IoT security: ten failures that lead to real breaches, and how to avoid them

Ten failures to design out

1. Default or shared passwords.
2. No way to update firmware, or updates that are not signed.
3. Services left open that the device does not need.
4. Unencrypted communication.
5. Secrets and keys stored in plain text on the device.
6. No device identity, so a fake device can join.
7. Flat networks where one compromised device reaches everything.
8. No logging or alerting from the fleet.
9. No plan for end of life, so old devices stay online unpatched.
10. Security treated as a launch task rather than a lifecycle one.

What to do instead

• Give every device a unique identity and credentials.
• Sign firmware and verify it at boot.
• Segment networks and allow only what is needed.
• Encrypt data in transit and at rest.
• Monitor the fleet and be ready to revoke a device.

Standards to read

ETSI EN 303 645 and the OWASP IoT guidance set out baseline practices for consumer and general IoT.

IICTP is a new independent credential and is not ISO/IEC 17024 accredited.