CIoTSP key terms

The sum of all points where an adversary could try to enter, influence, or extract data from an IoT system, including radios, physical ports, firmware, cloud APIs, and mobile apps.

Processing and storing data close to devices rather than only in a central cloud, reducing latency and exposure while creating new trust boundaries that must be secured and patched.

A startup process that verifies each firmware stage against a trusted cryptographic signature before execution, blocking unauthorized or tampered code from running on the device.

A minimal, immutable component whose integrity is assumed and used to anchor all later security checks, such as a hardware key store or boot ROM verification step.

A dedicated hardware chip that stores keys and measurements, performs cryptographic operations, and supports attestation so a system can prove its software state to a remote party.

A tamper-resistant appliance that generates, stores, and uses cryptographic keys without exposing them, commonly protecting device identities and cloud key operations at scale.

A small tamper-resistant chip embedded in a device that holds credentials and performs cryptography in isolation, protecting keys even if the main processor is compromised.

The verifiable representation of a device in a system, typically a certificate or key pair bound to hardware, used to authenticate the device to networks and services.

A handshake in which both parties prove their identities to each other, so a device verifies the server and the server verifies the device before exchanging sensitive data.

Restricting a client to trust only a specific expected certificate or public key instead of any certificate from a public authority, limiting damage from mis-issued or stolen certificates.

A security model that grants no implicit trust based on network location and instead authenticates and authorizes every request continuously using least privilege and strong identity checks.

Granting each user, service, or device only the minimum permissions needed for its function, reducing the blast radius if an account or component is compromised.

An authorization approach that assigns permissions to roles and then assigns roles to subjects, simplifying administration and limiting access to what each role requires.

An authorization model that evaluates attributes of the subject, resource, action, and environment against policies, enabling fine-grained context-aware decisions for diverse device fleets.

Dividing a network into small zones with enforced policy between them so that compromise of one device or segment cannot spread freely to others.

Splitting an IoT network into isolated subnets or VLANs by function and trust level, restricting lateral movement and separating devices from sensitive corporate systems.

An intermediary that aggregates device traffic, translates protocols, and can enforce security policy, authentication, and filtering between constrained devices and broader networks or cloud services.

A protocol that encrypts and authenticates traffic between endpoints, protecting confidentiality and integrity of IoT communications and commonly used with device certificates.

A TLS variant adapted for datagram transports such as UDP, providing encryption and authentication for constrained IoT devices where reliable streams are impractical.

A lightweight request-response protocol designed for low-power devices over UDP, often secured with DTLS, and common in machine-to-machine and industrial IoT deployments.

A publish-subscribe messaging protocol using a broker to route topics between devices and applications, widely used in IoT and secured with TLS and per-client credentials.

The central server in a publish-subscribe system that receives messages from publishers and forwards them to subscribers, making it a high-value target requiring authentication and access control.

Cryptographically signing firmware images so devices can verify origin and integrity before installation, preventing unauthorized or malicious updates from being accepted.

A protected mechanism for delivering and installing device software remotely, using signed packages, encrypted channels, and rollback protection to prevent tampering or downgrade attacks.

Reducing a device's vulnerability by disabling unused services and ports, changing default credentials, applying least privilege, and enforcing secure configuration baselines.

Preconfigured usernames and passwords shipped with a device that are widely known and must be changed or replaced before deployment to prevent trivial unauthorized access.

An attack that replays username and password pairs stolen elsewhere against IoT interfaces, exploiting reused or default passwords to gain access at scale.

Repeatedly guessing credentials or keys until access is gained, mitigated with lockouts, rate limiting, strong entropy, and monitoring of failed authentication attempts.

A structured method for identifying assets, adversaries, and attack paths in a system so that controls can be prioritized before deployment.

A threat classification scheme covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, used to systematically enumerate threats.

The process of estimating the likelihood and impact of threats against assets and comparing the result to tolerance thresholds to decide which treatments to apply.

A continuous cycle of discovering, prioritizing, remediating, and verifying weaknesses across devices and services, adapted for long-lived hardware and constrained patching windows.

A machine-readable inventory of the components and versions in a software product, enabling teams to trace vulnerable dependencies and respond quickly to disclosed flaws.

Exposure introduced by vendors, components, firmware, and third-party services, including counterfeit parts and compromised build processes, that can undermine device trust before deployment.

A process where a device reports verifiable evidence of its software and configuration to a remote party, which checks it against expected values before granting trust or access.

Collecting and retaining only the data actually needed for a defined purpose, limiting privacy exposure and the impact of any breach involving IoT telemetry.

Embedding privacy protections such as consent, purpose limitation, and data minimization into system architecture from the start rather than adding them afterward.

A defined schedule for how long data is kept and when it is securely deleted, reducing legal exposure and the volume of sensitive telemetry available to attackers.

Periodically replacing cryptographic keys and revoking old ones to limit the value of a leaked key and contain the impact of undetected compromise over time.

The lifecycle of generating, distributing, storing, rotating, revoking, and destroying cryptographic keys, including protecting them from disclosure across device and cloud environments.

A platform that collects, correlates, and alerts on log and event data from many sources, giving visibility into device, network, and cloud activity for detection and investigation.

A documented set of roles, procedures, and communications for detecting, containing, eradicating, and recovering from security incidents, including coordination with device owners and vendors.

The incident response phase that limits spread and damage, for IoT often by isolating segments, revoking credentials, disabling accounts, or quarantining devices.

The disciplined process of tracking, testing, deploying, and verifying software fixes across a device fleet, complicated by limited update channels and long operational lifetimes.