  Academic research has highlighted the failure of many Internet of Things
(IoT) product manufacturers to follow accepted practices, while IoT security
best practices have recently attracted considerable attention worldwide from
industry and governments. Given current examples of security advice, confusion
is evident from guidelines that conflate desired outcomes with security
practices to achieve those outcomes. We explore a surprising lack of clarity,
and void in the literature, on what (generically) best practice means,
independent of identifying specific individual practices or highlighting
failure to follow best practices. We consider categories of security advice,
and analyze how they apply over the lifecycle of IoT devices. For concreteness
in discussion, we use iterative inductive coding to code and systematically
analyze a set of 1013 IoT security best practices, recommendations, and
guidelines collated from industrial, government, and academic sources. Among
our findings, of all analyzed items, 68% fail to meet our definition of an
(actionable) practice, and 73% of all actionable advice relates to the software
development lifecycle phase, highlighting the critical position of
manufacturers and developers. We hope that our work provides a basis for the
community to better understand best practices, identify and reach consensus on
specific practices, and find ways to motivate relevant stakeholders to follow
them.
