Roadmaps Security roadmaps Specialised and emerging
Secure connected devices from chip to cloud: firmware, secure boot and updates, device identity, the protocols they speak, and the fleets of them in homes, cities and industry.
Estimated time: 15–29 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Device, gateway, cloud and app, with data and commands flowing between them. Security has to cover every link, not only the device.
Default passwords, no updates, insecure interfaces, hardcoded keys and weak network services. The OWASP IoT list has not changed much because the problems have not.
Microcontrollers, real-time operating systems, flash memory and constrained resources. Security controls must fit in kilobytes and milliwatts.
MQTT, CoAP and HTTP over the top; Wi-Fi, BLE, Zigbee, Thread, LoRaWAN and cellular underneath. Learn their security options and common misconfigurations.
Study Mirai and its descendants and the attacks on cameras, routers and medical devices. They show how cheap devices become infrastructure for attackers.
ETSI EN 303 645, the UK PSTI Act, the US Cyber Trust Mark and the EU Cyber Resilience Act set baseline device requirements. Know the ones for your market.
Each device needs a unique, protected identity, ideally in hardware, provisioned securely at manufacture or first boot. Shared secrets across a fleet are a disaster waiting.
Verify firmware at boot against keys in hardware so tampered firmware will not run. Most microcontroller families now support it; use it.
Signed, verified, resumable updates with rollback protection, for the whole supported life of the device. Devices without updates become liabilities.
Extract and analyse firmware for secrets, weak services and outdated components; then remove debug interfaces and unnecessary services before shipping.
TLS or DTLS with certificate validation, authenticated MQTT, encrypted wireless pairing. Constrained devices can still do this with the right libraries.
The mobile app and cloud API are often the weakest part. Apply API and mobile security standards and protect the device-to-cloud trust relationship.
Monitor thousands of devices for health, anomalies and compromise, rotate credentials, and push updates safely in waves. Design for the device you cannot reach.
Gateways and edge servers run real workloads near devices, often unattended. Harden them, attest them and treat them as semi-trusted.
Sensors and gateways bridging plants to the cloud cross the OT boundary. Apply both OT segmentation rules and IoT device security.
Hardware interfaces, firmware, radio, app and cloud all need testing. Learn the methodology and test only devices and systems you are authorised to.
Devices collect intimate data from homes, bodies and cities. Minimise collection, protect it, and be transparent; privacy law applies fully.
Define support periods, publish them, keep SBOMs, and plan what happens to devices when support ends. Regulators now require this.
Set the security baseline for every product or deployed device class, the architecture, the lifecycle rules and the compliance path for each market.
PSA Certified, ioXt, the Cyber Trust Mark and national labels prove baseline security to buyers. Choose the ones your market values.
Chip vendors, module makers, cloud platforms and standards bodies all shape device security. Engage them to raise the baseline.
Internet of Things devices are small computers with sensors and radios, built to a cost, deployed in huge numbers and rarely maintained. They sit in homes, hospitals, factories and cities, and they have been recruited into botnets and used as beachheads into networks.
IoT security covers the device itself (firmware, boot, keys, debug ports), its communications (wireless and application protocols), the cloud and mobile apps it depends on, and the operations of managing thousands of devices over years. Regulation now sets minimum requirements for consumer devices.
Billions of devices with weak defaults and no updates are an open invitation to attackers, and new laws make manufacturers responsible. Organisations deploying or building devices need people who understand the whole chain from silicon to cloud.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact