MQTT itself isn't encrypted. How do you secure it?

The MQTT protocol sends its packets, including topics and payloads, and any username/password in the CONNECT, in the clear, so on an untrusted network anyone on the path can read, modify, or spoof traffic, and credentials are exposed. You secure it by running MQTT over TLS, conventionally on port 8883 instead of plaintext 1883: TLS provides confidentiality (encryption), integrity, and server authentication (the device verifies the broker's certificate against a trusted CA so it isn't talking to an impostor). For authenticating the device to the broker you layer on credentials, username/password carried inside the now-encrypted TLS session, or, more strongly, mutual TLS with per-device client certificates so the broker cryptographically verifies each device's identity and you can revoke a single compromised device. On top of transport security you add authorization, access-control lists on the broker restricting which clients may publish or subscribe to which topics, so a compromised sensor can't subscribe to everything or publish commands. The constrained-device caveat is that TLS costs RAM, flash, and CPU/energy (the handshake and crypto), so you choose appropriate cipher suites, may use session resumption, and ensure the device has correct time and the right root certificates. So: TLS for the channel, certificates/credentials for identity, and broker ACLs for authorization, never plaintext MQTT on a real network.