Obviously, this property is especially important in low-resource IoT devices.

Orthogonality. Interface diversification can be seen as a part of a multilayered security scheme. Diversification is orthogonal: it can be used together with many other security approaches. Traditional solutions such as intrusion detection systems and cryptography can be combined with interface diversification to enhance overall security (de Haro-Olmo et al., Reference de Haro-Olmo, Varela-Vaca and Álvarez-Bermejo2020). This is an important property because interface diversification is not a silver bullet that works against all attack scenarios.

Counterbalancing poor security. Interface diversification counterbalances the poor security of IoT devices by providing an additional layer of security. Even if a malicious program finds a vulnerability and invades the device, it cannot use the essential interfaces of the target system. This is especially important because software on IoT devices is often not updated regularly.

Invisibility. When diversification is applied to internal interfaces of the system, a normal end user does not notice anything out of the ordinary (Collberg et al., Reference Collberg, Thomborson and Low1997). External interfaces that the user directly interacts (such as graphical user interfaces) with are left intact and not affected by diversification. Diversification also does not affect the software development process and programmers’ work, because it can be applied automatically after the source code has been compiled.

The list of shortcomings of the approach is shorter, with perhaps the most important one being the monetary costs of implementing such solutions and challenges in deploying updates to the obfuscated devices (Koivunen et al., Reference Koivunen, Rauti and Leppänen2016). Even in cybersecurity, some cost/gain balancing needs to be done, and some obfuscation approaches may be needlessly costly while offering security that could also be achieved through other means. Another shortcoming may be on usability. It is not always entirely clear who would be in charge of obfuscating the system and deploying the solution. There is also the additional work of ensuring that the system would operate as intended for the user even after such measures have been put in place.

4.1. The bibliometric profile of the research field of IoT cybersecurity

As demonstrated in Figure 2, the research field of IoT cybersecurity is growing strongly with more publications out each year than the year before. The field began growing rapidly in 2013, and the number of publications more than doubled each year until 2017. Afterwards the growth of the research field has continued steadily at a roughly linear rate, but as of 2019 has also shown some signs of plateauing soon. Perhaps unsurprisingly, the number of IoT cybersecurity publications is positively correlated with the number of publications within the entire field of IoT. According to Scopus, the number studies mentioning IoT in the title, abstract, or keywords has been in the tens of thousands each year after the year 2017, peaking at 62,549 studies published in 2021. From here we can make the crude estimation that IoT cybersecurity research is roughly one-seventh of the total number of IoT publications. Looking at obfuscation and diversification within the IoT cybersecurity field, we see that it represents roughly 1/45 of the overall IoT cybersecurity research. As a trend, obfuscation for IoT research has been growing roughly at the same rate as the overall IoT cybersecurity research.

Figure 2. The publication years of the studies on IoT cybersecurity (black columns) compared to the publication years of diversification and obfuscation for IoT cybersecurity (red line). Both trends are similar in trajectory with no notable observable differences.

The majority of the studies within the field of IoT cybersecurity are published in conference proceedings (n = 2037) followed by journals (n = 1439). The remainder (n = 206) are book chapters and other peer-reviewed publications. According to Scopus, these studies are overwhelmingly carried out in the field of computer science (n = 2972) or engineering (n = 1928), but a significant number of studies are also conducted within the field of mathematics (n = 575) and decision sciences (=564). There is also overlap in the field classifications, meaning some studies are interdisciplinary and related to both mathematics and computer science. The majority of the research is produced by scholars from the USA (n = 641) followed by China (n = 567), India (n = 452), the United Kingdom (n = 303), and Australia (n = 164). Altogether, the research has been carried out in 101 different countries. While there certainly is an emphasis on the USA, China, and India, these numbers roughly correlate to the overall research output of these countries. Hence, we estimate that no significant country-related publication bias exists in this domain.

The results of the co-word analysis are displayed in Figure 3. The concept map in Figure 3 illustrates that while academics have studied many security technologies closely related to obfuscation and diversification, these techniques, and proactive cybersecurity measures in general, seem to be missing from the big picture. Next, we discuss these two in further detail with references to the studies.

