Internet of things

The Internet of things connects identifiable physical objects to communication networks and computational services. A typical arrangement contains sensors that observe conditions, a local processor or gateway that filters readings, a network link, and software that stores or analyzes the resulting data. Actuators can close the loop by changing a valve, motor, lock, or temperature setting. The International Telecommunication Union describes the concept broadly enough to include physical and virtual entities that can be identified and connected, while NIST emphasizes the need to engineer IoT systems with attention to cybersecurity and privacy.¹²

IoT does not require every device to communicate directly with the public internet. A local sensor network may send data to an edge computer, which forwards only selected results to a cloud service. This layered design reduces bandwidth and latency, and can preserve operation when a wide-area connection fails.

The modern idea grew from machine-to-machine communication, embedded computing, and the expansion of Internet Protocol networks. An early precursor was a network-connected vending machine at Carnegie Mellon University that reported its stock and temperature in the 1980s; the phrase “Internet of things” was later popularized by Kevin Ashton in a 1999 presentation. Falling sensor and communications costs then widened adoption across logistics, manufacturing, agriculture, buildings, transport, and consumer products.

Applications differ in their tolerance for delay and failure. Industrial systems may use sensors for predictive maintenance, while smart meters support demand measurement and grid management. Connected medical devices can monitor patients, but their software and network dependencies make safety and security part of clinical risk management. A connected thermostat or vehicle is more consumer-facing, yet it still raises questions about ownership, updates, and data access.

IoT security begins with the device lifecycle rather than the network alone. Unique credentials, secure configuration, authenticated updates, vulnerability handling, encryption where appropriate, and the ability to retire obsolete equipment are foundational controls. The IETF identifies recurring IoT challenges including constrained devices, heterogeneous networks, device management, and the need to protect communications across administrative boundaries.³

Privacy risks arise because apparently ordinary observations can reveal occupancy, routines, health conditions, industrial activity, or location. Data minimization, clear retention rules, access controls, and meaningful user choice can reduce those risks. The U.S. Federal Trade Commission has treated weak security, misleading privacy representations, and excessive collection as consumer-protection concerns. Regulation also varies by sector: medical, automotive, energy, and building devices may face different safety and reporting obligations.

Many IoT systems are local, intermittent, or deliberately disconnected from the public internet. A factory network may use proprietary fieldbuses alongside IP links; a wildlife tag may transmit only when an animal approaches a receiver; and a soil sensor may spend most of its life asleep to conserve energy. These cases show that IoT is an architectural category, not a requirement for continuous cloud connectivity.

Interoperability is another overlooked difficulty. Devices can exchange packets yet remain operationally incompatible because they use different data models, identity systems, update mechanisms, or definitions of an event. Edge computing addresses some latency and resilience constraints by processing data near its source, but it also distributes software maintenance across many sites. Security guidance from ENISA consequently treats inventory, secure development, supply chains, and end-of-life planning as connected concerns rather than isolated features.⁴

Actuator

A component that converts a control signal into a physical action, such as opening a valve or switching a motor.

Edge computing

Processing data near the device or network location where it is produced, rather than sending everything to a distant cloud service.

Machine-to-machine communication

Automated exchange of data between devices or systems without requiring a person to initiate each transaction.

Digital twin

A computational representation of a physical object, process, or environment that is updated with observed data.