[Avg. reading time: 7 minutes]
Data Layer
Data in Transit (No Encryption)
💥 Problem: IoT devices often transmit data over protocols like MQTT, CoAP, or HTTP without TLS/DTLS. Attackers on the network can sniff or manipulate this data.
🧪 Real-World Use Case: A smart water meter system in a municipality was transmitting usage data over plain HTTP. Attackers intercepted and altered readings, affecting billing.
🛡️ Mitigation:
- Use TLS/DTLS for all device-server communication
- Enforce certificate pinning on clients
- Avoid legacy or plaintext protocols unless encapsulated securely (e.g., MQTT over TLS)
Data at Rest (Unencrypted Databases)
💥 Problem: Data stored on devices, gateways, or in the cloud might not be encrypted, making it easy for attackers with access to extract sensitive info.
🧪 Real-World Use Case: In 2020, a smart door lock vendor left unencrypted SQLite DBs in devices. Attackers extracted access logs and user PINs directly from flash memory.
🛡️ Mitigation:
- Enable AES-based encryption for device-side storage
- Use full-disk encryption on gateways or fog nodes
- Enforce encryption at rest (e.g., AWS KMS, Azure SSE) in cloud databases
Insecure Cloud Storage (e.g., Public S3 Buckets)
💥 Problem: Cloud object storage like AWS S3 or Azure Blob often gets misconfigured as public, leaking logs, firmware, or user data.
🧪 Real-World Use Case: A fitness tracker company exposed terabytes of GPS and health data by leaving their S3 bucket public and unprotected — affecting thousands of users.
🛡️ Mitigation:
- Use least privilege IAM roles for all cloud resources
- Audit and scan for public buckets (AWS Macie, Prowler)
- Enable object-level encryption and access logging
- Set up guardrails and policies (e.g., SCPs, Azure Blueprints)
Lack of Data Integrity Checks
💥 Problem: Without integrity checks, even if data is encrypted, an attacker can alter it in transit or at rest without detection.
🧪 Real-World Use Case: A smart agriculture system relied on soil sensor readings to trigger irrigation. An attacker tampered with packets to falsify dry-soil readings, wasting water.
🛡️ Mitigation:
- Use HMAC or digital signatures with shared secrets
- Implement checksums or hashes (SHA-256) on stored data
- Validate data consistency across nodes/cloud with audit trails