IoT Security
What the exam tests
IoT Security tests threats and controls across device, network, platform and application layers, plus identity and key management.
Threats and controls
- Device: weak default passwords, open debug ports, unsigned firmware, physical tampering. Controls: secure boot, secure key storage, hardware root of trust, unique per-device credentials, disabled debug interfaces.
- Network: eavesdropping and man-in-the-middle. Controls: TLS for TCP transports, DTLS for UDP/CoAP, IPsec or VPN for site links, network segmentation.
- Platform: credential stuffing, privilege escalation, tenant crossover. Controls: strong authentication, role-based access control, audit logs, tenant isolation, rate limiting.
- Application: broken object-level authorization and injection through APIs. Controls: OAuth 2.0 scopes, input validation, least privilege.
Worked example
A utility deploys NB-IoT water meters. Each meter gets a unique X.509 certificate burned in at manufacture, connects with DTLS to the platform, and accepts only signed firmware. The billing application calls a northbound API with a token scoped to read meter data only. A shared password would let one compromised meter impersonate the fleet; per-device identity limits blast radius, and scoped API tokens stop a billing compromise from controlling devices.
Traps
Do not treat TLS as a substitute for device identity: certificates or keys are still needed. Do not confuse authentication (who you are) with authorization (what you may do). Do not ignore physical security; an attacker with the device can extract keys unless protected by hardware.