Research Topic - Modern Internet of Things (IoT) cybersecurity compliance regulations

1. Practical Research Methodology

This chapter outlines the mixed-methods socio-technical approach to the research design, which was used to assess the effectiveness of modern Internet of Things (IoT) cybersecurity compliance regulations. As was noted in Chapter 2, the literature suggests a prevailing issue of a ‘compliance gap’ characterized by a disconnect between regulatory conformity and security resilience. While the development of regulations such as the United Kingdom’s Product Security and Telecommunications Infrastructure (PSTI) Act and the European Union’s Cyber Resilience Act (CRA) represent a major step towards the imposition of governance structures, there remain ongoing debates regarding the balance of incentives, interdependence, and regulatory ‘latency.’

In order to address these debates, a mixed-methods approach has been adopted, as a solely qualitative approach to the regulation would be likely to assess the effectiveness of the regulations in isolation, without the benefit of ‘real-world’ practical experience, whereas a solely quantitative approach to the device’s security would be likely to fail to account for the regulatory environment in which the device would be used. The approach has been informed by the socio-technical perspective, which recognizes the complex relationship between the technical, regulatory, and organizational spheres of the IoT.

The methodology has been divided into three stages, which have been designed to work together to provide a more comprehensive approach to the assessment of the regulations. First, a comparative analysis of the fragmentation and philosophical variance of the regulations has been carried out, which has identified the regulatory environment in which the IoT operates. Secondly, a technical assessment of the regulations has been carried out, which has evaluated the relationship between the regulatory baseline and the security characteristics of the IoT device. Thirdly, semi-structured interviews have been used to assess the challenges, disincentivizing factors, and perceived regulatory preparedness to emerging threats.

This approach has been designed to not only identify the areas of the regulations that have failed to be effective but to explain the reasons why these areas have failed to be effective, as well as the perceived effectiveness of the regulations, which has been achieved by the use of a mixed-methods approach, which has integrated the normative, empirical, and practitioner perspectives to provide a holistic approach to the assessment of the regulations.

3.1 Research Design and Philosophical Positioning

The study is positioned in the socio-technical research tradition, which recognises the limitations of exclusively technical and exclusively legal approaches to understanding the phenomenon of cybersecurity governance. A pragmatic epistemology is employed, which prioritizes explanatory coherence and practical insight over loyalty to a particular methodology.

This is made possible through a mixed-methods approach that enables triangulation across doctrinal, technical, and experiential spaces. This is justified by the research questions, which call for an evaluation of the regulatory structures (normative dimension), technical alignment (empirical dimension), and implementation realities (interpretive dimension).

3.2 Phase One: Comparative Regulatory Analysis

This phase examines a set of regulatory and standards-based models, such as the UK’s PSTI Act, the EU’s Cyber Resilience Act (CRA), as well as relevant NIST publications.

3.2.2 Analytical Matrix Design

A structured comparative matrix was designed to examine the following:

Applicability of the model

Enforcement mechanisms

Lifecycle security requirements

Transparency requirements related to the supply chain, such as SBOMs

Reporting requirements

Disclosure requirements

Consumer vs. critical environment

This approach enables a more systematic examination of the fragmentation of regulatory models as well as the philosophical differences.

3.2.3 Objective Alignment

This phase directly addresses Objective One by examining inconsistencies, synergies, and jurisdictional debates associated with the governance models. This phase defines the structural component of the compliance gap.

3.3 Phase Two: Empirical Technical Assessment

3.3.1 Device Selection Rationale

A typical consumer-level Internet of Things (IoT) product and its associated mobile application were selected based on market popularity and the existence of publicly available firmware sources. Selection of the device was based on the desire to provide analytical results rather than statistical generalisations.

3.3.2 Tools and Techniques

Static firmware analysis was conducted using publicly available reverse engineering tools (e.g., Binwalk). The assessment was focused on the following aspects of the firmware:

Presence of hard-coded credentials

Presence of outdated libraries

Update mechanisms

Cryptography usage

Configuration exposure

No unauthorized access or exploitation of the system was conducted.

3.3.3 Regulatory Mapping

The results of the technical assessment were matched against the regulatory baseline requirements identified during Phase One of the project.

This allows an assessment of the relationship between the compliance requirements and the actual security posture of the system under assessment. This phase contributes to the achievement of Objective Two.

3.4 Phase Three: Expert Interviews

3.4.1 Sampling Strategy

Semi-structured interviews were carried out with professionals working on the development of IoT, cybersecurity compliance, or technology policy. The selection of participants was based on the purposive sampling technique.

3.4.2 Interview Themes

The interviews covered the following themes:

The impact of such regulations on the development process

The economic factors that drive security investments

The difficulties faced by organizations while dealing with the maintenance of old devices

The preparedness for threats like AI, as well as the transition in cryptography

3.4.3 Data Analysis

Interviews resulted in the transcription of data, which was later coded for the identification of patterns that could explain the themes of implementation difficulties and the suitability of the existing regulatory environment. This section is relevant for the achievement of Objectives Two and Three.

3.5 Ethical Consideration

Ethical considerations underlying this study were presented in Chapter 1. The current section discusses the operationalisation of the ethical considerations during data collection and analysis.

Semi-structured interviews were conducted after approval by the ethics committee. Participants received a Participant Information Sheet and gave consent to participate in the study. Participants had the right to withdraw at any stage up to two weeks after the interview.

To reduce the risk associated with commercial and professional sensitivities, data was anonymised during transcription. Organisational details were removed, and the results are presented at the sector level. Audio and transcripts are stored on encrypted media with password protection and will be deleted after completion of the degree.

The research questions were strategically constructed to prevent the elicitation of sensitive and critical commercial and security information.

The technical analysis was limited to the static analysis of publicly available firmware and documentation. No unauthorized access, exploitation, or penetration was made.

For potential undisclosed vulnerabilities identified during the study, the research adopted the Responsible Disclosure principle. Details regarding exploits were removed to prevent misuse and are consistent with the non-maleficence principle and the principle of promoting public safety.

3.6 Validity, Reliability, and Triangulation

Triangulation of methods enhances the reliability of the analysis through the incorporation of normative, empirical, and experiential evidence. Though the sample size of the technical data may be small, the intention is to achieve depth rather than breadth of evaluation. For the interview data, the risk of bias is reduced through the structure of the interview and the consistency of the themes elicited.

3.7 Limitations

The study is subject to several limitations:

Limited number of devices evaluated

Jurisdictional boundaries of the regulatory frameworks evaluated

Risk of non-response bias from interview subjects

Constant evolution of regulatory instruments during the course of the research

These limitations were identified as a natural consequence of conducting a socio-technical study in a complex regulatory environment.