Figure 3. Visualizing the bibliometric co-word analysis.

4.2. Categories of diversification and obfuscation approaches within the landscape of IoT cybersecurity research

Table 3 shows different categories of obfuscation related to IoT cybersecurity. Most of the obfuscation schemes introduced in analyzed papers concentrated on obfuscating data (n = 22). The data processed by IoT devices can be obfuscated to protect users’ privacy or intellectual property. While encryption is usually the primary method for protecting data from adversaries, using obfuscating techniques instead of encryption is often necessary when it comes to IoT devices with limited resources and low computational power (Khan et al., Reference Khan, Shaheen and Wang2017. A special category of data obfuscation in mobile IoT devices is location obfuscation (n = 11), which aims to preserve the user’s location privacy while preserving service utility (Butun et al., Reference Butun, Österberg and Gidlund2019).

Table 3. The obfuscation targets

Many obfuscation approaches concentrate on traditional code obfuscation (n = 10), in other words, obfuscating the internal structure of programs in order to make it more difficult for the adversaries to understand reverse engineer, and modify programs. For example, Nausheen and Begum propose protecting mobile eHealth applications using code obfuscation techniques (Nausheen and Begum, Reference Nausheen and Begum2018), while Pastrana et al. present an obfuscation mechanism against code reuse attacks for embedded devices (Pastrana et al., Reference Pastrana, Tapiador, Suarez-Tangil and Peris-López2016).

Several internal interfaces of IoT devices can also be obfuscated (n = 4) to prevent malware authors from abusing the device’s resources. Koivunen et al., for example, propose obfuscating several internal interfaces of IoT devices, such as system call interfaces and operating system libraries (Koivunen et al., Reference Koivunen, Rauti and Leppänen2016). Interface diversification is a lightweight protection mechanism that does not require lots of computational resources, unlike many traditional software security mechanisms.

In the studied papers, software obfuscation is also regularly used by malware authors to hide the malicious nature of their code and executables (n = 17). As malware authors produce several diversified functionally equivalent versions of their harmful programs, approaches for measuring the similarity of these diversified pieces of malware have to be developed (e.g., Venkatraman and Alazab, Reference Venkatraman and Alazab2017).

When it comes to obfuscation on network level, obfuscating the contents and patterns of network packets is a popular approach (n = 8). Datta et al. introduce a library that replaces standard networking functions and obfuscates traffic patterns of an IoT device by using payload padding, fragmentation mechanisms, and randomly generated fake traffic (Datta et al., Reference Datta, Apthorpe and Feamster2018). The way packets are routed in a network (n = 7) can also be obfuscated (Bin-Yahya and Shen, Reference Bin-Yahya and Shen2022). For example, Bin–Yahya and Shen (Bin-Yahya and Shen, Reference Bin-Yahya and Shen2021) present a proactive route mutation scheme that alters the routes in wireless sensor networks to prevent reconnaissance and sniffer attacks. Research has also looked at IP address obfuscation (n = 2) and reassigning IP addresses as a moving target defense approach in order to prevent attackers from targeting IoT devices (He et al., Reference He, Si, Xiao, Wei, Zhu and Xu2021).

Turning to the larger IoT security picture of Figure 3, we can see that obfuscation and proactive security methods in general are absent in the picture. However, software and network-level obfuscation contribute to many general principles in the red area, such as security, data security, and cryptography. Software security is enhanced by protecting the internal structure of programs and diversifying interfaces, making it difficult for malware to attach itself to programs or interfaces and abuse them to achieve its goals (Cohen, Reference Cohen1993). On the other hand, data privacy in IoT systems can also be protected by using obfuscation like lightweight encryption when computation-intensive encryption methods cannot be used to ensure confidentiality of data (Yavari et al., Reference Yavari, Panah, Georgakopoulos, Jayaraman and van Schyndel2017).

In the green area, central themes are malware, machine learning, and intrusion detection. Obfuscation is connected to machine learning and artificial intelligence mainly through efforts by researchers to use these approaches to classify and understand obfuscated malicious code (Dib et al., Reference Dib, Torabi, Bou-Harb and Assi2021). Obfuscated malicious programs and network traffic can also be detected by intrusion and anomaly detection tools.

