Every sensor, gateway and dashboard is a way into your network. These IoT security basics cover default credentials, firmware updates, segmentation, encrypted transport, device identity, least-privilege dashboards, monitoring and incident response.
Key takeaways
A temperature probe in a cold room, an energy meter on a switchboard, a gateway on the factory floor: each one is a small computer on your network, often running for years with little attention. That is what makes IoT security different. The devices are numerous, inexpensive, physically exposed and rarely patched, and they sit right next to equipment that matters.
The risk is not theoretical. In 2016 the Mirai botnet took over large numbers of internet-connected devices simply by trying a short list of common default usernames and passwords, as a CISA alert described at the time. This guide covers the basics that defeat attacks of that kind, from the sensor to the dashboard, with a short note on TDRA's rules for IoT in the UAE.
Office IT has decades of habits behind it: managed laptops, patch cycles and endpoint protection. Connected devices often have none of that. Many run small embedded systems that cannot host security software, some cannot be updated at all, and a battery sensor may stay in a ceiling void for its whole working life. Classic field protocols such as Modbus were designed for closed networks and have no authentication or encryption of their own.
The consequences differ too. A compromised laptop leaks data; a compromised controller can switch off a chiller, open a valve or hide a temperature excursion in a pharmacy fridge, the kind of event our guides to cold chain monitoring and chiller maintenance are built around. IoT security protects data, operations and sometimes safety at the same time.
It helps to look at an IoT system layer by layer, because each one fails in its own way.
| Layer | Typical weakness | Basic control |
|---|---|---|
| Sensors and controllers | Default passwords, open debug ports, firmware that is never updated | Unique credentials, unused interfaces disabled, supported firmware |
| Gateways | Shared keys, remote administration open to the internet | Own identity and certificate, outbound-only connections, managed updates |
| Network | Devices on the same network as office PCs and servers | Separate zones, firewall rules by exception |
| Platform and data | Plain MQTT or HTTP, unprotected storage and backups | TLS on every link, encrypted storage, tested backups |
| Dashboards and apps | Shared logins, everyone an administrator | Named accounts, roles by site and action, audit logs |
The first provision of ETSI EN 303 645, the European baseline standard for consumer IoT security, is simple: no universal default passwords. Every device password must be unique per device or set by the user. The standard is written for consumer devices, but the rule is just as sound in a factory, a hotel or a warehouse.
StarSense works this way: each device and gateway receives its own credentials at enrollment, the device registry holds location, type, firmware and owner for every asset, and a lost or compromised device is revoked individually without touching the rest of the fleet.
Device vulnerabilities are fixed through firmware updates, so a device that never receives them stays exposed. Before you buy, ask how long the manufacturer will provide security updates. ETSI EN 303 645 expects manufacturers to publish that support period and a vulnerability disclosure policy, so a vendor that cannot answer is telling you something.
StarSense includes gateway and firmware update management, and its device registry records each asset's firmware alongside its location, type and owner.
If an attacker reaches one sensor, segmentation decides how far they get. Keep operational technology (OT), the systems that monitor and control physical equipment, in network zones separate from information technology (IT) such as office PCs, servers and guest Wi-Fi, and allow traffic between zones only by exception.
StarSense comes with network segmentation guidance for OT and IT environments, and its gateways buffer readings locally when a link drops, so tighter network rules do not have to mean lost data.
Readings, commands and credentials should never cross a network in clear text.
In StarSense, every connection from gateway to platform and between services uses TLS. The servers behind any platform need the same discipline; our hardening checklist for self-hosted Odoo shows what that looks like for a business system.
Dashboards are where people meet the system, and where shared logins and all-powerful accounts creep in. Apply least privilege, the principle that each person or service gets only the access its job needs:
StarSense applies permissions by site, zone, asset and action, and records configuration changes, commands, alert acknowledgments and rule edits with the user, the time and the previous value. The same thinking applies to the business systems your devices feed, as our guide to Odoo access rights explains.
