\subsection*{Practice 4.3: IoT Security Threats and Best Practices (Subtemas 4.5 y 4.6)}

\begin{objetivopractica}
The student will examine IoT security vulnerabilities and explore best practices for securing IoT devices and networks. This practice will demonstrate common IoT security threats, protection mechanisms, and practical approaches to implementing security measures that protect IoT implementations from unauthorized access and attacks.
\end{objetivopractica}

The practice begins with the student researching common IoT security vulnerabilities by examining real-world security incidents involving IoT devices. They investigate weak authentication, unencrypted communications, and inadequate update mechanisms that create security risks.

\definicion{IoT security}{The protection of IoT devices, networks, and data from unauthorized access, attacks, and misuse}

The student examines IoT device authentication challenges by understanding how resource-constrained devices struggle to implement strong authentication mechanisms. They research lightweight authentication protocols designed for IoT environments.

% \includegraphics[width=\textwidth]{figuras/captura43_iot_vulnerabilities.png}

The practice includes investigating IoT communication security by examining how data encryption protects information as it travels between devices and applications. The student learns about lightweight cryptographic algorithms suitable for IoT devices.

\definicion{device authentication}{The process of verifying that IoT devices are legitimate and authorized to access network resources}

\definicion{lightweight cryptography}{Encryption algorithms designed for devices with limited processing power and memory capacity}

The student explores common IoT security threats by researching password attacks, firmware vulnerabilities, network eavesdropping, and device hijacking scenarios. They understand how these threats exploit typical IoT device weaknesses.

The practice includes examining IoT botnet threats by researching how compromised IoT devices can be organized into networks for malicious purposes. The student examines the Mirai botnet and similar attacks that exploited IoT vulnerabilities.

\definicion{IoT botnet}{A network of compromised IoT devices controlled remotely for malicious activities}

% \href{https://www.youtube.com/watch?v=XXXXXXX}{IoT security threats and countermeasures}

The student investigates man-in-the-middle attacks against IoT communications by understanding how attackers can intercept and modify data between IoT devices and their applications. They learn how encryption and authentication prevent these attacks.

The practice includes examining physical security vulnerabilities by researching how unauthorized physical access to IoT devices can compromise entire systems. The student understands the importance of tamper-resistant hardware and secure device placement.

% \includegraphics[width=\textwidth]{figuras/captura43_attack_vectors.png}

The student explores IoT device management security by researching secure boot processes, encrypted firmware updates, and remote device monitoring that help maintain IoT device security throughout their lifecycle.

\definicion{secure boot}{A security mechanism that ensures IoT devices start up using only trusted software}

The practice includes investigating privacy concerns in IoT systems by examining how personal data collection, storage, and sharing practices affect user privacy. The student learns about data minimization and anonymization techniques.

The student examines IoT security best practices by researching industry recommendations for secure IoT deployment. They investigate device hardening, network segmentation, access control, and monitoring strategies.

The practice includes exploring network segmentation as a security strategy by understanding how isolating IoT devices from critical network resources reduces attack impact. The student examines VLAN and firewall configurations for IoT security.

\definicion{network segmentation}{The practice of dividing networks into separate segments to limit attack propagation and improve security}

% \includegraphics[width=\textwidth]{figuras/captura43_network_segmentation.png}

The student investigates IoT security frameworks and standards by researching guidelines from organizations such as NIST, OWASP, and industry consortiums. They understand how standards help establish consistent security practices.

The practice includes examining IoT device lifecycle security by understanding security considerations during device procurement, deployment, operation, and decommissioning phases. The student learns about security planning throughout device lifecycles.

The student explores IoT security monitoring and incident response by researching how organizations detect, analyze, and respond to IoT security incidents. They understand the importance of continuous monitoring and rapid response capabilities.

The practice includes investigating regulatory and compliance considerations for IoT security by researching data protection regulations, industry standards, and certification requirements that govern IoT implementations.

% \includegraphics[width=\textwidth]{figuras/captura43_security_framework.png}

The student examines IoT security assessment methodologies by understanding how security professionals evaluate IoT system vulnerabilities through penetration testing, vulnerability scanning, and risk assessment procedures.

The practice includes exploring emerging IoT security technologies such as blockchain for device identity management, artificial intelligence for threat detection, and quantum-resistant cryptography for future protection.

The practice concludes with the student creating a comprehensive IoT security framework that incorporates threat awareness, best practices, and practical implementation guidelines. They understand how proactive security measures protect IoT systems from evolving threats.

\begin{rubrica}
The student must submit a report containing clear evidence of completing the practice. The document should include screenshots, explanations of observations, and reflection on the learning achieved. The submission must demonstrate that the student understood the concept and was able to apply it with the indicated software.
\end{rubrica}

\subsection*{Suggested Report Format}

\textbf{Title:} Practice 4.3 - IoT Security Threats and Best Practices \\
\textbf{Objective:} Written by the student according to what they understood. \\
\textbf{Development:} Clear narration of actions performed. \\
\textbf{Evidence:} Screenshots or other data obtained. \\
\textbf{Conclusions:} Technical reflection on what was learned. \\
\textbf{Personal Opinion:} Student's free opinion about the usefulness or difficulty of the practice.