An IoT system administrator discovers that unauthorized users are able to log onto and access data on remote IoT monitoring devices. What should the…

The issue described is unauthorized users logging onto remote IoT devices. This is a classic indicator of compromised or weak authentication credentials. The most common vulnerability of this type in IoT ecosystems is the use of factory-default usernames and passwords, which are often publicly documented and rarely changed by administrators. Changing the default passwords on all devices is the most direct and immediate action to revoke access for unauthorized users who are exploiting these known credentials, thereby resolving the primary security flaw.

A. Encrypting data protects it from being read if stolen (data at rest), but it does not prevent the unauthorized login itself.

B. While applying firmware updates is a critical security practice, it does not directly address an authentication issue based on weak or default passwords.

D. URL filtering is a network-level control that restricts access to websites; it does not secure the device's own login and authentication mechanism.

1. National Institute of Standards and Technology (NIST). (2021). IoT Device Cybersecurity Guidance for the Federal Government: Foundational Activities and Core Device Cybersecurity Capability Baseline. NIST Special Publication 800-213A. Section 3.2

"Device Security

" identifies as a core capability that IoT devices should have "no default passwords" and support changing passwords. This directly supports changing default credentials to prevent unauthorized access. (Available at: https://doi.org/10.6028/NIST.SP.800-213A)

2. European Union Agency for Cybersecurity (ENISA). (2020). Baseline Security Recommendations for IoT. Section 4.2.1

"No Universal Default Passwords

" explicitly states that devices should not have default passwords and force users to change them upon first use to prevent trivial takeovers.

3. OWASP Foundation. (2018). OWASP Internet of Things Top 10 - 2018. The number one vulnerability listed is "I1 - Weak

Guessable

or Hardcoded Passwords." The remediation guidance emphasizes enforcing strong password policies and ensuring default credentials are changed.