Implementing and Operating IoT Security Controls
The exam tests whether you can turn selected controls into configured, operated and evidenced practice, and whether you understand device-level and architectural constraints.
Core control families
- Identity and access: unique credentials or certificates per device, no shared or default passwords, least-privilege service accounts, rotation and revocation.
- Integrity: secure boot with a root of trust, signed firmware, verified updates with rollback protection and staged rollout.
- Hardening: disable unused services and ports, change defaults, restrict physical ports, lock enclosures.
- Communications: mutual authentication, encryption in transit, egress allow-lists, segmentation between IoT and enterprise networks.
- Data and privacy: encryption at rest, minimisation, retention and deletion.
- Visibility: accurate time, centralised logging, alerts on authentication failure and configuration change.
- Lifecycle: asset records, change management, vulnerability handling and coordinated disclosure, spares and end-of-support planning, secure decommissioning and data sanitisation.
Worked example
A utility signs firmware for 20,000 meters. Reasoning: signing keys sit in an HSM with split approval; devices verify the signature and refuse unsigned images; rollout starts at one percent because a bad image could brick the fleet; rollback and a manual recovery path exist. Monitoring tracks update failure rates, and non-updatable meters stay on a compensating-control list until replacement. Each choice follows from weighing remote mass compromise against operational outage.
Traps that cost marks
Assuming segmentation fixes a device with no update path without adding detection; collecting logs nobody reviews; imposing IT patch windows that break operational processes; forgetting decommissioning, so credentials and data outlive the device.