IoT Data Security and Privacy
Domain 5 covers the telemetry itself: classifying it, protecting it in each state, and keeping identifiable information out of places it does not belong.
Data states and their controls
- In transit: TLS 1.2+ or DTLS for UDP, mutual authentication, and payload-level encryption (OSCORE, COSE) whenever an intermediary terminates transport security.
- At rest: AES-256-GCM with keys held in a KMS, HSM or secure element rather than an application config file. Backups and edge storage are in scope too.
- In use: the weakest state on IoT. Gateways hold decrypted telemetry in memory; confine processing to attested enclaves where the risk justifies it.
Privacy by design for telemetry
- Minimise at the source: send the computed result rather than the raw stream when the raw stream has no downstream use.
- Aggregate at the edge: a meter reporting every few seconds reveals occupancy, sleep patterns and appliance use; an hourly aggregate may serve billing equally well.
- Pseudonymise: replace serials and account numbers with stable tokens, and hold the mapping table in a separate access-controlled store.
- Beware metadata: timestamps, topic names, packet sizes and IP addresses re-identify. A topic named for an empty home is itself a disclosure.
- Retention: define it, enforce it in code, delete raw data after aggregation, and verify deletion on edge devices you do not physically control.
Regulatory anchors
GDPR (lawful basis, minimisation, storage limitation, subject access), CCPA/CPRA, and sector rules for health and utilities. Exam items test the design consequence rather than statute numbers: can you satisfy an erasure request when the record lives on ten thousand devices?
Worked example
A fitness tracker uploads raw accelerometer data linked to a user ID. Reasoning: raw accelerometer plus user ID is health data, and hashing the user ID is pseudonymisation, not anonymisation, because the mapping table restores it. Fix: classify as sensitive up front, compute activity summaries on-device, transmit summaries under a rotating pseudonym, retain raw data only for opted-in debugging with a 30-day TTL, and encrypt at rest with a KMS-managed key.
Traps that cost marks
- Calling a SHA-256 hash of an identifier anonymisation.
- Ignoring the edge gateway as a data store with its own retention.
- Retention that exists in policy documents but not in code.
- Believing encryption solves privacy; it does not limit collection.