Thanks to the recent advances in the embedded and networking technologies, the concept of Internet of Things (IoT), which is a collective network of various computing objects namely IoT nodes, has arisen. While most IoT nodes such as a smart watch have only limited resources, they tend to have a networking capability as well as both audio and visual sensors. It is not difficult to imagine that in the near future, IoT will have a significant impact on our daily lives. However, to unleash the full potential of the IoT, one significant challenge to overcome is the fact that each IoT device is with a limited resource. In particular, most IoT devices are battery-operated as well as they are constraint in size. In a cloud supported IoT architecture, which is commonly referred as IoT cloud, IoT nodes need to exchange messages with the back-end cloud frequently. Unfortunately, as the size of IoT cloud grows, the network latency increases, which is apparently a critical issue to time sensitive IoT cloud applications. Furthermore, the overheads on the back-end cloud will grow and the bottleneck nodes on the path between the IoT nodes to the cloud will be more congested. This means that the IoT cloud may not be proper to run large-scale latency-intolerant applications. To address this issue, the new concept of fog computing has been introduced [1]. In essence, fog computing is a hierarchically structured cloud computing in which additional computing buffers, which process the data between the cloud and the terminal IoT devices, are introduced. In the traditional IoT cloud, the messages from each IoT device have been directly destined to the back-end cloud. In contrast, in case of fog computing powered IoT cloud, which we name by IoT fog during the rest of this paper, the messages from the terminal IoT nodes could be processed by intermediate fog-like computing servers, and the overhead on the cloud as well as the congestion on the bottleneck nodes will be leased. It is expected that in the near future, IoT fog will collect and process deeply personal information. As a result, without proper security and privacy-preserving mechanisms, IoT fog cannot be adopted despite of its usefulness. Clearly, IoT fog will suffer from the classical security and privacy issues which are inherited from IoT cloud. In addition, it suffers from unique threats due to the adoption of fog infrastructure such as node-compromised attack. Unfortunately, there have been no serious study conducted on this issue. This paper aims to fill this void by introducing the concept of IoT fog (Section II), by discussing about the existing security and privacy-preserving measures for IoT cloud (Section III), which might be useful to protect IoT fog, and the security and privacy issues in IoT fog (Section IV). In addition, we also discuss about future research directions in Section V.