IoT security best practices: passwords, updates and segmentation

Because they are computers that nobody treats as computers. A connected camera or plug runs an operating system, has a network stack, and often ships with a default administrator password, a web interface, and services listening on the network that the owner never uses. It sits on the same network as laptops and phones, it is rarely updated, and it stays plugged in for years after the manufacturer stops supporting it.

That combination gives an attacker a foothold that is easy to find, easy to log into, and easy to keep. Once inside the network the device can be used to scan for other machines, to relay traffic, or to join a botnet. The device security basics article gives the short list of changes that remove most of that exposure, and the VLAN article covers the one structural fix: keeping devices where they cannot reach anything that matters even if they are compromised.

A separate Wi-Fi name on its own is not isolation. Many consumer routers offer a "guest" or "IoT" network, and some of them genuinely block traffic between that network and the main one, but others only give the devices a different name and put them on the same subnet. The only way to know is to test: from a device on the IoT network, try to reach a laptop on the main one.

Real isolation means the two networks are separate layer-2 segments, with a firewall between them that you control. On a home or small office network that means VLANs on a router and access point that support them, with rules that let your phone reach the devices but stop the devices reaching your phone. The VLAN article sets that up step by step. A router's guest network can be a reasonable stopgap if it passes the test above, but it rarely lets you write the one-way rules a proper setup needs.

First decide whether it still needs the internet at all. Many devices work perfectly well on the local network with their cloud access blocked at the firewall, and a device that cannot be reached from outside and cannot reach out is a much smaller risk than one that can. Put it on the IoT VLAN, block its outbound traffic except to anything it genuinely needs, and watch what it tries to do.

If the device must talk to a vendor cloud to function and that vendor has stopped patching it, the honest answer is to plan its replacement. The firmware update article explains what an update pipeline protects against, which helps in judging how exposed an unpatched device is. Cameras, anything with a microphone and anything that controls a lock or a heater deserve the strictest treatment; a light bulb that cannot be updated is an inconvenience rather than an emergency.