Industry Applications and Security Decision Making

Introduction

The security of an Internet of Things (IoT) system cannot be judged only by the strength of an encryption algorithm or the presence of a firewall. Security decisions are shaped by the application, the value of the assets, the consequences of failure, the capabilities of users and operators, legal obligations, and the cost of controls. A sensor in a greenhouse, a pacemaker, an industrial robot and a traffic-light controller may all be connected devices, but they require different security priorities.

IoT security decision making is therefore a process of selecting proportionate controls for a specific operational context. The central question is not “How can every risk be eliminated?” but “Which risks require treatment, which can be transferred or accepted, and which controls provide sufficient protection for their cost and operational impact?”

This chapter applies security principles to smart homes, healthcare, manufacturing, transport, agriculture and smart cities. It also introduces practical methods for comparing risks, estimating costs, communicating recommendations and supporting procurement and digital-transformation decisions.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain why IoT security priorities differ between industries.
2. Evaluate confidentiality, integrity, availability, safety, privacy and resilience requirements.
3. Compare preventive, detective, corrective and compensating controls.
4. Use risk, cost and benefit information to support security investment decisions.
5. Develop security requirements for procurement and supplier evaluation.
6. Communicate security decisions to technical and non-technical stakeholders.
7. Identify ethical, legal and governance issues in connected environments.

1. Security as an Industry-Context Decision

A useful starting point is the distinction between information security and operational safety. Information security commonly emphasizes confidentiality, integrity and availability (CIA):

• Confidentiality means preventing unauthorized disclosure.
• Integrity means preventing unauthorized or incorrect modification.
• Availability means ensuring that authorized users and systems can access services when needed.

IoT environments add further concerns:

• Safety: avoiding injury, environmental damage or unsafe physical operation.
• Authenticity: establishing that a device, message or user is genuine.
• Privacy: controlling collection, inference, use and sharing of personal information.
• Resilience: continuing essential functions and recovering after disruption.
• Non-repudiation and accountability: maintaining trustworthy records of actions and decisions.

The relative importance of these properties varies. In a smart home, temporary loss of a lighting service may be inconvenient, while unauthorized access to cameras may seriously violate privacy. In a chemical plant, integrity and safety may be more important than confidentiality because a manipulated control value could cause physical harm. In healthcare, confidentiality is important, but availability and integrity can become life-critical.

1.1 The IoT Risk Chain

IoT risk extends across an entire chain rather than a single device:

Device → communication network → cloud or edge platform → application → operator → physical process

A weakness at any stage can affect the whole system. Examples include:

• an unchangeable default password on a sensor;
• insecure wireless communication;
• excessive permissions in a cloud application;
• an unpatched gateway;
• an inaccurate digital-twin model;
• an operator who cannot distinguish an alarm from a false positive;
• a supplier who stops providing security updates.

The risk chain also includes the supply chain. Components may be produced by several organizations, firmware may contain third-party libraries, and data may cross national borders. Security decisions must therefore consider ownership, maintenance and exit arrangements, not merely initial installation.

2. A Framework for Security Decision Making

A practical decision process consists of six stages.

Stage 1: Define the mission and critical services

Identify what the system is intended to achieve and which services must continue during disruption. A city traffic-management system may have a mission of maintaining safe traffic flow, not simply collecting data. A hospital monitoring system may need to support clinical decisions even when the cloud platform is unavailable.

Stage 2: Identify assets and dependencies

Assets include devices, software, credentials, data, facilities, processes, people and reputation. Dependencies include electricity, telecommunications, positioning services, cloud providers, maintenance contractors and identity systems.

Stage 3: Model threats and consequences

Threats may arise from criminals, insiders, careless users, competitors, hostile states, environmental conditions or accidental faults. Consider both cyber and physical events. A stolen password and a flood damaging a gateway can both interrupt service.

Stage 4: Estimate and prioritize risk

Risk can be described qualitatively using likelihood and impact. A simple matrix is useful for initial prioritization, but it should not replace professional judgment. The same vulnerability can have different consequences in different industries.

A quantitative expected-loss model is:

where:

• ALE is annualized loss expectancy, measured in currency per year;
• SLE is single-loss expectancy, the estimated loss from one incident;
• ARO is annualized rate of occurrence, the estimated number of incidents per year.

