Zigbee

Zigbee is a wireless protocol for small, low-power devices that send little data, such as sensors, switches and locks. It builds on the IEEE 802.15.4 standard for low-rate personal area networks and is maintained by the Connectivity Standards Alliance, formerly the Zigbee Alliance. Its devices form a mesh: a coordinator starts the network, routers relay traffic, and battery-powered end devices sleep most of the time. The ISC2 exam outline names Zigbee under wireless networks in Domain 4, alongside Bluetooth and Wi-Fi.

Zigbee encrypts and authenticates its traffic with AES-based keys, so the cipher is rarely the weak point. Its practical weakness is commonly how keys are distributed and stored. A device joining a network has to receive the network key, and if that happens under a default or widely known key, an attacker listening at the moment of joining can capture it. Keys stored on cheap devices can also be extracted with physical access. With the network key, an attacker can read and inject traffic.

Exam relevance: a scenario is likely to involve building automation or industrial sensors and a weakness in how they were set up. Candidates are expected to look past the encryption to key distribution and device handling, and to treat Zigbee devices as part of the network that segmentation and monitoring must cover.