Fundamental Concepts and Principles of IoT Security
The exam tests whether you can explain why IoT systems break assumptions that ordinary IT security makes, and which principles you must apply in response. Questions typically ask you to name the principle behind a design decision, or the risk created when one is skipped.
The system you are protecting
- Elements: constrained devices (sensors, actuators), gateways and edge nodes, networks, cloud or backend services, and user applications. Each holds assets: data, credentials, commands and configuration, availability, and often physical safety.
- Characteristics that change the risk picture: service life that outlives vendor support, physical accessibility, unattended operation, scale and heterogeneity, deep supply chains, and cyber-physical consequences.
Core principles
Security by design and by default; proportionality to risk; defence in depth; least privilege and minimum exposed surface; assume compromise; privacy by design (purpose limitation, data minimisation, transparency, retention limits); clear accountability across the lifecycle, including secure decommissioning; and safety taking precedence when security choices conflict with it.
Worked example
A building operator installs 400 HVAC controllers with a shared default password, no firmware update path and a ten-year expected life. Reasoning: the asset is heating control and occupant safety, not only data; the threat is a botnet or malicious insider; the vulnerabilities are default credentials and an unsupportable lifecycle; the impact includes physical damage and lost availability. The design violates secure defaults and lifecycle responsibility, so the correct answer is a risk decision - replace or isolate the controllers now, and add contractual update and credential requirements for future purchases - rather than merely adding a firewall.
Traps that cost marks
Treating a firewall or encryption as a complete answer; confusing safety with security; scoping the device as the only asset; treating privacy as optional or identical to security; ignoring decommissioning.