I85PREP
⌘ K
CIoTSP study materials
CIoTSP study resources

CIoTSP: IoT Network and Communication Security

CIoTSP · Work through your exam, one topic at a time.

All guide sections

IoT Network and Communication Security

Domain 3 covers the protocols IoT actually runs and the network controls that keep them trustworthy when defaults are weak and devices cannot be patched.

Protocol facts worth memorising

  • MQTT: broker-mediated publish/subscribe. Secure with TLS on 8883, mutual TLS, one credential per device, and broker ACLs scoped by topic (devices/{thing-id}/#) rather than a blanket #. Disable anonymous access; treat retained messages and wide wildcard subscriptions as leak paths across tenants.
  • CoAP: UDP with DTLS 1.2, or OSCORE for end-to-end protection when an intermediary terminates DTLS. Watch Observe-based amplification and unprotected discovery.
  • OPC UA: select Sign and Encrypt policies with certificate authentication; legacy None or Basic128Rsa15 policies are unacceptable.
  • Modbus/TCP, DNP3, PROFINET: no native authentication, so rely on segmentation and deep packet inspection rather than a firewall rule alone.
  • LoRaWAN: OTAA preferred over ABP; protect AppKey, AppSKey and NwkSKey; join-server and replay defences matter.
  • BLE: LE Secure Connections pairing; Just Works provides no man-in-the-middle protection.
  • Zigbee/Thread: the network-key distribution step is the weak point; rotate keys and use install codes.

Network controls

Segment by function rather than by vendor; microsegment at the gateway; use 802.1X or MAC-based admission on wired ports; allow-list egress from OT zones; and monitor passively through SPAN/TAP rather than actively scanning, which can crash fragile devices. Baseline east-west traffic so a device talking to peers it has never contacted is visible.

Worked example

A plant publishes sensor data to an MQTT broker with anonymous access enabled, one shared credential, and broker reachability from the corporate LAN. Reasoning: a shared credential destroys attribution and revocation - one stolen key compromises the whole fleet. Fix: per-device client certificates over TLS 1.2+, anonymous access off, an ACL template binding write to devices/${cert.cn}/# and read to commands/${cert.cn}, the broker relocated to the DMZ with allow-listed publishers and subscribers, and authentication-failure alerting.

Traps that cost marks

  • Treating encryption as segmentation; TLS does not stop lateral movement.
  • Broad wildcard topic ACLs that let one device read another's telemetry.
  • Assuming Modbus or DNP3 can be secured with credentials.
  • Running active vulnerability scans against a live OT segment.