IoT Security: Assess, Harden and Monitor Connected Devices

“This course contains the use of artificial intelligence.”

This is the rebuilt, hands-on edition of this IoT security course, and it is defensive from start to finish. Instead of describing controls from the outside, you build a small device fleet on your own machine and then assess it, harden it and monitor it, one layer at a time. Nearly half of the content lectures are screen-recorded labs marked [LAB], and every command in them is run on camera with its real output.

The fleet is the running artefact of the course: containers that behave like devices, with a real init system, real services and a web interface, a device network with a gateway and a capture point, an MQTT broker, an update server, a backend API and a network sensor. You set it up in Section 2 and every later section leaves it more secure, ending with a hardened reference device and the evidence file that proves it.

You start with identity: finding default and shared credentials in your own image, generating per-device secrets, forcing a credential change at first setup, standing up a device certificate authority and proving each device with mutual TLS. Then you secure the code the device runs: the boot chain, signing firmware with real keys and watching verification fail on a tampered image, rollback protection, and what is actually inside your firmware, with an SBOM, vulnerability matching, triage and a CI gate so the image cannot regress.

Secure update gets its own section: signed update packages, an authenticated update channel, A/B partitions and rollback, refusing tampered or downgraded updates, TUF and Uptane explained, and staged rollouts that do not brick the fleet. You then lock down how devices talk (TLS at the broker, client certificates and per-topic ACLs, CoAP over DTLS) and the network around them (deny-by-default egress, proving the blocked path is blocked, DNS as a control point, and MUD per RFC 8520).

The later sections cover monitoring the fleet (baselines, alerts on never-seen destinations, detection rules and logs you can afford to collect), the backend and companion app (ownership checks on device APIs and command authorisation), incident response at fleet scale (revoking identities, rotating credentials and shipping an emergency update) and the evidence regulators and customers ask for. ETSI EN 303 645, NIST IR 8259A, the EU Cyber Resilience Act, the Radio Equipment Directive with EN 18031, the UK PSTI regime and the U.S. Cyber Trust Mark are each explained with their scope stated precisely. The course is not legal advice.

What cannot honestly be recorded, such as UART and JTAG work, chip-off, glitching and radio capture, is taught conceptually and the course says so on screen. Every lab runs against the course’s own bench, never against a system you do not own.

Twelve downloadable working documents accompany the course, from the fleet build log and the device identity policy to the secure update design review, the incident response plan and the conformity dossier pack, so the artefacts you build are ones you can take to work.