IoT devices are *typically a type of embedded system*, but many leverage technologies like machine learning, AI, cloud services, and similar capabilities to provide “smart” features. IoT devices bring a number of security and privacy concerns, and security analysts must be aware of these common issues: - **Poor security practices**, including weak default settings, lack of network security (firewalls), exposed or vulnerable services, lack of encryption for data transfer, weak authentication, use of embedded credentials, insecure data storage, and a wide range of other poor practices. - **Short support lifespans**—IoT devices may not be patched or updated, leaving them potentially vulnerable for most of their deployed lifespan. - **Vendor data-handling practice issues**, including licensing and data ownership concerns, as well as the potential to reveal data to both employees and partners of the vendor and to government and other agencies without the device owner being aware.