  The Internet of Things (IoT) market is rapidly growing and is expected to
double from 2020 to 2025. The increasing use of IoT devices, particularly in
smart homes, raises crucial concerns about user privacy and security as these
devices often handle sensitive and critical information. Inadequate security
designs and implementations by IoT vendors can lead to significant
vulnerabilities.
  To address these IoT device vulnerabilities, institutions, and organizations
have published IoT security best practices (BPs) to guide manufacturers in
ensuring the security of their products. However, there is currently no
standardized approach for evaluating the effectiveness of individual BP
recommendations. This leads to manufacturers investing effort in implementing
less effective BPs while potentially neglecting measures with greater impact.
  In this paper, we propose a methodology for evaluating the security impact of
IoT BPs and ranking them based on their effectiveness in protecting against
security threats. Our approach involves translating identified BPs into
concrete test cases that can be applied to real-world IoT devices to assess
their effectiveness in mitigating vulnerabilities. We applied this methodology
to evaluate the security impact of nine commodity IoT products, discovering 18
vulnerabilities. By empirically assessing the actual impact of BPs on device
security, IoT designers and implementers can prioritize their security
investments more effectively, improving security outcomes and optimizing
limited security budgets.
