By Phil Beecher, President/CEO Wi-SUN Alliance Every smart meter, streetlight and environmental sensor connected to a city network creates another potential point of attack. As utilities and municipalities deploy millions of IoT devices, security is becoming just as important as coverage, battery life and cost. Here are five security capabilities organisations should demand from their IoT network infrastructure. 1. Strong device authentication The first security consideration is how devices are added to a network. Currently, several IoT network technologies rely on pre-shared keys. Although this may sound secure, since in principle only the device vendor holds them, it creates a serious vulnerability. If a key falls into the wrong hands, whoever holds it can simply join the network. Instead, utilities and cities need true device authentication, the equivalent of a passport and a visa. Each device should carry its own “passport” (identity) and “visa” (permission to access the network). Organisations typically implement this using certificates and public key infrastructure (PKI), which also support firmware signing. This becomes even more important as organisations deploy more applications at the Edge. Devices must be able to verify that any software running on them is authorised, helping maintain the integrity of the wider network. Key Rotation The second requirement is encrypting messages in transit. As with device authentication, any technology using a single pre-shared key is at risk. Any technology using a single pre-shared key is vulnerable if that key is compromised. Regular key rotation limits the amount of encrypted traffic exposed to any one key and reduces the opportunity for attackers to decrypt captured data. 2. Scalable security monitoring Scalability and visibility are other critical aspects to consider when managing very large networks. Operators must be confident they can deploy millions of devices while maintaining full security oversight across the entire network. This