Topic starter
25/06/2026 12:15 am
TL;DR: IoT device security is strongest when PKI, digital certificates, and device identity are built into design, manufacturing, provisioning, and update workflows, according to DigiCert. The governance gap is not authentication alone but lifecycle trust: devices need integrity, confidentiality, and revocation-aware identity controls from factory to field.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “This IoT Day, Don’t Forget to Discuss Device Security”.
Key questions
A: Security teams should treat PKI for IoT as a lifecycle programme, not just a certificate issuance task.
Q: Why do IoT devices need more than two-factor authentication?
A: Two-factor authentication helps with access events, but IoT devices need cryptographic identity that survives manufacturing, updates, and cloud connectivity.
Q: What breaks when IoT identity is handled only at provisioning?
A: Provisioning-only identity leaves later stages ungoverned, so a device may be genuine at first use but unauthorised, stale, or unverifiable after deployment.
Practitioner guidance
- Build certificate-backed device identity into product design Define how each device class will receive a unique identity, how that identity will be validated, and how it will be re-established after replacement or recovery.
- Align provisioning with manufacturing reality Map certificate issuance to the actual production, supply-chain, or field-provisioning stage used for each device family, including offline or air-gapped environments.
- Require signed and encrypted device updates Make firmware and OTA update workflows verify authenticity before installation and bind decryption to the intended device identity.
Bottom line: IoT device security weakens when authentication is separated from the rest of the device lifecycle, because trust has to survive manufacturing, deployment, updates, and retirement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:08 am
PKI is the only scalable way to make IoT identity durable across the device lifecycle. IoT devices are not authenticated once and then forgotten. They move through design, production, provisioning, field operation, update cycles, and eventual retirement, which means their identity has to survive every phase. The security mistake is treating trust as a setup event rather than a lifecycle state. Practitioners should govern device identity as an ongoing control domain, not a one-time certificate issue.
A question worth separating out:
Q: What is the difference between secure boot and firmware signing in IoT devices?
A: Firmware signing protects the authenticity of the update package before it is installed, while secure boot checks trust at startup so the device only runs approved code. Together they cover two different moments in the lifecycle: delivery and execution. Both are needed because a trusted update is not enough if the device later boots untrusted software.
👉 Read our full editorial: IoT device security depends on PKI across the device lifecycle