The model assumes that losses can be estimated reasonably and that the events being considered are sufficiently defined. It is a planning aid, not a precise prediction. It should include direct costs, such as repair, and indirect costs, such as downtime, regulatory penalties, safety consequences and loss of trust. For rare catastrophic events, a simple average may conceal unacceptable consequences.

Stage 5: Select and compare controls

Controls may be:

• Preventive: secure configuration, authentication, segmentation and encryption.
• Detective: logging, intrusion detection, anomaly detection and inspections.
• Corrective: patching, restoration and incident response.
• Deterrent: policies, sanctions and visible monitoring.
• Compensating: alternative measures used when a preferred control is impractical.

Controls should be mapped to risks and requirements. A control that reduces one risk may introduce another. For example, frequent reauthentication may reduce account misuse but delay emergency access. A cloud analytics service may improve detection while increasing dependency and privacy exposure.

Stage 6: Decide, document and review

Possible responses are to avoid, reduce, transfer or accept risk. The decision should record assumptions, owner, budget, residual risk, review date and escalation threshold. IoT risk changes as devices age, vendors alter services, threats evolve and systems become more interconnected.

3. Comparing Security Investment Options

Security spending should be assessed as an investment in risk reduction and service continuity rather than as an isolated technical expense. A simple net-benefit comparison is:

A positive result suggests that the estimated financial benefit exceeds the cost. However, a negative financial result does not automatically justify rejecting a control. Legal duties, safety obligations, human rights and organizational values may require action even when financial returns are uncertain.

For example, suppose a manufacturing organization estimates an annual loss of £80,000 from a particular attack. A proposed segmentation project is expected to reduce the loss to £20,000 and costs £35,000 per year to operate. The estimated net benefit is:

The estimate depends on the quality of the assumptions. It should also consider implementation disruption, residual risk and whether the control protects several assets at once.

Security decisions can be represented by a control portfolio. Low-cost, high-impact controls such as removing default credentials, enabling secure updates and restricting administrative access are normally implemented first. More expensive controls, such as redundant sites or specialized monitoring, are justified where the consequences of failure are severe or recovery requirements are strict.

3.1 Risk appetite and risk tolerance

Risk appetite is the broad level and type of risk an organization is willing to pursue or retain. Risk tolerance is the acceptable variation around a particular objective. A hospital may have very low tolerance for unauthorized alteration of medication data, while accepting limited downtime for a noncritical administrative dashboard.

Risk appetite must not be used to excuse unlawful or unsafe practice. Senior leaders remain accountable for risks that are accepted, delegated or transferred.

4. Application Domain I: Smart Homes

Smart homes include connected locks, cameras, alarms, thermostats, lighting, voice assistants, appliances and energy systems. Their main characteristics are heterogeneous devices, non-specialist users, consumer-grade support models and extensive collection of behavioral data.

Main security concerns

1. Privacy invasion: cameras, microphones, occupancy sensors and location data can reveal intimate routines.
2. Unauthorized physical access: compromised locks, garage doors or alarms can create direct safety risks.
3. Weak lifecycle management: devices may remain installed after vendor support ends.
4. Shared access: family members, landlords, guests and service providers may need different permissions.
5. Cloud dependence: loss of internet connectivity may disable essential functions.
6. Unsafe interoperability: integrating devices from different vendors can create undocumented trust relationships.

Appropriate controls

Users should change default credentials, enable multifactor authentication where available, separate guest and device networks, update firmware, disable unused services and review mobile-app permissions. A home gateway should preferably support automatic security updates, secure configuration backup and local operation for essential functions.

Manufacturers should provide a vulnerability disclosure process, signed updates, support-life statements, data minimization and clear deletion procedures. Procurement decisions should not focus solely on purchase price; subscription costs, update duration and replacement requirements are part of the total cost of ownership.

A privacy-preserving design may process occupancy data locally rather than continuously sending raw sensor streams to a vendor cloud. This can reduce exposure, but local processing still requires access control and update mechanisms.

5. Application Domain II: Healthcare

Healthcare IoT includes wearable devices, infusion pumps, imaging systems, patient monitors, connected beds, implantable devices and hospital environmental systems. It combines sensitive personal data with clinical and physical consequences.

