IOT107 · IoT Security and Privacy

Protect IoT systems end to end: model threats, harden devices and brokers, encrypt and authenticate traffic, segment networks, plan secure updates and govern the personal data that sensors collect.

Advance · 8 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Learners who build or manage connected devices and need to deploy them responsibly in a business setting.

Prerequisites

IOT106 (IoT platforms and dashboards); basic command-line use.

What you will be able to do

• Create a threat model for an IoT system using assets, entry points and the STRIDE categories.
• Harden an MQTT broker with authentication, per-device access control and TLS.
• Specify device-security requirements covering credentials, updates, secure boot and network segmentation.
• Apply privacy-by-design principles, including data minimization and retention limits, to an IoT use case.

Lessons

• Lesson 1 · The IoT threat landscape and threat modeling
• Lesson 2 · Securing devices, communications and networks
• Lesson 3 · Privacy, governance and incident readiness
• Lesson 4 · Lab and assignment

Lab: Harden an MQTT broker and threat-model a smart building

You run a local Mosquitto broker that starts insecure, then lock it down step by step: disable anonymous access, add per-device passwords, restrict topics with an access control list and enable TLS with your own test certificate authority. You verify each control and then draw a threat model for a small office's IoT system in OWASP Threat Dragon.

Free tools: Docker Desktop, Eclipse Mosquitto, OpenSSL, MQTT Explorer and OWASP Threat Dragon (all free, local)

Assessed assignment

Submit your hardened Mosquitto configuration and ACL (with passwords removed), evidence screenshots or logs for each control, and your Threat Dragon diagram export. Write a security and privacy brief for a small office installing occupancy, air-quality and door sensors: list the top five threats, the controls that address them and the residual risk. Include a data inventory stating what each sensor collects, whether it is personal data, how long it is kept and who can see it. Finish with an update and incident-response plan of one paragraph.

Portfolio piece

A hardened broker configuration template plus a threat model and security-privacy brief you can adapt for real IoT deployments.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.