Risk Sources and Privacy and Security Controls for IoT Systems
Domain 2 tests whether you can identify risk sources across the IoT ecosystem and select controls that match them. Questions often present a deployment and ask for the most relevant control or the risk source being overlooked.
Risk sources
- Device-level: weak or default credentials, insecure interfaces, constrained cryptography, physical tampering, poor update support.
- Network: eavesdropping, man-in-the-middle attacks, weak protocols, exposed local interfaces.
- Service/cloud: insecure APIs, multi-tenant data exposure, misconfigured storage.
- Supply chain: untrusted components, third-party software, manufacturing and distribution risks.
- Human and environmental: misconfiguration, default settings, loss, vandalism.
- Privacy: overcollection, re-identification, secondary use, excessive retention, lack of transparency.
Controls
Technical controls include secure boot and integrity checking, unique device identity, authentication and authorization, encryption in transit and at rest, secure update, logging and monitoring, network segmentation, input validation, and privacy-enhancing technologies. Organizational controls include governance, risk assessment, supplier assurance, secure development, vulnerability disclosure, incident response, privacy notices and consent, retention rules, and training.
Worked example
Public environmental sensors report fine-grained readings. Risks include physical tampering, eavesdropping, and re-identification from detailed data. Relevant controls are tamper-evident enclosures, device certificates, TLS, edge aggregation before transmission, retention limits, and supplier audits. Reasoning: the data risk is not solved by transport encryption alone; collection and retention controls are also needed.
Traps that cost marks
- Assuming encryption alone is sufficient.
- Believing anonymization always prevents re-identification.
- Treating controls as only technical.
- Excluding supply chain and third-party software from scope.
- Planning update mechanisms only after deployment.