Protect the MQTT telemetry path
Review topic access and identity boundaries between an industrial gateway and broker.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
A gateway publishes production counts to an MQTT broker. A reporting client needs read-only access.
Evidence to examine
Gateway identity: gw-line1 Publish topic: factory/line1/count Reporting identity: reporting Current ACL: reporting may publish and subscribe factory/#
Your investigation tasks
- Identify permissions that exceed the reporting requirement.
- Draft topic permissions for both identities.
- Describe credential lifecycle and broker audit evidence.
Debrief
Review the reasoning after completing the tasks
Restrict reporting to subscribe only to the required topic and gateway publishing to its assigned topic. Use protected transport and distinct identities appropriate to the environment. Validate ACL behavior using a test broker, including denied publish and unrelated topic access.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.