Endpoint Protection · Topic 8 of 9
IoT Devices, Ecosystem and Security Risks
Understand IoT devices and application areas, the IoT ecosystem and architecture, communication models and protocols, and the main security risks.
- 4 min
- Four communication models: device to device, device to cloud, device to gateway, back end data sharing.
- MQTT uses TCP 1883 (8883 with TLS), and CoAP uses UDP 5683 (5684 with DTLS).
- The top IoT risks are weak credentials, no updates, insecure services and unencrypted data.
What it is
The Internet of Things (IoT) is a network of physical devices with sensors, software and connectivity that collect and exchange data with little human involvement. Examples are smart thermostats, cameras, medical monitors, industrial sensors and connected cars.
Many IoT devices are small, cheap, rarely updated and placed where no one watches them. That combination makes them attractive to attackers and difficult to defend.
How it works
IoT devices, their need and application areas
Organizations deploy IoT to automate, monitor, save cost and make decisions from data.
| Application area | Examples |
|---|---|
| Smart home | Thermostats, lights, locks, voice assistants |
| Healthcare | Wearables, remote patient monitors, connected infusion pumps |
| Industrial (IIoT) | Factory sensors, robots, supervisory control systems |
| Smart city | Traffic lights, parking, street lighting, metering |
| Agriculture | Soil and weather sensors, irrigation control |
| Transportation | Fleet tracking, connected vehicles |
| Retail and logistics | Asset tags, smart shelves, inventory tracking |
| Energy | Smart meters and smart grids |
IoT ecosystem and architecture
Typical layers, from bottom to top:
| Layer | Role |
|---|---|
| Things / devices | Sensors collect data and actuators perform actions |
| Edge / gateway | Collects and filters data, translates protocols, can enforce security |
| Network / connectivity | Moves the data |
| Cloud / platform | Stores, analyzes and manages devices |
| Application | Dashboards, mobile apps and control interfaces |
Common technologies include Wi-Fi, Bluetooth Low Energy, Zigbee, Z-Wave, Thread, NFC, RFID, LoRaWAN, cellular and 6LoWPAN. Application protocols include MQTT (publish and subscribe messaging, TCP 1883, or 8883 with TLS) and CoAP (lightweight, UDP 5683, or 5684 with DTLS).
IoT communication models
Four models are commonly described (from the Internet Architecture Board).
| Model | Description |
|---|---|
| Device to device | Devices talk directly, for example over Bluetooth, Zigbee or Z-Wave |
| Device to cloud | The device connects directly to a cloud service over Wi-Fi or cellular |
| Device to gateway | The device talks to a local gateway that connects onward to the cloud |
| Back end data sharing | Cloud services share data with other cloud services or third parties |
Security challenges and risks
- Weak, default or hardcoded passwords.
- Insecure network services and open ports.
- No secure update mechanism, or no updates at all, leaving known flaws permanently.
- Insecure or outdated components and libraries.
- Insecure data transfer and storage: data sent or stored without encryption.
- Insecure ecosystem interfaces: weak web, API or mobile app interfaces.
- Insufficient privacy protection of personal data.
- Poor device management: no inventory, no monitoring.
- Insecure default settings.
- Lack of physical hardening, such as exposed debug ports.
- Resource limits: low power and memory make strong encryption and agents hard.
- Huge scale and long life: thousands of devices that remain in service for years.
These weaknesses are listed in the OWASP IoT Top 10. Real consequences include botnets (such as Mirai), which used default credentials on cameras and routers to launch large denial of service attacks, as well as privacy loss and attacks on physical safety.
A worked example
A hospital deploys networked infusion pumps. They use default passwords, cannot be patched and sit on the same network as clinical systems. The defender places the pumps on their own VLAN, changes credentials, permits only the traffic they need and monitors them with a passive tool that lists the devices.
How the exam asks about this
- "Which IoT communication model has devices connect through a local intermediary to the cloud?" → Device to gateway.
- "Which lightweight publish and subscribe protocol is common in IoT?" → MQTT.
- "Which weakness let the Mirai botnet spread?" → Default credentials on internet exposed devices.
What to remember for the exam
- Four communication models: device to device, device to cloud, device to gateway, back end data sharing.
- MQTT uses TCP 1883 (8883 with TLS), and CoAP uses UDP 5683 (5684 with DTLS).
- The top IoT risks are weak credentials, no updates, insecure services and unencrypted data.
- Gateways translate protocols and can enforce security.
- IoT devices often cannot run agents, so network controls matter.
Do not assume a device is safe because it is "just a sensor". It can be the way into the network or part of a botnet.
Common mistakes
Treating IoT like a normal PC. Limited resources and no agent mean protection often has to come from the network.
Ignoring the gateway and cloud. The ecosystem is only as secure as its weakest part, including the app and the API.
Leaving the factory password. Default credentials are the first thing attackers test.
Check yourself
What does an IoT gateway do?
It aggregates devices, translates between protocols and connects them onward to the network or cloud.
Name the four IoT communication models.
Device to device, device to cloud, device to gateway, and back end data sharing.
Why are IoT botnets common?
Devices have default or weak passwords, are exposed and are rarely patched.
Topic 8 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.