I85PREP
⌘ K
CWIIP study materials
CWIIP study resources

CWIIP: Security Solutions Used Within IoT Integration Projects

CWIIP · Work through your exam, one topic at a time.

All guide sections

Security Solutions Used Within IoT Integration Projects

What this domain tests

CWIIP treats IoT security as an architecture problem, not a checklist. You must select the right control at each layer, know the transport that protects each protocol, and reason about identity lifecycle from manufacturing to decommissioning.

Transport and link-layer protection

  • MQTT, HTTPS and AMQP use TLS 1.2/1.3. CoAP over UDP uses DTLS 1.2 (port 5684). DTLS 1.3 exists but deployment is uneven; assume 1.2 unless told otherwise.
  • Wi-Fi: WPA2-Personal shares one PSK across the fleet, so one stolen key compromises everything. WPA2/WPA3-Enterprise with 802.1X and EAP-TLS gives per-device certificates; WPA3-SAE removes the offline dictionary attack on PSK.
  • Segment IoT traffic into its own VLAN/SSID and restrict egress to the broker and update endpoints only.

Identity, authorization and key lifecycle

  • Prefer per-device X.509 credentials with mutual TLS; PSK is the fallback for constrained radios. Provision at manufacture or use a zero-touch enrolment service (EST/SCEP-style), never a shared baked-in key.
  • Separate authentication (who) from authorization (what). The broker enforces topic ACLs per device; APIs use OAuth 2.0 client credentials or scoped API keys. Apply least privilege: a sensor publishes only to its own topic and subscribes to nothing.
  • Plan enrolment, renewal, revocation (CRL/OCSP) and rotation. Certificate expiry is the most common self-inflicted outage.

Device integrity

  • Secure boot plus signed firmware with anti-rollback counters; OTA updates fetched over TLS and verified before flashing.
  • Add replay protection (nonce, monotonic counter or timestamp) because captured frames can be resent.
  • Physical access is in scope: debug ports, JTAG and removable media must be disabled or locked.

Worked example

An audit finds an MQTT broker on 1883 with anonymous access, one shared username, and clients subscribing to #. Remediation order: enable TLS on 8883 with mutual authentication using per-device certificates; disable anonymous access; replace the shared credential with per-device identities; replace # subscriptions with per-device or per-site filters; add broker ACLs so each device can publish only to site/{id}/telemetry; and monitor failed-auth counts as an alert signal.

Traps

  • Treating TLS as data-at-rest protection.
  • Confusing 401 (not authenticated) with 403 (authenticated but not permitted).
  • Assuming WPA2-Personal with a strong passphrase is acceptable for a large fleet.
  • Forgetting that encryption without authentication invites man-in-the-middle attacks.
  • Ignoring certificate and firmware-signing-key expiry in maintenance plans.