Emerging Technologies and Cyber Security (Cloud, IoT, AI)
Domain focus
Emerging Technologies and Cyber Security tests security responsibilities and new attack surfaces in cloud, IoT and AI systems, with emphasis on configuration, identity and data trust.
Core rules and concepts
- Cloud models include IaaS, PaaS and SaaS. Security is shared: the provider secures the platform, while the customer secures identities, configurations, data and access.
- Common cloud risks are public storage misconfiguration, excessive IAM permissions, missing MFA, exposed keys and unmonitored APIs.
- IoT risks include default passwords, unpatched firmware, weak protocols, poor update support and insecure mobile apps. Segment IoT devices and restrict inbound access.
- AI risks include data poisoning, adversarial inputs, prompt injection, model leakage, deepfakes and over-reliance on generated output.
- AI can also support defence through anomaly detection and alert triage, but outputs require validation and human accountability.
Worked example
A smart camera is reachable from the Internet with the default admin password. The fix is to change credentials, disable remote exposure, isolate the camera on a restricted VLAN, update firmware and monitor it. Reasoning: default credentials are a known weakness; segmentation limits lateral movement if the camera is compromised; updates remove known flaws.
Traps that cost marks
Do not say the cloud provider secures everything. Do not leave IoT defaults because the device is internal. Do not treat AI output as verified fact. Do not confuse prompt injection with SQL injection. Do not assume a deepfake is easy to spot without verification.