Edge computing runs processing close to where data is created, on gateways, local servers or devices, instead of sending everything to a central cloud. It lowers delay and bandwidth use, and it puts many small computers in places that are harder to patch, monitor and physically protect.
What problem does the edge solve?
NIST's fog computing conceptual model (SP 500-325) explains the motivation well. It notes that managing data from Internet of Things sensors and actuators is among the biggest challenges of deploying such systems, and that traditional cloud based approaches struggle with large scale, varied devices and high latency. One response is to decentralize applications, management and analytics into the network itself.
A camera that detects a safety hazard cannot wait for a round trip to a distant region. A retail store should keep taking card payments when its internet link drops. A factory line produces more sensor data than is worth uploading. These cases favour local processing.
Edge, fog and cloud: what is the difference?
The terms overlap. In common use, cloud means centralized services in large data centres. Edge means compute at or near the data source. Fog, the term used in the NIST document, describes a layer between the two that spreads resources through the network. Treat the labels as descriptions of where code runs, not as separate technologies.
What are the main security risks?
- Physical access. An edge device in a shop, a roadside cabinet or a vehicle can be stolen, opened or tampered with. Data stored on it is at risk unless disks are encrypted.
- Patching at scale. Hundreds or thousands of devices need updates, often over weak links, and some stay offline for days.
- Weak identity. Devices with shared default passwords or long lived keys become a way into the wider network.
- Large attack surface. Each site adds open ports, management interfaces and local networks.
- Uneven monitoring. Logs may never reach a central place, so a compromised device can go unnoticed.
- Supply chain. Firmware and container images from many sources must be verified before they run.
- Data sprawl. Sensitive data may be copied to places your data classification rules do not cover.
A constructed example
A grocery chain installs a small server in each of 300 stores to run price checks and camera analytics. The servers ship with the same administrator password and a remote management port open for the vendor. A researcher scanning the internet finds one open port and the shared password works on every unit. No weakness in the analytics software was needed. The mistakes were shared credentials and an exposed management interface.
A better design gives each device its own certificate, closes inbound management ports, and has devices connect out to a management service that can revoke them.
Which controls matter most?
- Unique identity per device, backed by hardware protected keys where available.
- Signed updates and a tested rollback, so a failed update does not brick a site.
- Disk encryption and a plan for lost or stolen devices.
- Minimal exposed services, with management done over outbound, authenticated connections.
- Network segmentation at each site, separating devices from guest and office networks.
- Central logging that tolerates intermittent connections by buffering and forwarding.
- A zero trust stance: NIST SP 800-207 describes shifting defences from network perimeters to focus on users, assets and resources, with no implicit trust based on location.
How to check or apply this
- Count your edge devices and compare to what your asset system lists. Differences are your first finding.
- Check that no two devices share a credential.
- Pick a random site and look for open ports from outside.
- Time how long a security update takes to reach 95 percent of devices.
- Test what happens to a device when it is powered off and stolen: can someone read its storage?
- Make sure container images and firmware come from an approved source, with versions recorded.
Quick check
Is edge computing less secure than cloud?
Not inherently. It shifts the risks toward physical exposure, patching and identity, so controls must change to match.
What is the first control to put in place?
A unique identity for every device, so you can tell them apart and revoke one without affecting the rest.
Sources
- NIST SP 500-325, Fog Computing Conceptual Model
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-215, Guide to a Secure Enterprise Network
Last reviewed: 18 October 2026.
