Monitoring, Reviewing and Continually Improving IoT Security
The exam tests whether you can show the program works, feed findings back into risk decisions, and improve without waiting for an incident.
Monitoring and measurement
Collect device and network logs, baseline normal behaviour, and alert on anomalies such as unexpected outbound connections, repeated authentication failures and configuration drift. Track vulnerabilities and supplier advisories, and use threat intelligence relevant to IoT botnets and targeted attacks. Choose metrics tied to risk: percentage of devices with unique credentials, mean time to detect, patch or mitigation coverage, devices missing from inventory, high risks past their review date, and supplier compliance.
Review and improvement
- Test controls rather than assuming them; sample configurations and run tabletop or live exercises.
- Hold management reviews at planned intervals covering risk status, incidents, audit findings and metric trends.
- Use internal audit and independent assessment for assurance.
- Close incidents with root-cause analysis, then update the risk assessment, control set, supplier requirements, inventory and training.
- Re-check the program against the ISO/IEC 27400 principles as scope changes, recording decisions, owners and dates.
Worked example
Monitoring flags cameras sending traffic to an unknown external address at a fixed interval. Reasoning: the pattern suggests command-and-control beaconing; the team isolates the segment, preserves logs, confirms an unpatched firmware vulnerability and applies the vendor mitigation. Improvement follows the finding rather than the incident: a detection rule for that beacon pattern is added, the firmware baseline is updated, and procurement adds a vulnerability-disclosure requirement. Management review tracks closure, and the risk register entry is re-scored rather than deleted.
Traps that cost marks
Reporting activity metrics such as number of scans instead of risk reduction; reviewing once a year only; closing incidents without root cause; producing a review with no owned actions or follow-up.