Security priorities

• Integrity: incorrect clinical data can lead to harmful decisions.
• Availability: loss of monitoring or treatment capability can endanger patients.
• Confidentiality: health information is highly sensitive.
• Safety and fail-safe behavior: devices must enter a safe state when communication or sensors fail.
• Traceability: access and clinical actions must be attributable.

Healthcare systems often contain legacy equipment that cannot be patched without disrupting care or invalidating certification. Technical teams may therefore use network segmentation, compensating monitoring, application allow-lists, restricted maintenance ports and carefully controlled maintenance windows.

Access should follow least privilege and role-based principles. A nurse, biomedical engineer, vendor technician and system administrator should not automatically receive the same permissions. Emergency access (“break glass”) may be necessary, but it should be logged, justified and reviewed.

Security and safety engineering must work together. A security control that blocks an authorized clinician during an emergency may create unacceptable risk. Conversely, an emergency override that is never audited can become a permanent vulnerability.

Healthcare organizations should evaluate device suppliers for secure development, clinical update procedures, vulnerability response, interoperability, data residency and end-of-support commitments. Compliance with applicable data-protection, medical-device and health-information regulations is essential; legal requirements vary by jurisdiction.

6. Application Domain III: Manufacturing and Industrial IoT

Manufacturing environments include programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA), robots, sensors, industrial gateways and enterprise resource-planning systems. Information technology (IT) and operational technology (OT) are increasingly connected for efficiency, predictive maintenance and quality management.

Distinctive requirements

OT systems often prioritize availability, deterministic operation, process integrity and safety over frequent change. A patch that is routine in an office may interrupt production or alter the behavior of a validated control system. Industrial attacks may cause defective products, equipment damage, environmental release or worker injury.

Layered industrial protection

A defensible design commonly includes:

• separation between enterprise IT, industrial DMZ and control networks;
• strict allow-listing of communications;
• authenticated engineering workstations;
• controlled remote maintenance;
• asset inventories that identify firmware and dependencies;
• tested backups of configurations and logic;
• independent safety instrumentation where appropriate;
• continuous monitoring that does not destabilize control traffic.

Convergence creates benefits, such as centralized analytics, but also expands the attack surface. A predictive-maintenance platform should not automatically receive write access to a controller merely because it receives sensor data.

Security decisions must include production engineering and safety personnel. A technically secure design that cannot be maintained, or that causes operators to bypass controls, is not a successful design.

7. Application Domain IV: Transport

Transport IoT includes connected vehicles, fleet telematics, railway signaling, intelligent transport systems, port logistics, navigation services and roadside infrastructure. The sector combines mobility, public safety, real-time requirements and geographically distributed assets.

Threats include manipulation of location data, unauthorized vehicle commands, denial of service, compromise of roadside units, theft of journey information and attacks on signaling or dispatch systems. Safety-critical functions require strong authentication, message integrity, redundancy and carefully bounded fail-safe behavior.

Security architecture should distinguish safety-critical control from passenger convenience services. Passenger Wi-Fi, infotainment and operational control should not share unrestricted trust. Fleet devices should have unique identities, secure boot where appropriate, signed software updates and mechanisms for rapid revocation of compromised credentials.

Availability planning must consider poor coverage and intermittent connectivity. A vehicle or rail system should have defined local behavior when the central service is unreachable. “Fail-safe” does not always mean stopping immediately; it means moving to a state that is safe for the particular process.

Privacy is also significant. Telematics can reveal employee movements, passenger behavior and sensitive locations. Data collection should have a stated purpose, retention limit and access policy.

8. Application Domain V: Agriculture

Agricultural IoT includes soil sensors, weather stations, irrigation controllers, autonomous machinery, livestock monitoring and drone systems. Benefits include efficient water use, early disease detection and improved yields.

Agricultural systems often operate over large areas with limited physical protection and unreliable connectivity. Devices may be battery-powered and difficult to visit for maintenance. Threats include false environmental readings, manipulation of irrigation, theft of farm data, ransomware affecting machinery and compromise of autonomous equipment.