Finally, the blue area highlights the industrial internet and applications of IoT such as smart power grids and power transmission networks. Such parts of critical infrastructure that may never receive security updates can greatly benefit from supplementary security measures such as diversification (Koivunen et al., Reference Koivunen, Rauti and Leppänen2016).

4.3. An example framework applying obfuscation and interface diversification as a part of a multilayered software security scheme

As noted previously, one of the key advantages of interface diversification and obfuscation techniques is the fact that they are orthogonal. Diversification can be combined with many other security measures. Several traditional security techniques and approaches, such as intrusion detection systems and access control mechanisms can be used together with obfuscation and diversification to enhance overall security (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021; de Haro-Olmo et al., Reference de Haro-Olmo, Varela-Vaca and Álvarez-Bermejo2020). In what follows, we describe a conceptual software security framework consisting of several, mostly proactive, security measures. The framework demonstrates how interface diversification can be used along with other security mechanisms to improve the security of IoT systems. We will also discuss the relationship other techniques have with interface diversification. The framework includes the following security measures:

• • Interface diversification: Essential interfaces of the system, including e.g. operating system library interfaces and the system call interfaces are diversified to prevent malicious actors from abusing them. Consequently, it becomes more challenging for the adversary to gain access to valuable resources such as data.

• • Data obfuscation: Data stored on the IoT device can be obfuscated for better data security and privacy. While encryption should usually be the primary way to protect data from unauthorized access, it is sometimes too performance-intensive for IoT devices. In these cases, obfuscation is employed as a lightweight mechanism to protect data.

• • Access control: It is important to ensure the IoT device is protected by strong authentication and authorization mechanisms. Special care should be taken to change the default credentials. Interface diversification and obfuscation can protect the device even in cases in which the authentication mechanism fails, for instance, because of a weak password.

• • Software updates: If possible, the system should receive software updates regularly. However, as this is often not the case with many IoT devices, diversification and obfuscation as security measures can complement missing software updates, providing an additional level of security. Moreover, zero-day threats aiming to exploit unknown vulnerabilities in the target device’s software frequently appear. These threats cannot be thwarted with software updates when they first appear. Interface diversification is an important security measure that introduces unpredictability for the attacker and prevents many zero-day attacks ((Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021).

• • Moving target defense (MTD): MTD ((Lei et al., Reference Lei, Zhang, Tan, Zhang and Liu2018) can be used to change the diversification regularly and increase uncertainty for the attacker. This is an effective, proactive, and adaptive defense mechanism ((Cho et al., Reference Cho, Sharma, Alavizadeh, Yoon, Ben-Asher, Moore, Kim, Lim and Nelson2020), which still has only modest costs in terms of resource consumption. A newly diversified set of interfaces can be installed into the system as a part of a software update, for instance.

• • Secure configuration: The system has to be protected by using a secure configuration and minimizing attack surface by only including the necessary services in the system. The secure configuration also supports diversification solutions: implementing, deploying, and changing interface diversification is easier with a limited set of interfaces and services.

• • Intrusion detection: Oftentimes, continuously monitoring an IoT system with solutions such as intrusions detection systems and antivirus software, which are potentially quite intensive resource, may not be a viable option. Employing interface diversification and obfuscation techniques is one way to fill this gap. However, some lightweight intrusions detection schemes may still be feasible on IoT devices. One way to implement a lightweight intrusion detection scheme in the host system is to uniquely diversify the interfaces in a system but also leave the original interfaces as traps for attackers. As the trusted programs in the system only use the new secret interfaces, the use of the “fake original interfaces” is always suspicious and a sign that something abnormal is happening in the system.

This proactive security framework lays a basis for a collection of security measures that are a good fit for IoT systems with restricted resources, focus on data, rare updates, and minimal installs – key characteristics we described previously. As a multilayered security framework, it sets several barriers for the attacker and makes use of several proactive measures, adding uncertainty to the system from an adversary’s viewpoint. At the same time, it only requires a modest amount of resources such as computational power.

