  Information-Centric Networking (ICN) is a new networking paradigm, which
replaces the widely used host-centric networking paradigm in communication
networks (e.g., Internet, mobile ad hoc networks) with an information-centric
paradigm, which prioritizes the delivery of named content, oblivious of the
contents origin. Content and client security are more intrinsic in the ICN
paradigm versus the current host centric paradigm where they have been
instrumented as an after thought. By design, the ICN paradigm inherently
supports several security and privacy features, such as provenance and identity
privacy, which are still not effectively available in the host-centric
paradigm. However, given its nascency, the ICN paradigm has several open
security and privacy concerns, some that existed in the old paradigm, and some
new and unique. In this article, we survey the existing literature in security
and privacy research sub-space in ICN. More specifically, we explore three
broad areas: security threats, privacy risks, and access control enforcement
mechanisms.
  We present the underlying principle of the existing works, discuss the
drawbacks of the proposed approaches, and explore potential future research
directions. In the broad area of security, we review attack scenarios, such as
denial of service, cache pollution, and content poisoning. In the broad area of
privacy, we discuss user privacy and anonymity, name and signature privacy, and
content privacy. ICN's feature of ubiquitous caching introduces a major
challenge for access control enforcement that requires special attention. In
this broad area, we review existing access control mechanisms including
encryption-based, attribute-based, session-based, and proxy re-encryption-based
access control schemes. We conclude the survey with lessons learned and scope
for future work.
