Resource-constrained embedded systems belonging to the Internet of Things (IoT) are in the process of substantially increasing the attack surface of modern society. The new communication and processing capabilities will allow an enormous number of connected devices to collect, store and transmit sensitive information. Protecting embedded systems in this context will require the implementation of security mechanisms at an unprecedented scale. This lecture will discuss the main challenges in deploying security and privacy protection mechanisms in embedded systems, ranging from the generation and distribution of cryptographic keys to mitigating large-scale data breaches. The challenges will be richly illustrated with real-world examples, current research results and future directions.