Controls should be proportionate to the value and timing of the process. A sensor used for historical analysis may tolerate delayed data, whereas an irrigation controller during a drought may require high integrity and availability. Local fallback rules can maintain safe operation when cloud connectivity fails. Devices should use authenticated commands, tamper evidence where justified, secure replacement procedures and weather-resistant enclosures.

Farm data may reveal yields, land use, ownership and commercial strategy. Sharing it with equipment suppliers or agricultural platforms requires clear ownership, consent, retention and portability terms.

9. Application Domain VI: Smart Cities

Smart cities integrate lighting, parking, water, waste, public transport, environmental monitoring, emergency services and public spaces. Their scale and public visibility create complex governance challenges.

A city may be unable to replace thousands of devices quickly. Procurement must therefore address interoperability, update support, vulnerability disclosure, data governance, accessibility and contract termination. Central platforms can improve visibility but also create high-value targets and concentration risk.

Examples of city-specific concerns include:

• traffic signals manipulated to cause congestion or danger;
• water-quality sensors providing false assurance;
• public cameras enabling disproportionate surveillance;
• smart meters exposing household behavior;
• ransomware affecting municipal services;
• algorithmic decisions disadvantaging particular communities.

Security must be connected to democratic accountability. Residents should understand what data is collected, why it is needed and how complaints are handled. Privacy impact assessments, public consultation and independent oversight may be necessary, particularly for facial recognition, location tracking and predictive policing.

Resilience should include manual procedures, alternative communications and the ability to operate essential services if a central platform is unavailable. A city should avoid making every service dependent on one supplier or one data format.

10. Procurement and Total Cost of Ownership

Many IoT security failures originate in procurement. A buyer may specify device functionality but fail to specify secure update mechanisms, support duration or evidence of testing.

A procurement specification should address:

Total cost of ownership includes acquisition, installation, integration, training, licenses, connectivity, monitoring, updates, incident response, replacement, disposal and decommissioning. A low purchase price may conceal high subscription or maintenance costs.

Contract clauses should assign responsibilities clearly. “The supplier provides security” is insufficient unless the contract defines update duties, notification times, evidence, audit rights and remedies.

11. Communicating Decisions to Stakeholders

Security professionals communicate with audiences that have different concerns. Engineers may ask about protocols and attack paths; executives may ask about service impact and investment; operators may ask whether a control will slow work; citizens may ask about privacy and fairness.

A useful decision paper contains:

1. the business or public-service objective;
2. the assets and critical dependencies;
3. the leading risks and assumptions;
4. control options and their operational effects;
5. cost, benefit and residual-risk comparison;
6. legal, safety and ethical implications;
7. a recommended decision and accountable owner;
8. implementation milestones and review measures.

Avoid presenting risk scores without explanation. A “high” rating should state what could happen, how likely it is, who is affected and what evidence supports the judgment. Use plain language for consequences and reserve technical detail for appendices or implementation plans.

Useful performance indicators include patch coverage, percentage of devices with unique credentials, time to detect and contain incidents, backup restoration success, unsupported-device count and completion of supplier security reviews. Metrics should measure meaningful risk reduction rather than activity alone. The number of firewall rules, for example, does not prove that a system is secure.

12. Illustrative Case: Connected Water-Irrigation District

Background

A regional agricultural authority operates 420 remotely controlled irrigation gates. Sensors report water levels to a cloud dashboard, and authorized staff can issue commands through a mobile application. The system reduces travel and improves water allocation, but several gateways use old firmware and share a maintenance password.

Problem

An assessment identifies three risks: unauthorized opening or closing of gates, false sensor readings and loss of cloud connectivity during extreme weather. The authority has a limited annual budget and cannot replace all gateways immediately.

Analysis

The most serious consequence is not data disclosure but incorrect water distribution, crop loss and possible flooding. Integrity and availability therefore receive higher priority than confidentiality. The shared password creates weak accountability, while the cloud-only design creates dependency risk.

Approach

The authority adopts a phased plan:

1. replace the shared password with unique device and user identities;
2. enable multifactor authentication for staff;
3. separate control traffic from office networks;
4. install signed firmware updates on gateways that support them;
5. introduce local control rules for safe operation during connectivity loss;
6. validate sensor readings against physical limits and neighboring sensors;
7. retain manual override and emergency contact procedures;
8. replace unsupported gateways in the highest-consequence locations first;
9. require the supplier to provide vulnerability notifications and data export.