The conceptual framework we presented is an example of seamlessly combining interface diversification and obfuscation with other security measures. At the same time, it can also be understood as an example case of a possible recommendation or guideline of how to implement data security in IoT systems, bridging the obvious gap between practical software development and security policies. For instance, it is one possible way to implement the appropriate technical measures described only vaguely in the GDPR.

Figure 4 shows an abstract example of a multilayered software security scheme for IoT sorted into three layers: (1) application; (2) operating system; and (3) network layers. We situate existing cybersecurity measures within these three layers and display on the right in green boxes how obfuscation and diversification can be applied as proactive measures to boost the cybersecurity within this type of architecture for IoT cybersecurity. Note that based on this study we are not proposing at this stage to add obfuscation and diversification to the network layer due to problems in interoperability. While this has been investigated in a few works (Mäki et al., Reference Mäki, Rauti, Hosseinzadeh, Koivunen and Leppänen2016), we encourage future research on this topic. Overall, the visualization in Figure 4 highlights the orthogonality of interface diversification as a software security measure: it can be used along with other measures in a multilayered scheme. Moreover, diversification itself is a multilayered security measure in the architecture, as it covers both the operating system level and applications (e.g., when diversifying the system call interface, we are making changes on the operating system layer, but these changes need to be propagated to trusted applications in the application layer in order for these applications to keep working (Rauti et al., Reference Rauti, Laurén, Mäki, Uitto, Laato and Leppänen2021).

Figure 4. An example of the practical architecture of the multilayered software security scheme. NOTE: This is not an exhaustive summary of all possible cybersecurity measures, but rather, it is an exemplar of cybersecurity architecture.

4.4. Refining existing policies to account for multilayered cybersecurity

In this section, we discuss refining existing IoT security policies and guidelines to account for implementing multilayered cybersecurity with obfuscation and diversification. As mentioned in Section 3.3, we refer to three prominent cybersecurity policies: (1) ENISA (ENISA, 2019), (2) NIST (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021), and (3) Microsoft (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017). We summarize the characteristics of these policies in Table 4. The guidelines from ENISA and Microsoft are IoT-specific, but the NIST policy is broader, yet it also covers IoT cybersecurity.

Table 4. Existing popular privacy policies discussed in this study

While prominent in the guidance offered by NIST (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021), an element that receives minimal attention in ENISA’s (ENISA, 2019) and Microsoft’s (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017) documents when contrasted against the academic corpus on IoT cybersecurity, is multilayered security and resilience. For example, ENISA’s guideline recommends strict access control and choosing third-party libraries that are updated regularly (ENISA, 2019, p. 54). These are indeed important practices, but the principles of resilience can be better followed by building failsafe approaches in case these mechanisms fall short due to e.g., the following reasons: users may choose weak passwords or third parties may fail to update their software components (assuming the software of the specific IoT device can be updated at all) and even in the worst cases, accidentally introduce new vulnerabilities through updates. In these cases, diversification appears as a component of multilayered cybersecurity, a backup mechanism, and the next layer of defense protecting critical resources of the system. Microsoft’s IoT security policy document Abendroth et al. (Reference Abendroth, Kleiner and Nicholas2017) does not go into details about technical software security measures. It mentions some security solutions as examples, mostly traditional software security measures as opposed to proactive security measures such as diversification. Although the importance of resilience is mentioned and emphasized (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017, p. 9), proactive solutions and multilayered schemes are missing. In general, while proactive security measures improving resilience appear in the general cybersecurity policy document of NIST (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021), they could be better integrated and included in the IoT-specific policy documents offered by Microsoft (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017) and ENISA (ENISA, 2019).

