CIoTSP flashcards
CIoTSP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Perception layer
- The lowest IoT architecture layer containing sensors and actuators that interact with the physical world; it is physically accessible and therefore hardest to secure against tampering.
- Trust boundary
- A point where data or control passes between components with different security levels, such as device to gateway or gateway to cloud, requiring authentication and integrity checks.
- Purdue model DMZ
- A buffer zone between operational technology networks and enterprise IT at level 3.5, restricting and inspecting traffic so compromised business systems cannot directly reach controllers.
- Secure boot
- A chain in which an immutable root of trust verifies each next stage's signature before execution, preventing unauthorized firmware from running on the device.
- Anti-rollback protection
- A mechanism that refuses firmware versions older than the installed one, blocking attackers from reinstalling a vulnerable signed image to exploit known flaws.
- A/B partitioning
- Firmware update design with two slots so a new image is written to the inactive slot and validated before switching, allowing rollback if the update fails.
- Debug interface hardening
- Disabling or physically protecting JTAG, SWD, and UART consoles in production so attackers cannot read memory, extract keys, or halt the processor.
- Secure element
- A tamper-resistant chip that stores private keys and performs cryptographic operations without exposing key material to the main processor or firmware.
- MQTT port 8883
- The standard port for MQTT over TLS, providing encrypted transport and server authentication; plaintext port 1883 should not be exposed outside isolated test networks.
- DTLS for CoAP
- Datagram TLS secures UDP-based CoAP on port 5684, providing encryption and authentication while tolerating packet loss typical of constrained networks.
- Microsegmentation
- A network control approach that enforces deny-by-default policy between individual devices or workloads, limiting lateral movement after a single device is compromised.
- Modbus security gap
- Modbus has no native authentication or encryption, so protection relies on compensating controls such as gateways, deep packet inspection, and strict network isolation.
- Mutual TLS
- An authentication mode where both client and server present X.509 certificates, giving each side cryptographic proof of the other's identity before exchanging data.
- Device attestation
- Evidence that a device runs approved firmware and holds a genuine hardware key, used during enrollment before operational credentials are issued.
- Certificate revocation
- Invalidating a device certificate before expiry using CRL or OCSP, typically after compromise, loss, or decommissioning, so it can no longer authenticate.
- Per-device pre-shared key
- A unique symmetric secret assigned to each device for protocols like DTLS-PSK, cheaper than certificates but harder to rotate and revoke at fleet scale.
- Envelope encryption
- A scheme where data is encrypted with a per-object data key, and that key is itself encrypted by a master key held in a key management service.
- Data minimization
- Collecting and retaining only the telemetry needed for a stated purpose, reducing privacy exposure and the impact of a breach.
- Replay attack
- An attacker resends captured valid messages to trigger actions or corrupt data; defenses include timestamps, sequence numbers, and nonces validated at ingest.
- Pseudonymization
- Replacing direct identifiers with tokens so data cannot be attributed without additional information held separately; still treated as sensitive because re-identification is possible.
- Shared responsibility model
- The division where the cloud provider secures physical infrastructure and the customer secures device identity, IAM policy, application code, and data.
- Wildcard publish policy
- A cloud broker authorization rule permitting a device to publish to all topics; a common misconfiguration that lets one compromised device inject data fleet-wide.
- Edge autonomy
- The ability of an edge node to keep operating and enforcing local policy when disconnected from the cloud, using cached credentials and rules.
- Secrets manager
- A managed service that stores and rotates credentials and API keys, keeping them out of firmware images, source code, and environment files.
- STRIDE
- A threat classification covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, applied per trust boundary.
- SBOM
- A software bill of materials listing firmware components and versions, enabling rapid matching of devices to newly disclosed vulnerabilities.
- Environmental risk context
- Adjusting a vulnerability's severity by exposure, criticality, and existing controls; an isolated sensor ranks lower than an internet-facing gateway with the same score.
- Compensating control
- An alternative safeguard used when a device cannot be patched, such as network isolation, strict allowlisting, or continuous monitoring of the unpatched asset.
- Containment in IoT IR
- Isolating a compromised device through network policy, VLAN change, and credential revocation to stop propagation while preserving evidence for analysis.
- Behavioral baseline
- A recorded profile of normal device traffic, publish rates, and destinations, used to flag anomalies such as beaconing or sudden fan-out that indicate compromise.
- Patch SLA
- A governance-defined maximum time to remediate vulnerabilities by severity class, giving measurable targets for firmware update programs.
- Breach notification duty
- A legal or contractual obligation to report certain data breaches to regulators or affected parties within a set period, mapped in advance into incident playbooks.