Security: Threats & Defense · Study deck
IoT Privacy Threats
A smart lock records one door event.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- distinguish excessive collection, aggregation, inference, and third-party sharing as privacy threat categories
- use identifiability, linkability, detectability, and disclosure as privacy threat vocabulary
- explain why single-field mitigation fails against multi-identifier re-identification
- apply mitigation patterns (data minimization, local processing, aggregation, retention limits) to a worked example
Major section
In 60 Seconds
A smart lock records one door event.
- That single record may seem harmless.
- Many records can reveal sleep, work, travel, visitors, or an empty home.
- This map does not prove legal compliance or remove every risk.
- The deeper sections explain tracking, inference, weak notice, access, retention, and safer design controls.
Major section
A Normal Feature Can Still Tell a Story
IoT privacy threats are not limited to stolen data.
- A system can be secure against attackers and still harm privacy by collecting too much data, keeping it too long, combining it into sensitive inferences, or sharing it with parties the user did not expect.
- Privacy review starts by separating security from privacy.
Major section
A Normal Feature Can Still Tell a Story (continued)
Intuition only: you do not need to be breached to be tracked.
- Security asks whether unauthorized parties can access or change data.
- Privacy asks whether the data should be collected, retained, linked, or shared at all.
- IoT devices can reveal patterns even when each single reading looks harmless.
- Inference supports profiling.
Major section
A Normal Feature Can Still Tell a Story (continued)
It gives the Third-party sharing discussion a concrete result to carry forward.
- A wearable logs activity, a thermostat records changes, a smart lock records entry events, or a camera stores motion clips.
- Each feature may have a legitimate purpose.
- Profiling becomes harder to control once it is shared outside the original system.
Major section
A Normal Feature Can Still Tell a Story (continued)
Aggregation enables inference.
- The privacy question is whether the system also creates a record of a person's routine, health, location, visitors, or habits.
- Aggregation Ordinary readings become revealing when they are joined over time or across devices.
- Linkability Separate observations can be connected as the same subject, building a profile over time.
Major section
A Normal Feature Can Still Tell a Story (continued)
Inference Linked data reveals occupancy, routines, visitors, or health-related patterns that were not directly collected.
- Third-party sharing Data leaves the user's expected trust boundary through analytics, SDKs, partners, or onward sharing.
- This sequence demonstrates ioT privacy threats can start with routine collection, then grow through aggregation, inference, profiling, and sharing.
- Privacy Threat Vocabulary Identifiability An observation can be tied to a specific individual, not just an anonymous event.
Major section
Follow the Data Before You Trust the Feature
Privacy review should follow the data, not just the device.
- A review is weak if it only names the sensor and skips the downstream recipients.
- The privacy risk appears when those events are linked.
- Repeated temperature changes may suggest wake and sleep patterns.
- Lock events may suggest home and away periods.
Major section
Follow the Data Before You Trust the Feature (continued)
Motion events may suggest room use.
- Wearable activity may reveal routines or periods of inactivity.
- None of those conclusions require a breach; they can come from normal data collection.
- That support is what the Follow the Data Before You Trust the Feature narrative needs before proceeding.
Major section
Follow the Data Before You Trust the Feature (continued)
Their exact meanings support the claim that a privacy review follows data from device collection through local processing, cloud storage, analytics, and external sharing, checking minimization and control points along the way.
- The threat: every shop, station, or venue that logs nearby MAC addresses records this device.
- The mitigation:: MAC randomization replaces the real address with a rotating random one, so a device seen in two places no longer presents the same identifier and the sightings cannot be linked.
- The requirement: the randomization must actually change between contexts and not be undermined by other stable fields, or the linkage returns.
Major section
Follow the Data Before You Trust the Feature (continued)
At Figure: Wi-Fi probe review starts with the scan event, Probe/connect is not interchangeable with: AP, signal, and place? Shows why the distinction matters.
- That specific contrast demonstrates wi-Fi probe review starts with the scan event, then checks whether the address, observed metadata, logs, gateway, app, cloud, or SDK path can still reveal the same place or device.
- Mitigation Patterns Data minimization Collect fewer values, sensors, and samples when the feature does not need fine-grained raw data.
- Local processing Keep raw readings on the device or gateway and send only the service result.
Major section
When Re-Identification Uses More Than One Identifier
Privacy risk grows as data moves from direct readings to derived profiles and then to decisions.
- A responsible design documents each step and limits how far raw data can travel.
- Effective unlinkability requires rotating all correlatable identifiers together and at the same boundaries, such as address, fingerprint-affecting fields, counters, and names, and doing so at moments that do not themselves leak.
- Common Pitfalls Taken together, these checks make the section reviewable.
Major section
When Re-Identification Uses More Than One Identifier (continued)
Privacy against linkage is a property of the whole set of exposed identifiers, not of the single one you happened to protect.
- Higher-layer names A stable hostname or service name is an identifier the MAC randomization never touched.
- Rotate together Unlinkability requires changing all correlatable identifiers at the same boundary, not just one.
- Strong mitigation removes unnecessary data first, then rotates or suppresses all remaining correlatable identifiers together.
Major section
When Re-Identification Uses More Than One Identifier (continued)
At the boundary, the address, advertised capabilities, counters, cached network names, local service names, and app-visible identifiers should either change together or stop being exposed.
- Evidence should include paired captures from before and after a rotation event, plus a short explanation of which fields changed together and which fields were intentionally suppressed.
- If the same gateway log, analytics event, or service advertisement can still join the sessions, the privacy control is incomplete.
- That order exposes inferences and secondary use that a device-only view would miss, carrying the privacy analysis into a defensible lifecycle decision.
Deck summary
Key takeaways
A smart lock records one door event.
- Evidence should include paired captures from before and after a rotation event, plus a short explanation of which fields changed together and which fields were intentionally suppressed.
- Aggregation enables inference.
Retrieval practice
Recall check 1 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q1How can an IoT system be secure against attackers yet still create a privacy threat?
Show answer
Answer: B A secure system can still harm privacy by over-collecting, over-retaining, or combining data into sensitive inferences.
Retrieval practice
Recall check 2 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q2How can an IoT device create a privacy threat even when it is not breached and every component works as designed?
Show answer
Answer: C Privacy threats arise from ordinary behavior, not just attacks.
Retrieval practice
Recall check 3 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q3A wearable broadcasts a fixed hardware MAC address whenever it scans for WiFi. What privacy threat does this create, and what is the primary mitigation?
Show answer
Answer: A A persistent identifier turns independent sightings into a movement profile - linkability, often leading to identifiability.
Retrieval practice
Recall check 4 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q4A smart lock, thermostat, and motion sensor each collect ordinary operational events. When combined over several weeks, the events reveal when the home is usually occupied. Which privacy threat is most directly illustrated?
Show answer
Answer: A The individual events may be ordinary, but combining them over time creates an occupancy inference that was not directly collected as a single value.
Retrieval practice
Recall check 5 of 5
Shield Shelly says: answer from memory, then check your reasoning.
Q5A device randomizes its MAC address but is still tracked across locations. What is the most likely explanation?
Show answer
Answer: D Linkability needs only one stable attribute.
Print reference
Answers
Answer key.
- B · A secure system can still harm privacy by over-collecting, over-retaining, or combining data into sensitive inferences.
- C · Privacy threats arise from ordinary behavior, not just attacks.
- A · A persistent identifier turns independent sightings into a movement profile - linkability, often leading to identifiability.
- A · The individual events may be ordinary, but combining them over time creates an occupancy inference that was not directly collected as a single value.
- D · Linkability needs only one stable attribute.