CertNexus CIoTSP (IoT Security Practitioner) Exam Syllabus

• Account enumeration
• Weak default credentials
• Injection flaws
• Unsecure direct object references
• Sensitive data exposure
• CSRF
• Unvalidated redirects and forwards
• Session Management
• Malformed URLs
• Session replay
• Reverse shell
• Misconfiguration
• Weak account lockout settings
• No account lockout
• Unsecured credentials
• Lack of integration credentials on Edge devices

- Implement countermeasures used to secure web, cloud, or mobile interfaces.

• Change default passwords
• Secure password recovery mechanisms
• Secure the web interface from XSS, SQLi, or CSRF
• Protect credentials
• Robust password policies
• Account lockout policies
• Protect against account enumeration
• 2FA if possible
• Granular role-based access

• Lack of password complexity
• Poorly protected credentials
• Lack of 2FA
• Unsecure password recovery
• Privilege escalation
• Lack of RBAC
• Unsecure databases and datastores
• Lack of account lockout policy
• Lack of access auditing
• Lack of security monitoring
• Lack of security logging

- Implement countermeasures used to provide secure authentication, authorization, and accounting.

• Granular access control
• Password management
• Ensure re-authentication is required for sensitive features
• Event logging and IT/OT admin notification
• Security monitoring

• Vulnerable services
• Buffer overflow
• Open ports via UPnP
• Exploitable UDP services
• DoS/DDoS
• DoS via network device fuzzing
• Endpoint (address) spoofing
• Packet manipulation/injection
• Networking, protocols, radio communications

- Implement countermeasures used to provide secure network services.

• Port control
• Secure memory spaces
• DoS mitigation/DDoS
• Secure network nodes
• Secure field devices
• Secure network pathways

• Vulnerable data in motion
• Vulnerable data at rest
• Vulnerable data in use

- Implement countermeasures used to secure data.

• Encrypt data in motion, at rest, and in use

• Collection of unnecessary personal or sensitive information (PII, PHI, metadata)
• Unsecured data in transit or at rest
• Unauthorized access to personal information
• Lack of proper data anonymization
• Lack of data retention policies

- Implement countermeasures used to ensure data privacy.

• Only collect critical data
• Protect sensitive data
• Comply with regulations/laws
• Authorize data users
• Data retention policies
• Data disposal policies
• End-user notification policies (GDPR)
• Enable courtesy notifications to end users
• Enable notifications as required by law

• Poorly designed/tested software/firmware
• Unsecure updates/patches
• Firmware contains sensitive information
• Lack of OTA updates
• Constrained devices with non-existent security features
• Lack of end-to-end solution
• Software/firmware not digitally signed
• Unsecure bootloader/boot
• Unsecure key storage

- Implement countermeasures used to provide secure software/firmware.

• Digitally signed updates
• Remote update capability for, e.g., bootloader, firmware, OS, drivers, application, certificates
• Secure updates/digitally signed updates
• Root-of-trust/secure enclave
• Secure bootloader/boot, measured boot

• Access to software/configuration via physical ports
• Access to or removal of storage media
• Unprotected shell access for accessible ports
• Unrestricted physical access to vulnerable devices
• Easily disassembled devices 

- Implement countermeasures used to ensure physical security. 

• Protect data storage medium 
• Encrypt data at rest 
• Protect physical ports
• Tamper-resistant devices
• Limit physical access when possible
• Hardened security for shell access
• Limit administrative capabilities and access