What is the purpose of mutual authentication in IoT/OT design?

• A. Devices authenticate each other before exchanging data.
• B. Only the server authenticates the client.
• C. Authentication is optional for efficiency.
• D. Usernames replace certificates.

Answer: (A)

Mutual authentication means both devices prove who they are before any data is exchanged. In IoT/OT, devices and gateways are often distributed, unattended, and part of critical control loops. If only one side is verified, a malicious device or rogue gateway could impersonate a legitimate endpoint, allowing spoofed commands or data leakage. By requiring both sides to authenticate, you prevent impersonation and man-in-the-middle attacks and you can establish an encrypted, trusted channel for data integrity and confidentiality. This is typically done with machine-appropriate credentials like certificates or pre-shared keys, often via TLS/DTLS with client and server authentication and protected by secure hardware.

One-way authentication leaves the device at risk because the client or device could be deceived into talking to a false server or gateway. Making authentication optional is not acceptable in critical OT environments, where trust and integrity are essential. Relying on usernames for machine-to-machine authentication is insecure and does not scale or provide strong, automated identity assurance for devices.