Monitoring catches what prevention misses. ETSI's baseline asks manufacturers to examine telemetry for security anomalies, such as an abnormal increase in failed logins, and operators should watch for the same signs: devices that stop reporting, report at odd hours, change firmware unexpectedly or start talking to new destinations.
StarSense tracks device health through heartbeat, signal strength, battery level and last-seen status, alerts on missing data as well as thresholds, and sends alerts by email, in-app notification or WhatsApp through StarBot. When something does go wrong, a short, rehearsed plan beats improvisation:
Tip: Before buying any connected device, ask the vendor three questions. Are credentials unique per device? How long will security updates be provided? How do we report a vulnerability? Vague answers are an answer.
In the UAE, the Telecommunications and Digital Government Regulatory Authority (TDRA) regulates IoT under the IoT Regulatory Policy that its predecessor, the TRA, issued in March 2018, and the IoT Regulatory Procedures for registering services that followed in 2019. Three points matter for most projects:
Ask any IoT provider for its TDRA registration and device type approvals, and check the latest requirements on the TDRA IoT services registration page. This is a summary for planning, not legal advice.
StarSense, our AI and IoT platform, treats every device as an identity, every connection as untrusted until proven otherwise and every action as something to log. It runs on your own servers, in a private cloud or as a managed service by Star Bit Solutions, with the same security model in each case. Projects start with a site survey and a pilot, so security questions are settled before devices go in, whether the site is a building, a plant or a network of smart city sensors.
Have a security questionnaire or an OT network policy we need to fit into? Send it to [email protected], call +971 55 973 4524 or use the contact page, and an engineer will answer point by point.
Star Bit Solutions is a software company in Ajman, UAE, founded in 2014. We implement and customize Odoo Enterprise and Odoo Community, and build StarBiz (AI-driven ERP), StarHub (life super app), StarBot (conversational AI), StarLearn (adaptive learning) and StarSense (AI and IoT platform). About us
Device identity, TLS, role-based access and audit logs, on your own servers, in a private cloud or as a managed service.
Learn MoreDevice onboarding, telemetry and anomaly-triggered work orders across energy, water and environmental sensors.
Learn MoreRemote meter and sensor data with consumption anomaly detection, linked to asset registers and maintenance.
Learn More
Sensor points, chiller fault patterns, alert routing and maintenance schedules: a practical guide to predictive maintenance for cooling plant in UAE buildings.
· 10 min read
Sensors for cold rooms, reefers and fridges, alerting and escalation, tamper-evident records, calibration and tying each excursion to the lots it affected.
· 9 min read
Maintenance strategies compared, the sensors that matter, baselines and anomaly detection in plain terms, alert thresholds and the loop to work orders.
· 10 min read
Start with five habits: no default passwords and a unique identity for every device, firmware kept up to date, connected devices on their own network segment, encryption on every connection, and dashboards where each person has only the access their job needs. Add monitoring for unusual device behavior and a rehearsed incident response plan, and you close the most common ways in.
The same username and password often ship on every unit of a model and appear in public manuals, so attackers can try them automatically across the internet. The Mirai botnet did exactly that in 2016 with a short list of common defaults. ETSI EN 303 645 therefore requires device passwords to be unique per device or set by the user.
Yes. Put sensors, controllers, cameras and gateways in their own network zones, separate from office computers, servers and guest Wi-Fi, and allow traffic between zones only by exception. Gateways should connect outwards to the platform rather than accept connections from the internet. If one device is compromised, segmentation limits how far an attacker can go.
MQTT relies on the transport for encryption, so secure deployments run it over TLS, on port 8883 rather than the plain port 1883, with devices checking the server certificate and each device authenticating with its own credentials or certificate. Add access control on the broker, so each device can publish and subscribe only to the topics it actually needs.
Under TDRA's IoT Regulatory Policy, providers offering IoT services to the UAE market must register those services with TDRA, and radio and telecommunications equipment needs TDRA type approval. The policy also sets storage expectations by data classification. Requirements can change, so check the latest guidance on tdra.gov.ae and ask your provider for its registration. This is not legal advice.
Tell us what you need to monitor. We will propose a pilot with a device list, a network plan and the security controls built in.