Don't Panic - IoT Device Security

An IoT device is part of a larger product and system. It has hardware and software, but it also has local interfaces, network services, an update path, a management service, users, and an owner. Security has to hold across those connections. A secure device is not a device with one security feature switched on.

NIST's IoT device cybersecurity capability core baseline is a useful starting map. It groups capabilities into identification, configuration, data protection, logical access to interfaces, software update, cybersecurity state awareness, and device security. The baseline is a starting point, not a universal checklist. Device function, deployment, users, physical access, and consequences of failure decide what a product profile must add.

Start with the product boundary. List the device, firmware, boot process, every local and network interface, mobile or web applications, cloud services, installers, operators, and support staff. Then list assets that matter: credentials, keys, configuration, firmware images, commands, telemetry, and personal or operational data. For each connection, ask who may use it, how identity is established, what action is permitted, and what happens on failure.

Device identification supports inventory and incident response. Configuration must cover security-relevant settings with controlled change. Data protection depends on who may read or change data, not encryption alone. Logical access means disabling unused interfaces and authenticating the rest. Software update only counts when updates are authenticated and recovery is defined. State awareness needs events chosen before you need them. Device security preserves the intended state against logical and physical abuse.

ETSI EN 303 645 makes consumer provisions concrete: no universal default passwords, vulnerability handling, updateability, protected parameters, secure communication, minimized attack surface, and software integrity. Deployment still needs inventory, segmentation, and a tested update path. End of support is a security state customers must understand.

Read the Intro for the seven capabilities. Use the Cheatsheet when you need the capability and interface checklist. Updates tracks the NIST IR 8259 series page this course uses for the baseline.