The authority also creates an incident playbook and tests restoration before the irrigation season.

Outcome

The plan does not eliminate all risk. It reduces the likelihood of unauthorized commands, improves accountability and limits the impact of a cloud outage. The phased replacement aligns spending with consequence rather than device count. The remaining risk is documented and reviewed before each season.

Learning points

• The most important security property depends on the process; here it is integrity and continuity.
• Compensating controls can be appropriate for legacy equipment.
• Local fallback behavior is essential when connectivity is uncertain.
• Procurement and contract terms are part of technical security.
• A documented residual risk is better than an unexamined assumption of safety.

13. Challenges and Limitations

Risk analysis is affected by uncertainty. Attack frequency may be unknown, indirect effects may be difficult to price and control effectiveness may depend on user behavior. Quantitative estimates can create false precision. Qualitative matrices can hide important differences between risks that receive the same label.

IoT systems also create tensions between security and usability, privacy and personalization, resilience and cost, openness and control, and centralization and autonomy. Legacy devices, scarce skills and supplier dependence may restrict available choices.

Artificial intelligence can assist anomaly detection, predictive maintenance and prioritization, but it does not remove the need for governance. Models can produce false positives, be manipulated by poisoned data or make decisions that operators cannot explain. AI systems require protected training data, access controls, monitoring and human accountability. An automated response should be carefully bounded when it can affect safety or essential services.

Ethical analysis must consider people who are not direct users. A smart-city sensor may affect pedestrians; a workplace wearable may affect employees; a connected medical device may affect patients and carers. Fairness, accessibility, consent and proportionality should be included in design reviews.

14. Best-Practice Checklist

Before approving an IoT deployment, an organization should be able to answer “yes” or provide a documented reason for “no” to the following questions:

• Is the mission and critical service clearly defined?
• Is there an accurate inventory of devices, software, data and dependencies?
• Are devices uniquely identified and authenticated?
• Are unnecessary services disabled and privileges minimized?
• Are communications and stored data protected appropriately?
• Can updates be authenticated, tested and delivered throughout the support period?
• Are logs sufficient for detection and investigation?
• Is there a tested backup, recovery and manual-operation plan?
• Have safety, privacy, legal and accessibility effects been assessed?
• Are supplier responsibilities and exit arrangements contractual?
• Has residual risk been accepted by an accountable person?
• Are controls reviewed after incidents, major changes and at defined intervals?

Chapter Summary

IoT security is an industry-context decision involving technical, operational, financial, legal and ethical considerations. Smart homes emphasize privacy and user control; healthcare requires confidentiality, integrity, availability and patient safety; manufacturing prioritizes process integrity, availability and safe IT/OT integration; transport combines real-time operation, privacy and public safety; agriculture requires resilient operation over distributed and resource-constrained environments; and smart cities require large-scale resilience, public accountability and responsible data governance.

Effective decisions begin with mission definition, asset and dependency identification, threat and consequence analysis, control selection, cost comparison and documented review. Risk calculations such as ALE = SLE × ARO can support investment decisions, but they must not replace professional judgment or legal and safety obligations. Procurement should cover the full lifecycle, including updates, vulnerability response, data governance, monitoring and exit. Finally, security recommendations must be communicated clearly so that leaders, engineers, operators, suppliers and affected communities can make informed decisions.

Key Terms

Asset: Anything of value that requires protection, including data, devices, services and processes.

Attack surface: The collection of points through which a system may be attacked.

Availability: The property of being accessible and usable when required.

Compensating control: An alternative safeguard used when a preferred control cannot be implemented.

Confidentiality: Protection against unauthorized disclosure.

Cyber-physical system: A system in which digital processes monitor or control physical processes.

Integrity: Protection against unauthorized or incorrect alteration.

Internet of Things (IoT): A network of physical objects with sensing, processing, communication or actuation capabilities.

Least privilege: Giving users and components only the permissions necessary for their tasks.

Residual risk: Risk remaining after controls have been implemented.

Resilience: The ability to continue, adapt and recover during disruption.

Risk appetite: The broad level and type of risk an organization is willing to retain or pursue.

