Edge & IoT Systems Engineering Roadmap

Start with the unit of trust. Build a small test CA and a lifecycle state machine before deploying brokers or dashboards.

• Explain why unique device identity limits the blast radius of extraction and compromise
• Separate manufacturing/bootstrap identity from operational identity and authorization
• Model zero-touch enrollment, server authentication, assignment, activation, and audit
• Compare X.509, symmetric-key, and hardware-backed attestation tradeoffs without universal claims
• Create test certificate chains, protected private keys, trust stores, and expiry monitoring
• Practice bounded-overlap renewal, revocation, quarantine, re-establishment of trust, and retirement
• Map NIST IoT device cybersecurity capabilities to the lifecycle
• Separate device, service, operator, update signer, and recovery identities
• Run negative enrollment tests for wrong issuer, model, tenant, expiry, replay, and duplicate identity
• Publish no private key, real identifier, or reusable credential in source, images, logs, or evidence

Use the OASIS MQTT specification and Mosquitto behavior to understand packet-level guarantees, then add application semantics honestly.

• Capture CONNECT, CONNACK, PUBLISH, acknowledgment, subscribe, disconnect, and reason-code flows
• Choose QoS 0, 1, or 2 per loss, duplication, latency, state, bandwidth, and consequence
• Make QoS 1 and uncertain retries safe with stable IDs and idempotent outcomes
• Test Clean Start, Session Expiry, stable client identity, queued messages, and Message Expiry
• Use retained publications for current state, not as an event-history substitute
• Use Last Will plus normal online state to model unexpected disconnect carefully
• Design versioned topics for tenant, site, device, telemetry, state, commands, and responses
• Bind authenticated identities to exact publish and subscribe scopes and test wildcards negatively
• Separate observations, desired/reported configuration, and bounded expiring commands
• Compare local MQTT with Azure IoT Hub and AWS IoT Core MQTT support without assuming identical features

Build the first project entirely in a disposable lab. Preserve source meaning across protocols and make disconnection a normal, bounded state.

• Run only a synthetic OPC UA server with an invented namespace and deterministic failures
• Validate OPC UA application certificates, secure endpoints, users, and trust lists
• Allowlist node IDs and keep the gateway read-only unless a separate harmless simulation is governed
• Preserve type, engineering unit, quality, source time, gateway time, schema, and provenance
• Separate acquisition from publication through a durable local queue
• Size queue bytes from measured record size, event rate, outage target, indexes, and safety margin
• Define priority, expiry, quota, eviction, protection, restart recovery, and declared loss behavior
• Rate-limit replay, protect live traffic, deduplicate downstream, and reconcile every terminal outcome
• Harden the gateway container with minimal user, capabilities, mounts, networks, and resources
• Complete certificate, bad-quality, stale-time, network, broker, disk, clock, duplicate, crash, and replay tests

Treat update authority and operational rollback as first-class security boundaries. A fleet release is a distributed change with heterogeneous eligibility and failure modes.

• Explain secure boot and measured trust concepts separately from TLS and update delivery
• Verify signed update metadata, digest, size, expiry, model, dependency, and security version
• Separate protected root trust from routine release-signing and artifact distribution roles
• Reconcile anti-rollback security policy with a tested last-known-good recovery path
• Target deployments by model, capability, site, version, and ring
• Use immutable artifact identity rather than a mutable newest tag
• Preflight disk, power or resource state, certificate validity, queue/state compatibility, and dependencies
• Gate canary, pilot, and broad rollout on process, resource, freshness, schema, and semantic health
• Halt and roll back a workload that runs but produces invalid synthetic telemetry
• Compare Azure IoT Edge and AWS IoT Greengrass deployment mechanisms as implementations of these decisions

Operate the second project as a lifecycle system: inventory, detect, contain, restore, reconcile, retire, and prove cleanup.

• Track lifecycle, model, site, version, configuration generation, ring, credential expiry, and update state
• Measure source sequence/time, queue age, publish outcome, ingestion time, convergence, restarts, disk, and clock
• Apply OpenTelemetry selectively to gateway, provisioning, policy, update, and backend operations
• Keep device and event IDs out of routine metric labels; minimize logs, traces, precision, export, and retention
• Page on sustained fleet symptoms and group by cohort rather than generating one alert per device
• Capacity-test payload, protocol overhead, QoS, connections, reconnect storms, routes, queues, storage, and downstream lag
• Attribute cost to connections, messages, operations, compute, updates, storage, retention, telemetry, transfer, and DR
• Restore registry, enrollments, policy, desired state, update trust, deployments, routing, dashboards, and alerts
• Fence command/update authority, cut over a cohort, measure RPO/RTO, reconcile, and test failback
• Retire identities and delete queues, retained state, artifacts, keys, backups, telemetry, containers, and hosted resources