IoT Security: Zero Trust, Regulations and Cybersecurity for Connected Devices
IoT security today requires much more than changing passwords. It requires microsegmentation, virtual patching and Zero Trust architectures to defend against a threat landscape that already accounts for more than 1.5 billion attempted breaches, according to Kaspersky.
Business leaders, CISOs and industrial IT directors all share the same question: what happens if a cybercriminal gains unauthorized access to a sensor connected to the corporate network? According to IBM Security, the average cost of such a breach is around 4 million dollars. Let us look at why this happens and how to prevent it.
The threat landscape: from botnets to IoT/OT convergence
Connected IoT devices now exceed 16 billion worldwide, and each one adds a potential entry point into the corporate network. The convergence between IoT and OT multiplies this risk when both environments share infrastructure without real barriers.
At ABAMobile, we have been developing IoT applications and platforms for more than 13 years, and if there is one thing we have learned, it is that there is little point in securing the physical sensor if the mobile application that controls it has vulnerabilities.
The risk of headless devices and the breakdown of the air gap
Microsoft has documented how operational networks, which were once physically isolated, are no longer truly separated. IoT acts as a bridge: a compromised headless sensor on the IT network can become the entry point to industrial machinery and SCADA systems.
These devices lack a management interface and often do not have the capability to receive secure OTA updates. That is why changing the factory password is not enough: if the firmware contains hardcoded credentials, the door remains open even if the visible password is changed. We explore this risk further in our analysis of cybersecurity trends.
The real cost of a breach: 4 million dollars according to IBM Security
IBM Security’s Cost of a Data Breach Report places the average cost of a breach in highly complex technical environments above this figure. In IoT/OT environments, the cost rises even further due to operational disruption and the associated reputational damage.
IoT security architecture beyond passwords
The myth of basic security hygiene still persists: changing the password continues to be presented as the definitive solution. But in headless devices with hardcoded firmware, that measure is merely cosmetic without network microsegmentation and virtual patching to contain lateral movement. If you are interested, we explore these security recommendations in more detail.
Five-layer encryption and automated PKI management
A defense-in-depth architecture encrypts traffic across five layers, from device-to-device communication using 128-bit AES to key renewal using RSA. Automated PKI management injects cryptographic identities from the factory.
Solutions such as those from GlobalSign or sensor manufacturers such as Libelium already work with zero-touch provisioning. In more than 13 years developing IoT application projects, we have seen that this decision can make the difference between a secure deployment and a vulnerable one.
Network microsegmentation and virtual patching through IPS
Fortinet recommends isolating IoT devices in dedicated VLANs and applying an Intrusion Prevention System that acts as a virtual patch for devices that may never receive a real update. This layer stops the attack before it reaches the device, complementing management through MDM (Mobile Device Management), the software that allows you to remotely control all devices.
Root of Trust: secure hardware from the factory
Integrating a TPM or HSM module directly into the hardware turns each device into its own trust anchor, capable of signing and verifying without relying on external software. At ABAMobile, we design this layer from the first sprint, rather than treating it as a later patch, while also selecting the communication protocol according to the environment in which the sensor will operate.
Apps: secure by design
The app is often the most accessible entry point. That is why we do not conceive software development without applying the principle of ‘security by design’. From multi-factor authentication (MFA) to encryption of the APIs that connect the device to the cloud, we design every mobile architecture to ensure that the convenience of managing your industry from a smartphone never becomes your weakest link.
We explain more in this video:
Communication protocols and attack surface
The choice of protocol directly determines how much security each node can support without draining its battery or saturating the available bandwidth.
Vulnerability comparison: WIZE, LoRaWAN and NB-IoT
| Protocol | Typical use | Security consideration |
|---|---|---|
| WIZE | 169 MHz, high penetration in basements, water meters | Dedicated band with lower exposure, although the key management ecosystem is more limited |
| LoRaWAN | Dozens of kilometers, rural environments and smart cities | Open standard that requires its own session key rotation |
| NB-IoT | 4G/5G cellular infrastructure, large-scale deployments | Inherits the operator network’s security, reducing the management burden |
Data provenance and the Internet of Dark Things
It is not enough for the device to withstand an attack: the data it generates must be trustworthy from end to end. Researchers at the UOC point out that data provenance, meaning the ability to trace its journey from the sensor, is the next critical frontier.
Without this traceability, a device can operate within the so-called Internet of Dark Things, compromised and feeding incorrect information into decision-making processes without anyone noticing it on the control dashboard.
Immutable traceability against manipulation
Techniques such as in-packet storage or blockchain-based records allow provenance information to travel together with the data itself, resisting tampering while in transit.
Regulatory compliance: CRA, NIS2 and IEC 62443
Another fundamental point is the European Union’s new Cyber Resilience Act, which turns what was previously a voluntary recommendation into a direct legal obligation for manufacturers, with associated financial penalties. We analyze its scope in this article about the CRA.
NIS2, meanwhile, requires active risk management in essential infrastructure. For industrial environments, IEC 62443 defines zones and conduits that determine what can communicate with what inside the plant, a principle that aligns directly with Zero Trust.
Compliance audits to adapt your IoT ecosystem
Adapting to the CRA means auditing every deployed device, documenting its lifecycle and demonstrating the ability to update it securely. Our team supports this technical and documentation transition for your product’s mobile apps, helping to prevent legal responsibility from becoming an unexpected issue when the regulation becomes fully applicable.
The next step: turning IoT security into a competitive advantage
In this context, IoT security is no longer simply a technical checklist. It becomes essential for scaling any project without taking on legal or reputational risk. If your company is evaluating an IoT deployment or reviewing one that is already in operation, it is worth analyzing how secure and scalable app development is built from the very first line of code.
What is the fundamental technical difference between IoT and OT environments?
IoT connects everyday objects to the internet to collect data, while OT directly controls physical and industrial processes with availability and physical safety requirements that consumer IoT does not address. Their convergence is now one of the greatest corporate risks.
Why do legacy IoT devices represent a critical risk to corporate infrastructure?
Because they often run firmware that does not support OTA updates and contain hardcoded credentials that cannot be rotated. Without microsegmentation or virtual patching, they remain exposed indefinitely and act as a silent entry point into critical systems.
How does Zero Trust architecture ensure security in networks with IIoT devices?
By continuously verifying every connection and trusting nothing inside the network by default. Combined with microsegmentation, it limits lateral movement even if an IIoT sensor is compromised, containing the damage within an isolated segment.
What security requirements does the Cyber Resilience Act (CRA) impose on hardware manufacturers?
It requires security by design, the elimination of default passwords, secure updates throughout the entire lifecycle and mandatory reporting of actively exploited vulnerabilities, placing legal responsibility directly on the device manufacturer.
