Endpoint Protection · Topic 9 of 9
IoT Security Measures, Tools and Standards
Secure IoT environments with segmentation, device identity, encryption and updates, plus IoT security tools, best practices and standards such as NIST.
- 4 min
- Change default credentials, patch, segment, encrypt and monitor.
- Secure boot and signed firmware stop tampered code.
- Use MQTT over TLS (8883) and CoAP over DTLS (5684).
What it is
IoT security means protecting the devices, the networks they use, the cloud services behind them and the data they produce. Because devices are limited, the defender relies on layered controls: secure the device, segment the network, protect the data and watch for abnormal behavior. Standards and guidelines describe what "good" looks like.
How it works
Security in IoT-enabled environments
Security must cover each layer of the ecosystem.
| Layer | Security focus |
|---|---|
| Device | Secure boot, unique identity, signed firmware, no debug ports |
| Gateway / edge | Authentication, filtering, protocol translation, local logging |
| Network | Segmentation, firewalls, encrypted channels |
| Cloud | Strong access control, API security, key management |
| Application | Secure mobile and web apps, input validation, MFA |
| Data | Encryption in transit and at rest, privacy controls |
The principle is security by design: build in authentication, encryption and update support from the start rather than adding them later.
Security measures for IoT environments
- Change default credentials and require unique, strong passwords per device.
- Maintain an inventory of every IoT device, owner and firmware version.
- Update firmware through signed, verified updates, and retire devices that can no longer be patched.
- Disable unused services, ports and features (such as Telnet or UPnP).
- Segment IoT onto separate VLANs and limit traffic with firewall rules to what each device needs.
- Encrypt communications with TLS (MQTT over TLS) or DTLS, and use certificates for device identity.
- Use strong device authentication and authorization, for example certificates or tokens rather than shared secrets.
- Secure the cloud and APIs with least privilege and MFA for administrators.
- Use secure boot and signed firmware to block tampered code.
- Protect physically: disable or protect debug interfaces such as UART and JTAG.
- Monitor traffic and logs for odd behavior, for instance a camera sending large volumes to a foreign address.
- Plan the lifecycle: secure onboarding, regular review and secure decommissioning with data wipe.
IoT security tools and best practices
| Type of tool | What it helps with |
|---|---|
| Device discovery and inventory | Finds and classifies connected devices on the network |
| Network monitoring (Wireshark, IDS such as Suricata or Snort) | Examines IoT traffic for anomalies |
| Vulnerability scanners (for example Nmap and general scanners) | Find open ports and known flaws |
| Firmware analysis tools (for example Binwalk) | Unpack firmware to find hardcoded secrets or known components |
| IoT security platforms and NAC | Profile devices and enforce network policy |
| Internet exposure search (Shodan) | Shows which of your devices are visible from the internet |
| Device management platforms | Push updates, rotate credentials, remove devices |
Best practices that tie these together: buy from vendors with a stated support period and update process, test devices before deployment, treat IoT as untrusted on the network, follow a zero trust approach and keep the list of devices current.
Standards, initiatives and efforts
| Standard or effort | Focus |
|---|---|
| OWASP IoT Project and Top 10 | The most common IoT weaknesses and testing guidance |
| NIST IR 8259 | Baseline activities and cybersecurity capabilities for IoT manufacturers |
| NIST Cybersecurity Framework | General risk management applied to IoT |
| ETSI EN 303 645 | Baseline security requirements for consumer IoT, such as no default passwords |
| ISO/IEC 27400 | Guidance on IoT security and privacy |
| IEC 62443 | Security of industrial automation and control systems |
| IoT Cybersecurity Improvement Act (United States, 2020) | Security requirements for IoT devices bought by federal agencies |
| UK Product Security and Telecommunications Infrastructure regime | Bans universal default passwords and requires a vulnerability reporting contact and a stated support period for consumer devices |
| IoT Security Foundation, GSMA, Cloud Security Alliance | Industry guidance and best practices |
A worked example
A smart building has cameras, badge readers and HVAC controllers. The security team inventories them, changes default passwords, places each group on its own VLAN, allows the HVAC controllers to reach only the building management server, enables TLS on MQTT and schedules signed firmware updates. A Shodan search finds none of the devices exposed to the internet.
How the exam asks about this
- "Which network measure limits the damage if an IoT device is compromised?" → Segmenting IoT devices onto a separate VLAN with restrictive firewall rules.
- "Which ETSI standard prohibits default passwords in consumer IoT?" → ETSI EN 303 645.
- "Which search engine shows internet exposed devices?" → Shodan.
What to remember for the exam
- Change default credentials, patch, segment, encrypt and monitor.
- Secure boot and signed firmware stop tampered code.
- Use MQTT over TLS (8883) and CoAP over DTLS (5684).
- Standards to recognize: OWASP IoT Top 10, NIST IR 8259, ETSI EN 303 645, IEC 62443.
- Inventory comes first, because you cannot protect what you do not know about.
Putting IoT on the same flat network as business systems is the classic design error. Segmentation is the usual best answer.
Common mistakes
Mixing consumer and industrial standards. ETSI EN 303 645 targets consumer devices, IEC 62443 targets industrial control.
Assuming encryption alone secures a device. An unpatched device with strong TLS can still be exploited through its services.
Skipping decommissioning. Retired devices may still hold credentials and data.
Check yourself
Why segment IoT devices?
A compromised device cannot easily reach business systems, and traffic can be limited to what the device needs.
What does ETSI EN 303 645 require that is easy to remember?
Baseline security for consumer IoT, including no universal default passwords.
What do secure boot and signed firmware prevent?
Running modified or malicious firmware on the device.
Topic 9 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.