Securing IoT and Smart Devices at Home and at Work

Smart TVs, video doorbells, thermostats, warehouse sensors, connected printers, the Internet of Things (IoT) has quietly become the largest category of device on most networks, and often the least secured. Unlike a laptop, most IoT devices have no visible security software, no obvious way to check for updates, and were designed for convenience first.

Why IoT devices are attractive targets

• Weak default credentials. Many IoT devices ship with a default username and password that's never changed, and is often published online for that exact model.
• Infrequent or nonexistent updates. Some manufacturers stop releasing security patches within a year or two of a device shipping, leaving known vulnerabilities permanently open.
• Always-on, always-connected. Unlike a laptop that's sometimes off or disconnected, most IoT devices are online 24/7, giving attackers an unlimited window.
• Low visibility. Most IoT devices don't show up in traditional device management tools, meaning a compromised smart camera can sit unnoticed on a network for months.

What attackers actually do with compromised IoT devices

Rarely is the device itself the target. Compromised IoT devices are most often recruited into botnets used for large-scale distributed denial-of-service attacks, used as a foothold to pivot toward more valuable systems on the same network, or in the case of cameras and microphones, used directly for surveillance.

Practical steps for home use

1. Change every default password immediately after setup, on every device, router, camera, smart speaker, thermostat, everything.
2. Put IoT devices on a separate network from your computers and phones. Most modern routers support a "guest" or secondary network, use it for smart devices so a compromised lightbulb can't reach your laptop.
3. Check for and enable automatic updates where the device supports it, and periodically check the manufacturer's app or website for manual updates otherwise.
4. Disable features you don't use, remote access, voice assistants, or cloud connectivity you never actually use are extra attack surface↗ for no benefit.
5. Retire devices the manufacturer has abandoned. A smart device that no longer receives security updates is a permanent, unpatchable liability.

Practical steps for businesses

• Maintain an IoT asset inventory as part of your broader asset management program, you cannot secure devices you don't know exist.
• Network segmentation↗ is non-negotiable at scale: IoT devices belong on their own VLAN, with strict rules about what they can and cannot reach.
• Include IoT in your patch management↗ program, even though it's less convenient than patching laptops, schedule regular firmware checks as part of routine maintenance.
• Vet IoT vendors on their security update track record before purchase, not after deployment, a cheaper device with no update history is rarely cheaper once you account for the risk.

The bigger picture

As IoT devices multiply, from personal wearables to industrial sensors, the gap between "connected" and "secured" keeps widening. Treating every connected device, no matter how small or seemingly harmless, as something that needs a password change, a network boundary, and a patching plan is the single highest-leverage habit for closing that gap.

Related reading

IoT and Smart Device Security Basics

Smart cameras, speakers, thermostats and doorbells all connect to your network, and most ship with weak default security. Here's how to lock them down.

Managing a Growing Fleet of Devices and IoT

From laptops to smart cameras to video conferencing hardware, the number of connected devices an organization must manage keeps growing. Here's how to keep visibility as the fleet scales.

Keep Your Devices and Apps Updated

Updates don't just add features, they close known security holes. A simple, low-effort routine for keeping your phone and computer current.