IoT security is harder than conventional IT security for structural reasons: devices are numerous, physically exposed, often battery and memory constrained, and expected to run for years with little attention. The attack surface includes the hardware, the firmware, the radio link, the cloud backend and the supply chain that produced all of them. Incidents such as the Mirai botnet showed how cheap defaults scale into a global problem.
The fundamentals are consistent across sectors: a unique device identity, secure boot, encrypted and authenticated communication, a working update path, and no default credentials. Regulation now requires several of these for consumer and industrial products. IoT security fundamentals sets out the threats and the defenses in order.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.