CISSP 9.10 - Internet of Things

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series examines the Internet of Things within Domain 3. It explains how these connected smart devices differ from embedded systems, why their weak security matters, and how to treat the gadgets already inside your walls as the real endpoints they are.

Frequently Asked Questions

What is the Internet of Things, and how does it differ from an embedded system?

The Internet of Things is a class of connected smart devices that add automation, remote control, or intelligence to ordinary appliances, like smart thermostats, home assistants, and connected cameras. The key exam distinction is that an Internet of Things device is its own separate hardware, used on its own or bolted onto an existing system, while an embedded system is baked right into a larger machine and shares its chassis. It is a standalone gadget versus a built-in brain.

Why are Internet of Things devices such a security problem?

Most were never designed with security in mind, not even as an afterthought, and that gap has caused countless home and office breaches. Worse, once an attacker gets into or through one of these devices, they can often reach everything else on the same network. Picture a cheap smart plug as an unlocked side door: nobody guards it, yet it opens onto the whole house.

How do you deploy Internet of Things devices safely?

You start by putting them on their own isolated network segment, walled off from your main network, so a compromised gadget stays trapped in its own pen. Then you apply the same discipline you already know: keep them patched, limit who can reach them, monitor their activity, and put firewalls and filtering in front. And before you buy, judge both the device and the reputation of the vendor behind it.

What should you weigh with wearables and sensors?

Wearables like smart watches and fitness trackers raise sharp data questions: where does the collected data live and is it private, is the link to the collection service encrypted, and can you fully delete your data if you walk away. Sensors are the workhorse in business, measuring temperature, motion, humidity, and more, and often feed cyber-physical systems that act on what they read. One rule holds across all of them: never trust the defaults, and always change default passwords.

What is the Industrial Internet of Things?

The Industrial Internet of Things is a heavier branch aimed at manufacturing, engineering, and infrastructure. It evolves older industrial control systems by folding in cloud services for data collection, analysis, and automation. Edge computing and fog computing are examples of it. It is the same core idea as consumer devices, but scaled up to run factories and power grids instead of living rooms, and every organization owns this risk because these devices are woven through the modern workplace.

Reference: This article is based on concepts discussed in CISSP 9.10 - Internet of Things.