While security is often recognized as a top priority for organizations and a push for competitive advantage, repeatedly, Internet of Things (IoT) products have become a target of diverse security attacks. Thus, orchestrating smart services and devices in a more open, standardized and secure way in IoT environments is yet a desire as much as it is a challenge. In this paper, we propose a model for IoT practitioners and researchers, who can adopt a sound security thinking in parallel with open IoT technological developments. We present the state-of-the-art and an empirical study with IoT practitioners. These efforts have resulted in identifying a set of openness and security thinking criteria that are important to consider from an IoT ecosystem point of view. Openness in terms of open standards, data, APIs, processes, open source and open architectures (flexibility, customizability and extensibility aspects), by presenting security thinking tackled from a three-dimensional point of view (awareness, assessment and challenges) that highlight the need to develop an IoT security mindset. A novel model is conceptualized with those characteristics followed by several key aspects important to design and secure future IoT systems.

Digital technologies have enabled novel forms and reconfigurations of value creation, delivery, and capture. These new reconfigurations challenge the conventional notion of value creation with digital business models. On that premise, the widening of privacy concerns, alert us that organizations of the elite digital, like Netflix, Amazon, and Spotify, design technology to feed on personal data, based on algorithmic profiling capabilities. Then, privacy itself becomes their digital business model. In this paper we conceptualize the impact of digital business models on privacy concerns, by presenting a focused literature review that presents 4 waves of research on understanding privacy from the context of digital business models. With our initial findings, we recommend that future technological development should pay central attention to privacy-preserving digital business models, by making it possible that data privacy is envisioned with the right safeguards, targeting 'invisibility' of the user.