Four Districts, One Broker
Water, traffic, air and power look separate on the city map. If they publish into the same broker with no topic access control, that separation exists on the map and not in the traffic.
Your smart city has four districts.
An attacker may need one broker.
MQTT was not built as an industrial protocol, and more water, traffic, air and power systems run through it every year.
The Map Shows Four Systems
Water, traffic, air, power. Different devices, different gateways, different vendors, different naming conventions.
All four can publish into the same broker.
A district is an operational boundary. It is a way of dividing responsibility, reporting and staffing. It is not a security boundary, and nothing about naming it makes it one.
If the broker does not control which client may reach which topic, the separation you drew exists on the map rather than in the traffic. We covered the mechanics of that — wildcards, retained messages and optional authentication — in Four Districts' companion piece at labshocksecurity.com/news/mqtt-security-wildcards-retained-messages-ot
Then Gateways Change the Scale
A sensor cannot always reach the platform, so a hundred, two hundred, four hundred devices report through one gateway.
If those devices carry no identity of their own, the platform trusts the gateway to speak for all of them.
That changes the security question. It is no longer how many devices you have. It is how many gateways can speak for them, and what happens to the rest if one is wrong.
Some Messages Matter More Than Others
Ten thousand devices may report data.
Only a few hundred can move the city:
- a pump
- a valve
- a traffic signal
- a breaker
MQTT does not know the difference between a temperature reading and a command that opens a breaker. Both are a publish to a topic.
Your architecture has to know, because the protocol will not tell you.
Try It Yourself
- Find your brokers in traffic rather than in the asset register — TCP 1883 and 8883.
- For one district, prove a client in it cannot subscribe to another district's topics. If the answer is a naming convention rather than an ACL, you have a map, not a boundary.
- List the topics that can physically move something. That list, not the device count, is the one worth protecting.
- Test it somewhere the consequences are educational: github.com/zakharb/labshock · discord.gg/bpmaQFfW76
More on education