The HiveMQ blog recently ran a blog post series about securing MQTT. It featured 10 blog posts packed with content about security for the Internet of Things and MQTT. 

For convenience, here is a list with all blog posts.

• Introducing the MQTT Security Fundamentals
• Authentication with Username and Password
• Advanced Authentication Mechanisms
• Authorization
• TLS / SSL
• X509 Client Certificate Authentication
• OAuth 2.0 & MQTT
• MQTT Payload Encryption
• MQTT Message Data Integrity
• Securing MQTT Systems

If you plan to run MQTT in production, make sure to read the blog posts!