I85PREP
⌘ K
CIoTSP study materials
CIoTSP study resources

CIoTSP: IoT Device Security and Hardening

CIoTSP · Work through your exam, one topic at a time.

All guide sections

IoT Device Security and Hardening

Domain 2 tests whether you can harden a specific device - camera, sensor tag, gateway, PLC - across hardware, firmware and configuration, and defend each change against that device's operational constraints.

Chain of trust

  1. Immutable root of trust in mask ROM or a secure element (TPM 2.0, ATECC, DICE CDI) verifies the first-stage bootloader.
  2. Secure boot: each stage verifies the signature of the next; failure halts the boot or falls back to a known-good image.
  3. Signed firmware: the vendor private key signs the image and the device holds only the public key or a hash. The signing key never ships.
  4. A/B (dual-bank) update: write the inactive partition, verify, then flip the boot flag, so a power loss mid-update does not brick the fleet.

Configuration hardening baseline

  • Unique per-device credentials provisioned at manufacture; no fleet-wide shared keys, no default passwords.
  • Disable or physically block debug: JTAG/SWD, UART console, Telnet, unused SSH, UPnP, mDNS reflection.
  • Least-privilege service accounts; disable unused ports and cloud connectors.
  • Encrypted storage for keys and logs; attestation of boot state on each connection.
  • Tamper response: potting, case-open switches that zeroise keys.
  • Expose firmware version in telemetry so the fleet can be audited.

Worked example

Hardening a networked IP camera. Changing the default admin password is necessary but insufficient. Next: disable the vendor peer-to-peer cloud tunnel (a common exfiltration path), enforce unique credentials, disable unused ONVIF and remote shells, verify firmware is signed and enable A/B auto-update, place the camera in a dedicated VLAN with egress allow-listed to the NVR only, enable 802.1X, and forward authentication failures to the SIEM. Reasoning: the tunnel and the debug interface were the exploitable surfaces, not the password length.

Traps that cost marks

  • Believing "changed the default password" constitutes hardening.
  • Declaring physical access out of scope - most IoT devices sit where strangers can reach them.
  • Hardening so aggressively that update egress is also blocked, guaranteeing permanently unpatched firmware.
  • Confusing secure boot with measured boot or with secured storage of keys.