Working group

IoT devices represent a wide variety of non-traditional devices that are increasingly implemented in organizations due to the numerous benefits. These unique devices often pose a security challenge due to the limited size and lack of innate security making them difficult to secure with traditional security controls and methodologies. It is a combination of these factors that has rendered many devices vulnerable to attacks like the Mirai botnet. The IoT Working Group's mission is dedicated to understanding relevant use cases for IoT deployments and defining actionable guidance for security practitioners to secure their IoT ecosystem. This includes outlining best practices for securing IoT implementations, identifying gaps in standards coverage for IoT security, and identifying threats to IoT devices and implementations.

Prepare a standard for the lower layers for uni and bi-directional meters data exchange by radio frequency communication. (see resolutions 2& 3/1999).

Produce and maintain standards for meter data exchange protocols, for use over short range wireless networks with meshing functionality. Note: Work will be based on existing ZigBee specifications.

To define an ISO/OSI application layer for communication systems for and remote reading of all meters within the scope of TC 294 to fullfill the user requirements as defined by WG 1 (as one part of the standards). To define and maintain a glossary of terms (as one part of the standards).

Maintain EN 1434-3, preparing a draft revision, taking into account: - to improve the reference to the ISO/OSI physical- and linklayer; - to enable CEN/TC 294 DLMS-Protocol to be used on the physical- and linklayer of EN 1434-3; - to ensure consistency with the work done on other WGs of CEN/TC 294; - to prepare the draft for enquiry as soon as possible (see resolution 3/1998)

The standard describes an authentication scheme including the following features: 1) User needs single unique login credentials to logon to multi-Server setup 2) It offers a two-factor authentication scheme comprising of password as one and the soft token/hardware token as the second factor for authentication 3) The scheme does not require a password table to be maintained at the server 4) The scheme resists various known authentication related attacks

The standard defines methods of out-of-band third-party individual identity attestation and secure conveyance requiring no key storage on the endpoint device.

The IEEE Standards Association (IEEE SA) pre-standards workstream for Clinical Internet of Things (IoT) data validation and interoperability with blockchain was initiated to determine if a viable standards framework could be established to enable the validation of data generated from a clinical-grade IoT device and shared through the interoperability of blockchain technology. Participants in the workstream were gathered from an IEEE SA workshop held at Johns Hopkins University in Rockville, Maryland in April 2018, and grew to include their network of healthcare and Health-IT ecosystem players, as well as participants in prior IEEE SA efforts in related areas. The workstream commenced in August 2018 and completed in February 2019. Participants in this pre-standards workstream who are the authors of this paper are listed in Appendix A. The pre-standards workstream led to the recommendation of the development of an IEEE SA Standards effort on Clinical IoT data and device interoperability with TIPPSS-Trust, Identity, Privacy, Protection, Safety and Security-in connected healthcare to improve data sharing and healthcare outcomes. The pre-standards workstream team decided that blockchain is not necessary for clinical IoT data and device interoperability and validation, nor does it necessarily meet the robust TIPPSS needs in connected healthcare. The workstream recommendation includes a draft TIPPSS Architectural Framework for Clinical IoT data validation & interoperability, which could include digital ledger technology but does not need to do so. The resulting IEEE Standards Association P2733 working group to develop a standard for Clinical IoT Data and Device Interoperability with TIPPSS kick off meeting is scheduled for July 17, 2019, sponsored by the IEEE SA Engineering in Medicine and Biology Society (EMBS).

Data Protection, Privacy and Identity Management

Cybersecurity services

Security evaluation and assessment

The WG considers national and international standards for adoption in the domain of management system standards including supporting control sets covering information and cyber security. Where not being developed by other SDO's, the WG may develop CEN/CENELEC publications in this domain.