{"id":"https://openalex.org/W4296132168","doi":"https://doi.org/10.1145/3563392","title":"Security Best Practices: A Critical Analysis Using IoT as a Case Study","display_name":"Security Best Practices: A Critical Analysis Using IoT as a Case Study","publication_year":2022,"publication_date":"2022-09-15","ids":{"openalex":"https://openalex.org/W4296132168","doi":"https://doi.org/10.1145/3563392"},"language":"en","primary_location":{"id":"doi:10.1145/3563392","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3563392","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101557702","display_name":"David Barrera","orcid":"https://orcid.org/0000-0003-2319-9916"},"institutions":[{"id":"https://openalex.org/I67031392","display_name":"Carleton University","ror":"https://ror.org/02qtvee93","country_code":"CA","type":"education","lineage":["https://openalex.org/I67031392"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"David Barrera","raw_affiliation_strings":["Carleton University, Ottawa, Canada"],"raw_orcid":"https://orcid.org/0000-0003-2319-9916","affiliations":[{"raw_affiliation_string":"Carleton University, Ottawa, Canada","institution_ids":["https://openalex.org/I67031392"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5004082538","display_name":"Christopher Bellman","orcid":"https://orcid.org/0000-0003-1996-7943"},"institutions":[{"id":"https://openalex.org/I67031392","display_name":"Carleton University","ror":"https://ror.org/02qtvee93","country_code":"CA","type":"education","lineage":["https://openalex.org/I67031392"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Christopher Bellman","raw_affiliation_strings":["Carleton University, Ottawa, Canada"],"raw_orcid":"https://orcid.org/0000-0003-1996-7943","affiliations":[{"raw_affiliation_string":"Carleton University, Ottawa, Canada","institution_ids":["https://openalex.org/I67031392"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011846293","display_name":"Paul C. van Oorschot","orcid":"https://orcid.org/0000-0002-5038-5370"},"institutions":[{"id":"https://openalex.org/I67031392","display_name":"Carleton University","ror":"https://ror.org/02qtvee93","country_code":"CA","type":"education","lineage":["https://openalex.org/I67031392"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Paul Van Oorschot","raw_affiliation_strings":["Carleton University, Ottawa, Canada"],"raw_orcid":"https://orcid.org/0000-0002-5038-5370","affiliations":[{"raw_affiliation_string":"Carleton University, Ottawa, Canada","institution_ids":["https://openalex.org/I67031392"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I67031392"],"apc_list":null,"apc_paid":null,"fwci":8.1239,"has_fulltext":false,"cited_by_count":29,"citation_normalized_percentile":{"value":0.97518236,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"26","issue":"2","first_page":"1","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/best-practice","display_name":"Best practice","score":0.8981919884681702},{"id":"https://openalex.org/keywords/clarity","display_name":"CLARITY","score":0.5577973127365112},{"id":"https://openalex.org/keywords/government","display_name":"Government (linguistics)","score":0.45406079292297363},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.44744569063186646},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.44561412930488586},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.4420575499534607},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.42193883657455444},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.41039395332336426},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.39399921894073486},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.342464804649353},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.32912886142730713},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.19009217619895935},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.13861191272735596}],"concepts":[{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.8981919884681702},{"id":"https://openalex.org/C2777146004","wikidata":"https://www.wikidata.org/wiki/Q14949826","display_name":"CLARITY","level":2,"score":0.5577973127365112},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.45406079292297363},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.44744569063186646},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.44561412930488586},