Risk transfer: Moving some financial or operational consequences to another party, often through insurance or contract.

Safety: Protection from conditions that could cause injury, damage or environmental harm.

Secure boot: A mechanism that permits execution only of authorized software during startup.

Single-loss expectancy (SLE): Estimated loss from one occurrence of an incident.

Total cost of ownership: All significant lifecycle costs, not only the purchase price.

Vulnerability: A weakness that can be exploited or can contribute to failure.

Review Questions

Short Answer Questions

1. Why can availability be more important than confidentiality in some industrial IoT systems?
2. Define residual risk and explain who should accept it.
3. Identify three security requirements that should appear in an IoT procurement specification.
4. Why is local fallback operation valuable in transport and agricultural systems?
5. Distinguish between a preventive control and a detective control.

Long Answer Questions

1. Compare the security priorities of smart homes and healthcare IoT.
2. Explain how IT/OT convergence changes the security design of a manufacturing environment.
3. Discuss the privacy and governance challenges of smart-city deployments.
4. Explain why total cost of ownership is more useful than purchase price when evaluating IoT products.
5. Describe a complete process for making and communicating an IoT security investment decision.

Analytical / Application Questions

1. A hospital proposes connecting infusion pumps to a cloud analytics platform. Analyze the benefits, risks, control requirements and residual-risk decision.
2. A city wants to deploy connected cameras near schools. Develop a decision framework addressing necessity, proportionality, privacy, security, procurement and public accountability.
3. A factory estimates an annual loss of £120,000 from a control-network incident. A segmentation project would reduce expected loss to £45,000 and cost £50,000 annually. Calculate the estimated net benefit using the chapter’s model and discuss important non-financial factors that could change the decision.

Multiple Choice Questions with Answers

Question 1

Which security property is usually most critical when manipulated sensor data could cause unsafe industrial operation?

A. Integrity

B. Confidentiality

C. Portability

D. Anonymity

Correct Answer: A. Integrity

Question 2

What does total cost of ownership include?

A. Only the purchase price

B. Purchase, operation, maintenance, updates and disposal costs

C. Only the annual subscription

D. Only the cost of incident response

Correct Answer: B. Purchase, operation, maintenance, updates and disposal costs

Question 3

Which control is primarily detective?

A. Multifactor authentication

B. Network segmentation

C. Anomaly monitoring and alerting

D. Secure boot

Correct Answer: C. Anomaly monitoring and alerting

Question 4

In the formula ALE = SLE × ARO, what does ARO represent?

A. Annualized rate of occurrence

B. Authorized recovery operation

C. Average risk objective

D. Annual response obligation

Correct Answer: A. Annualized rate of occurrence

Question 5

Why should healthcare IoT use role-based access?

A. To give every user identical permissions

B. To assign access according to job responsibilities

C. To eliminate the need for audit logs

D. To prevent emergency access in all circumstances

Correct Answer: B. To assign access according to job responsibilities

Question 6

Which procurement requirement most directly supports supply-chain resilience?

A. A product’s color options

B. A defined vulnerability-notification and update commitment

C. A larger device display

D. A shorter password

Correct Answer: B. A defined vulnerability-notification and update commitment

Question 7

What is a compensating control?

A. A control that replaces an unavailable preferred safeguard

B. A control that increases the purchase price

C. A control used only after a device is discarded

D. A control that removes all residual risk

Correct Answer: A. A control that replaces an unavailable preferred safeguard

Question 8

Why is local fallback behavior important for connected transport systems?

A. Connectivity is always available

B. It allows safe operation when central services are unreachable

C. It eliminates the need for authentication

D. It guarantees that attacks cannot occur

Correct Answer: B. It allows safe operation when central services are unreachable

Question 9

Using the chapter’s net-benefit model, a control with £120,000 expected loss before, £45,000 after and £50,000 cost has what estimated net benefit?

A. £25,000

B. £75,000

C. £95,000

D. −£25,000

Correct Answer: A. £25,000

Question 10

Which issue is especially important in smart-city security governance?

A. Ignoring affected residents

B. Public accountability and proportional use of personal data

C. Removing all manual procedures

D. Making every service depend on one supplier

Correct Answer: B. Public accountability and proportional use of personal data