In this 6th episode of my Device to Cloud series, which is another whiteboard talk, I'm talking about why application-level security matters in typical M2M scenarios where, for instance, sensors pick up environmental data and control systems react on that input and take action. Security approaches that merely focus on providing a secure tunnel separating "this" system from the rest of the world, or are even further segregating traffic at the lowest layers of the network, are not a sufficient solution if the underlying networks are not fully trustworthy (that includes public mobile operator networks) and/or there is any risk of 3rd party interception and manipulation inside such a segregated network zone, for instance by foreign malware intrusions and in the infamous Stuxnet case. The best way to deal with network-level foul play is to pull the responsibility for privacy, integrity, and identity up to the application layer or to at least tie these concerns into the application layer from the underlying network layer. [Part 1] [Part 2] [Part 3] [Part 4] [Part 5]