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4420575499534607},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.42193883657455444},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.41039395332336426},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.39399921894073486},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.342464804649353},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32912886142730713},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.19009217619895935},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.13861191272735596},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3563392","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3563392","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5600000023841858,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W587461618","https://openalex.org/W1559155956","https://openalex.org/W1595201491","https://openalex.org/W1965658570","https://openalex.org/W2039759229","https://openalex.org/W2095881341","https://openalex.org/W2150104072","https://openalex.org/W2156109180","https://openalex.org/W2238895898","https://openalex.org/W2248302901","https://openalex.org/W2288181411","https://openalex.org/W2680793898","https://openalex.org/W2733765803","https://openalex.org/W2806158696","https://openalex.org/W2957731207","https://openalex.org/W3000583668","https://openalex.org/W3017863658","https://openalex.org/W3110938143","https://openalex.org/W3111375213","https://openalex.org/W4234065838","https://openalex.org/W4251712384"],"related_works":["https://openalex.org/W2086338133","https://openalex.org/W4367679314","https://openalex.org/W225526533","https://openalex.org/W2078361494","https://openalex.org/W2009234990","https://openalex.org/W2148273157","https://openalex.org/W4244083766","https://openalex.org/W2091016074","https://openalex.org/W2023583523","https://openalex.org/W2134615400"],"abstract_inverted_index":{"Academic":[0],"research":[1],"has":[2],"highlighted":[3],"the":[4,65,98,160,166,182],"failure":[5,81],"of":[6,9,36,60,74,89,100,119,138,148,154,169],"many":[7],"Internet":[8],"Things":[10],"(IoT)":[11],"product":[12],"manufacturers":[13,170],"to":[14,51,82,112,144,159,184,199,203],"follow":[15,83,204],"accepted":[16],"practices,":[17,124,188,195],"while":[18],"IoT":[19,101,121],"security":[20,37,49,90,122],"best":[21,70,84,123,187],"practices":[22,50,78],"have":[23],"recently":[24],"attracted":[25],"considerable":[26],"attention":[27],"worldwide":[28],"from":[29,42,129],"industry":[30],"and":[31,62,92,114,126,132,152,171,190,196],"governments.":[32],"Given":[33],"current":[34],"examples":[35],"advice,":[38,91],"confusion":[39],"is":[40],"evident":[41],"guidelines":[43,127],"that":[44,175],"conflate":[45],"desired":[46],"outcomes":[47],"with":[48],"achieve":[52],"those":[53],"outcomes.":[54],"We":[55,86,173],"explore":[56],"a":[57,117,179],"surprising":[58],"lack":[59],"clarity,":[61],"void":[63],"in":[64,105],"literature,":[66],"on":[67,193],"what":[68],"(generically)":[69],"practice":[71],"means,":[72],"independent":[73],"identifying":[75],"specific":[76,194],"individual":[77],"or":[79],"highlighting":[80,165],"practices.":[85],"consider":[87],"categories":[88],"analyze":[93,116],"how":[94],"they":[95],"apply":[96],"over":[97],"lifecycle":[99,163],"devices.":[102],"For":[103],"concreteness":[104],"discussion,":[106],"we":[107],"use":[108],"iterative":[109],"inductive":[110],"coding":[111],"code":[113],"systematically":[115],"set":[118],"1,013":[120],"recommendations,":[125],"collated":[128],"industrial,":[130],"government,":[131],"academic":[133],"sources.":[134],"Among":[135],"our":[136,146,176],"findings,":[137],"all":[139,155],"analyzed":[140],"items,":[141],"68%":[142],"fail":[143],"meet":[145],"definition":[147],"an":[149],"(actionable)":[150],"practice,":[151],"73%":[153],"actionable":[156],"advice":[157],"relates":[158],"software":[161],"development":[162],"phase,":[164],"critical":[167],"position":[168],"developers.":[172],"hope":[174],"work":[177],"provides":[178],"basis":[180],"for":[181],"community":[183],"better":[185],"understand":[186],"identify":[189],"reach":[191],"consensus":[192],"find":[197],"ways":[198],"motivate":[200],"relevant":[201],"stakeholders":[202],"them.":[205]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":2}],"updated_date":"2026-08-11T07:18:39.950985","created_date":"2025-10-10T00:00:00"}