Fundamental Concepts and Principles of IoT Security and Privacy
Domain 1 tests the vocabulary and principles in ISO/IEC 27400:2022: what an IoT system is, why IoT security differs from conventional IT, and which security and privacy principles must shape design and operation. Expect definitional questions and short scenarios asking which principle is applied or violated.
IoT ecosystem and device realities
- An IoT system spans devices, network connectivity, services/cloud, and users/stakeholders; security and privacy responsibilities are shared.
- IoT devices often interact with the physical world, run unattended, remain in service for years, are physically accessible, and have constrained compute, memory, power, and user interface.
- These properties make patching, credential management, monitoring, and consent harder; physical tampering and long-term exposure become first-order risks.
Principles to apply
- Security and privacy by design: integrate controls from concept and procurement, not after deployment.
- Defense in depth across device, network, service, and organizational layers.
- Least privilege and secure defaults: unique credentials, minimal exposed services, fail securely.
- Privacy principles aligned with ISO/IEC 29100: purpose specification, collection limitation/data minimization, use and retention limits, transparency, user participation, accountability.
- Risk-based lifecycle view: design, manufacture, deployment, operation, maintenance, decommission.
Worked example
A smart door lock uses a phone app, cloud service and battery-powered lock. Apply secure defaults (no shared PIN), least privilege (the app can lock/unlock but not read other users' logs), data minimization (avoid continuous occupancy history), defense in depth (signed firmware plus cloud API authentication), and lifecycle updates. Reasoning: the lock is physically accessible and long-lived, so default credentials and updateability matter more than raw compute power.
Traps that cost marks
- Treating IoT as merely small IT.
- Equating privacy with encryption alone.
- Assuming a device-only scope.
- Ignoring physical access and long service life.
- Treating consent as a one-time checkbox.