A smart thermostat, a connected camera, an industrial sensor – on their own, they look harmless. But every connected device is also a potential entry point, and in an IoT network the weakest device sets the security level for the whole system. As organisations connect more of their operations, the attack surface keeps growing right along with it.

This course by the Arab British Fellowship Training Academy gives participants a hands-on grounding in securing IoT systems end to end: applying GDPR and ENISA guidance from the design stage onward, protecting devices and the networks they talk to, and keeping systems secure long after deployment – including in 5G and edge-computing environments where the stakes keep rising.

Who Should Attend?

• Cybersecurity professionals, system administrators and engineers working with IoT technologies.
• IT managers and privacy or compliance officers overseeing IoT infrastructure.
• Researchers, developers and any organisation adopting IoT technologies that needs to comply with European regulations.

Course Objectives:

By the end of the course, participants will be able to:

• Identify the security risks and vulnerabilities specific to IoT devices and networks.
• Apply European standards, including GDPR and ENISA guidance, to secure IoT environments.
• Protect sensitive data transmitted and stored by IoT devices, from design through deployment.
• Build incident response plans and threat mitigation strategies tailored to IoT systems.
• Maintain IoT security over time, including in supply chain, monitoring and post-deployment update processes.

• Module 1: One Weak Device, One Big Problem
  • IoT applications across industries, and the key components of an IoT system: sensors, devices, networks and data management.
  • Common security threats to IoT systems, including hacking, data breaches and unauthorised access.
  • How a single compromised device can affect an entire enterprise network.
• Module 2: Europe's Rulebook for Connected Devices
  • The role of GDPR in securing IoT systems and protecting personal data.
  • ENISA's contribution to IoT security guidelines and EU policy on IoT and data protection.
• Module 3: Securing the Device and the Network
  • Best practices for device security, from secure boot and firmware updates to authentication and encryption.
  • Encryption and secure protocols, such as TLS and VPNs, for protecting data moving between IoT devices.
  • Firewalls, intrusion detection and network segmentation to isolate IoT devices from critical systems.
• Module 4: Privacy and GDPR by Design
  • Data minimisation, anonymisation and secure storage for sensitive data on IoT devices.
  • Applying GDPR requirements – data processing, storage, transfer and data subject rights – to IoT systems.
  • Building security and privacy into the IoT device lifecycle from the start, with regular assessments to maintain compliance.
• Module 5: Finding and Fixing the Gaps
  • Conducting risk assessments and mapping potential attack surfaces across an IoT environment.
  • Preventing denial-of-service attacks and using AI-driven tools for predictive security monitoring.
  • Building incident response plans tailored to IoT, including post-incident recovery and forensic analysis.
• Module 6: Keeping IoT Secure After Deployment
  • Assessing and securing the IoT supply chain, including third-party components and vendor management.
  • Real-time monitoring and SIEM systems for ongoing IoT security management.
  • Regular firmware and software updates, including secure over-the-air (OTA) deployment.
• Module 7: IoT Security in a 5G, Edge and AI World
  • The impact of 5G networks and edge computing on IoT security requirements.
  • Emerging threats, including AI-driven attacks and the rise of autonomous IoT systems.
  • How EU regulation is expected to evolve, and what that means for IoT manufacturers and service providers.