Device Provisioning Security Analysis

Inspect provisioning trust boundaries, attack surfaces, and the controls that keep bootstrap trust from becoming production risk

animation
security
provisioning
trust-boundaries
device-identity
iot-security
interactive
An interactive device provisioning security analysis lab with trust-boundary scenarios, attack focus modes, control toggles, Play/Back/Next/Reset controls, technical accuracy notes, quick references, and practice prompts.

Animation Security analysis Trust boundaries Provisioning

Device Provisioning Security Analysis

Move through provisioning trust boundaries and see why a device is not safe just because it can connect. The lab shows the asset at risk, the required control, the attack path, and the remaining risk after controls are applied.

BRSKIDeployment scenario
FactoryActive boundary
34Residual risk
6/6Controls enabled

Device provisioning security controls and trust-boundary outputs

BRSKI trust-boundary analysis

Inspect the pledge, registrar, MASA voucher, EST enrollment, and runtime domain boundary.

Trust boundary map

Factory-root security decides whether the device starts with unique, verifiable identity evidence.

Device provisioning trust boundary diagram A trust-boundary map showing device, owner, untrusted network, provisioning, manufacturer, and operational service zones.

Security score

Residual
34
Detection
78
Blast radius
28

Asset at risk

Factory identity and manufacturer root of trust.

Required control

Unique per-device identity, protected key storage, and auditable manufacturing records.

What can go wrong

No attack focus is injected. The selected controls keep this boundary in the baseline state.

Provisioning security is a chain of boundary checks, not a single login event.
A weak factory identity makes later ownership and certificate checks much less meaningful.
Attacker entrycounterfeit or cloned device evidence
Trust anchormanufacturer CA or voucher authority
Telemetry to keepfactory record, serial, certificate issuer, lot
Recovery actionblock duplicate identity and investigate supply chain

Security Controls

Select the deployment scenario, choose an attack focus, then toggle controls to see how residual risk changes.

Trust Boundary Quick Reference
Device boundary

Protect private keys, bootstrap identity, firmware, secure boot state, and local storage from cloning or extraction.

Network boundary

Treat discovery, DNS, local radio, and first internet contact as hostile until authenticated by the provisioning method.

Owner boundary

Separate real device proof from authorization to join a specific account, tenant, owner, or domain.

Runtime boundary

After onboarding, enforce scoped credentials, renewal, revocation, logging, update support, and decommissioning.

Control Checklist
Identity

Use unique per-device identity or ownership evidence. Avoid shared fleet secrets and unaudited setup codes.

Authorization

Verify who may claim the device before production access is issued. A genuine device can still join the wrong tenant.

Credential issue

Replace temporary bootstrap evidence with scoped operational credentials and a policy matched to the device role.

Lifecycle

Keep a path for renewal, revocation, update, monitoring, and recovery after a provisioning failure or compromise.

Technical Accuracy Notes
BRSKI

RFC 8995 defines pledge, registrar, MASA, voucher, and EST integration concepts for bootstrapping remote secure key infrastructure.

EST

RFC 7030 defines certificate enrollment and CA certificate distribution over secure transport.

NIST baseline

NISTIR 8259A frames device identification, configuration, data protection, update, and cybersecurity state as core IoT capabilities.

OWASP IoT

OWASP IoT highlights weak credentials, insecure interfaces, insecure update, and insufficient device management as recurring IoT risks.

Practice Prompts
Find the hidden trust jump

Select each scenario and name the first point where an untrusted zone is allowed to influence identity.

Turn off a control

Disable mutual authentication or owner authorization. Which attack becomes easier, and why?

Limit blast radius

Select leaked bootstrap and compare scoped runtime with lifecycle disabled. What would you revoke?

Audit the failure

Choose a failure and list the telemetry needed to prove whether it was device, owner, network, or service side.