IoT Security Best Practices

Common IoT Threats

IoT devices face unique security challenges due to limited resources and remote deployment.

Device Hardening

Disable Unused Services

# ESP32: Disable unused features in menuconfig
CONFIG_BT_ENABLED=n
CONFIG_LWIP_TCP_ENABLED=y
CONFIG_LWIP_UDP_ENABLED=y
CONFIG_LWIP_SND_BUF_DEFAULT=5760

# Disable debug interfaces
CONFIG_LOG_DEFAULT_LEVEL_NONE=y
CONFIG_ESP32_DEBUG_OCDAWARE=n

Remove Debug Access

• Disable JTAG/SWD in production
• Remove UART debug output
• Enable flash encryption
• Enable secure boot

Encryption

Data in Transit

Protocol	Encryption	Use Case
TLS 1.3	AES-256-GCM	HTTPS, MQTT over TLS
DTLS 1.2	AES-128-CCM	CoAP, UDP-based
WireGuard	ChaCha20	VPN tunnels

Data at Rest

// ESP32 Flash Encryption
// Enable in menuconfig:
CONFIG_ESP32_SECURE_FLASH_ENC_ENABLED=y
CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE=y

// Encrypt partition table
espsecure.py encrypt_flash_data --keyfile key.bin --address 0x10000 app.bin

Secure Boot

Ensure only signed firmware runs on devices:

1. Generate secure boot key
2. Sign firmware with private key
3. Device verifies signature on boot
4. Reject unsigned/tampered firmware

# Generate secure boot key
espsecure.py generate_signing_key --version 2 key.pem

# Sign application
espsecure.py sign_data --version 2 --keyfile key.pem --output signed_app.bin app.bin

# Burn key to eFuse (ONE TIME - irreversible!)
espefuse.py burn_key secure_boot_v2 key.pem

Authentication

Device Authentication Methods

• X.509 Certificates: Most secure, PKI-based
• Pre-Shared Keys (PSK): Simpler, less secure
• Token-based (JWT): Good for cloud services
• HMAC: Message authentication

Network Security

Network Segmentation

# VLAN Configuration
VLAN 10: IoT Devices (isolated)
VLAN 20: Management (admin access)
VLAN 30: Guest (no IoT access)

# Firewall Rules
Allow IoT → Internet (specific ports only)
Allow IoT → MQTT Broker (port 8883)
Deny IoT → Internal Network
Deny Internet → IoT (no inbound)

Port Security

Service	Secure Port	Insecure Port
MQTT	8883 (TLS)	1883
HTTP	443 (HTTPS)	80
CoAP	5684 (DTLS)	5683
SSH	22	-

OTA Updates

Secure firmware update process:

1. Firmware signed with private key
2. Device verifies signature before install
3. Use A/B partition for rollback
4. Encrypt firmware in transit
5. Authenticate update server

// ESP32 OTA with verification
void performOTA() {
  WiFiClientSecure client;
  client.setCACert(rootCACertificate);
  
  HTTPClient https;
  https.begin(client, "https://updates.example.com/firmware.bin");
  
  int httpCode = https.GET();
  if (httpCode == 200) {
    Update.begin();
    Update.writeStream(https.getStream());
    Update.end();
    
    if (Update.isFinished()) {
      ESP.restart();
    }
  }
}