IoT Cloud and Edge Security
Domain 6 tests how responsibility splits between the IoT platform and the customer, and what changes when compute moves to a physically exposed edge.
Shared responsibility
The provider secures physical infrastructure, hypervisor and managed-service availability. You own device identity, IoT policies, topic namespaces, credentials, firmware and data classification. Most incidents come from misconfigured policies and leaked device credentials, not provider compromise.
Platform primitives to recognise
- Device registry: every thing registered with a certificate or key; mutual TLS on connect.
- Policy engine: least privilege scoped to the thing's own topics. Avoid wildcard actions or resources; use policy variables so the thing name is bound into the resource identifier.
- Device shadow / twin: desired versus reported state. A writable or stale shadow is an attack path into actuation.
- Rules and routing: serverless functions triggered by telemetry; validate and bound payloads before they reach downstream stores.
- OTA jobs: signed images, cohort rollout, and on-device signature verification with rollback.
Edge security
The edge is physically reachable and often intermittently connected. Controls: full-disk encryption, secure boot, tamper detection, container or workload isolation, local key custody (never cloud root keys on a gateway), local authorisation for offline decisions, signed rule bundles, and bounded encrypted buffering of telemetry.
Worked example
An edge gateway caches telemetry during outages. Review finds credentials in a config file, a wildcard IoT policy, and unbounded local storage. Reasoning: file-based credentials are trivially extracted from a stolen gateway; the wildcard lets a compromised unit read other sites' topics; unbounded storage eventually overflows. Fix: keys in a TPM, policy scoped to site/{siteId}/gateway/{thingName}, an encrypted ring buffer with a size cap and TTL, disk encryption, and signed OTA for the rule bundles.
Traps that cost marks
- Assuming the provider secures your IoT policies and topic namespace.
- Wildcard policies and one credential shared across a product fleet.
- Treating the edge as trusted because it is on-premises.
- OTA with no signing, no cohort control and no rollback path.
Tenant isolation is a related trap: verify that topic namespaces, rule targets and storage buckets cannot be reached by another customer's devices through a crafted client ID or thing name.