An alternative is to provide a reverse path for communications
back to the device, by having the device periodically
(at a frequency appropriate to the application) poll
the web-service, looking for updated command-and-control
messages. This type of pull-communications to the device
is inherently more secure