Skip to main content

IOT Security

Code: TBD · Credits: 4 · Hours: 60 · Type: ELECTIVE

IoT spans home devices, industrial sensors, smart meters, vehicle telemetry, and a long tail of single-purpose hardware. The security model has to fit constrained devices, intermittent connectivity, and 10-year deployment lifetimes. This elective covers the stack, the threats, and the engineering trade-offs.

Key topics​

  • IoT reference stack: device, gateway, cloud, mobile, network.
  • Constrained-device cryptography (AES-CCM, ChaCha20-Poly1305, ECC).
  • Secure boot, code signing, OTA update authentication and rollback protection.
  • Protocols: MQTT, CoAP, AMQP — and their TLS/DTLS modes.
  • Device identity: hardware root of trust, TPM/TEE, attestation.
  • Privacy and lifecycle: ownership transfer, decommissioning, e-waste.
  • Real-world incidents: Mirai, Verkada cameras, smart-meter mass attacks, NTC routers.

Learning outcomes​

By the end of this subject, a student should be able to:

  • Architect secure provisioning + OTA update for a fleet of 10k devices.
  • Audit a vendor IoT stack against the IEC 62443 family.
  • Implement constrained-device crypto correctly (no nonce reuse, no rolling-your-own).
  • Plan privacy-conscious telemetry for a Nepal-context smart-meter rollout.

Further reading​

  • IEC 62443 series.
  • NIST IR 8259 / 8425.
  • IoT Security Foundation Best Practice Guidelines.
  • Cesare, Practical IoT Hacking.
Chapter notes

Detailed chapter-by-chapter notes for this subject are still being written. The topic outline above mirrors the published syllabus. If you'd like to help draft a chapter, see the contributing guide.

· min read