Sometimes the nature and limitations of an IoT environment itself may prevent the implementation of the technical measures the analyzed policy documents recommend. For example, all IoT devices are not well equipped to “use proven encryption techniques” (ENISA, 2019, p. 54) due to limited computational power. Therefore, in some cases, obfuscation and diversification may be a viable option to provide some lightweight data protection (Xu et al., Reference Xu, Zheng, Jiang, Gu, Tan and Cheng2020). As a generic guideline for developing cyber-resilient systems, NIST’s document Ross et al. (Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021) does not specifically take into account this aspect of limited resources in IoT systems. Also, some IoT devices are not built to receive regular patches and updates (ENISA, 2019, p. 55), in which case diversification and obfuscation techniques can compensate for the shortage of software patches. Some IoT devices may even intentionally be designed to never receive updates (which can be a security measure in itself), and in these cases, it is critical to assure the security of these systems. Again under these circumstances, failsafe mechanisms and multilayered security offer a solution, with obfuscation and diversification being relevant techniques to reaching these goals.

The policy documents also recommended some techniques and approaches that we can implement in practice by using obfuscation and diversification techniques. For example, when implementing anti-tampering features (ENISA, 2019, p. 55), obfuscation has been found to be a feasible solution (Collberg and Thomborson, Reference Collberg and Thomborson2002). Another example is the recommendation to use whitelists for allowed applications (ENISA, 2019, p. 56). A diversification scheme applied to a system is inherently a whitelist, where only trusted applications can successfully interact with their environment. Moreover, obfuscation can be combined with other security mechanisms, such as regular updates. Security updates are not only an important mechanism to protect from external threats (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017, p. 12) but also a possibility to dynamically change the applied diversification, implementing moving target defense (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021, p. 99), where attack surface changes, making it more difficult for the attacker to reach their goals. In this sense, obfuscation, diversification, and other proactive measures could be explicitly mentioned in the guidelines, as they align perfectly with these proposed security measures.

Yet, these techniques also carry downsides, such as there being costs involved in successfully implementing these mechanisms within IoT software, and in propagating the changes to trusted software in a way that does not cause interoperability issues with other devices in the local IoT ecosystem. Clarification of the aspects of costs and benefits could help IoT system developers choose the most appropriate measures for securing their systems, and could make the policy documents more actionable.

Lastly, with the introduction of obfuscation and diversification, the existing policies could be extended to include recommendations that may not otherwise be easy to implement. For example, ENISA’s IoT cybersecurity policy document (ENISA, 2019) does not mention any kind of intrusion detection, perhaps due to the limited resources IoT devices possess. On resource-constrained devices with limited performance, memory, and energy, it is challenging to implement resource-intensive intrusion detection schemes or run complex security algorithms on these devices. Obfuscation and diversification approaches can be combined with leaving “fake original interfaces” as traps in the system (e.g., honeypots). When trusted programs only use the new diversified and secret interfaces, any abnormal activities in the system can be caught without using much memory or computing power. Also, sometimes obfuscation can be used as a lightweight alternative for resource-intensive encryption proposed in the documents (Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017, p. 10).

Of the studied guidelines, NIST’s general policy document (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021) is the only one mentioning diversification and proactive cyber resiliency technologies in general. NIST’s document lists several proactive “strategic design principles” (Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021, p. 136) and advocates diversity as a method to add unpredictability. The document does not, however, go into specifics about how to implement the measures in different layers. We conceptualize a practical design by providing an example of a potential multilayered security architecture involving diversification in addition to many traditional security measures (see Figure 4). Furthermore, since the policy document of NIST is not IoT-specific, we encourage policymakers to integrate the best practices from the work of NIST and academic research to construct more up-to-date hands-on guidelines for IoT developers to ensure cybersecurity within this rapidly growing field.

To sum up, since IoT devices have characteristics that distinguish them from other software (e.g., they are rarely updated, they are minimalist, they typically gather and make use of sensor data and communicate with other devices), there is certainly a demand for IoT-specific cybersecurity policies. Within these policies, obfuscation and diversification measures, and other similar proactive measures, could be proposed and explicitly mentioned in the cybersecurity policies (ENISA, 2019; Abendroth et al., Reference Abendroth, Kleiner and Nicholas2017; Ross et al., Reference Ross, Pillitteri, Graubart, Bodeau and McQuaid2021) to apply the principle of multilayered software security in practice, and consequently, improve system resilience against cyber threats. These measures can effectively be used to compensate for several security measures that cannot be implemented, to provide practical implementation for many of the recommended practices, and even to extend the guideline with new practical security measures that might otherwise be out of reach in the IoT environment.