In partnership with

Dear Sentinels

The Internet of Things has been quietly sneaking into our lives, tucking sensors and microprocessors into everything from your thermostat to your nan's insulin pump, and even the odd industrial control system. All very convenient, until you realise most IoT devices were designed with function in mind and security as a bit of an afterthought, if it was thought of at all. Weak default passwords, unencrypted messages flying about, and patching that happens about as often as a solar eclipse have left billions of devices wide open for attackers. The result? Anything from a little privacy leak to full-blown botnets that can knock out half the internet, as we saw with Mirai back in 2016. Now that we're heading towards tens of billions of these things, knowing how they can be attacked isn't just a nice-to-have, it's absolutely essential if we want systems people can actually trust.

Enter STRIDE, stage left. Microsoft cooked up this threat modelling framework to break down security risks into six neat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Although it was originally meant for your standard software systems, STRIDE fits surprisingly well with the weird and wonderful world of IoT, where gadgets, cloud back-ends, and all those chatty protocols each bring their own set of headaches. In this edition, we'll take a stroll through each STRIDE category and see how it plays out in IoT, with a few real-world horror stories and some practical tips for keeping the gremlins at bay.

This is the first part of a two part series, so get the next one in a weeks time!

Some teams never seem to stop moving. They're on Attio, the agentic CRM.

Every customer signal is captured in one shared context layer, always current and compounding. Agents and workflows build pipeline, chase every buying signal, and move deals forward, an always-on revenue engine running alongside your team.

With Attio, you’ll get: