Authentication
Disable anonymous connections and create a separate account for each device or application. Use long, unique passwords and do not share credentials across sites. Disable the account promptly when a device is retired.
Topic authorization
Use ACLs so a device can publish only to its own telemetry area and read only the command area it needs. Give management applications only the permissions required for their role. Assess broad wildcard permissions before production use.
Transport and network protection
Use TLS when supported by broker and clients, and do not disable certificate verification. Run the broker inside the IoT VLAN, expose management ports only to authorized stations, and block direct internet access.
Monitoring, backup, and testing
Monitor failed logins, unusual connection counts, and unauthorized topic attempts. Back up broker configuration and user/ACL files securely. Test restoration and credential rotation during scheduled maintenance.