IoT device security basics: default passwords, updates and network segmentation

A connected camera, a smart plug, a printer, a thermostat and a network-attached storage box have one thing in common: each is a small computer on your network that nobody thinks of as a computer. That is the whole problem. The fixes are not exotic. They are the same basics that apply to any computer, applied to devices that make them easy to skip, and they are the core of the IoT security best practices this site keeps returning to.

Why IoT devices are a soft target

Three properties make these devices attractive. They ship with defaults: a known administrator account, a known password, services switched on that most owners never use. They are rarely updated, because the update needs a person to open an app they forgot they had, or the manufacturer stopped issuing them. And they sit on the same network as everything else, for years, plugged in and forgotten.

An attacker does not need to be clever with a device like that. Automated scanning finds devices with open ports, tries the known default credentials, and logs in. Once inside, the device becomes a foothold: a place to scan the rest of the network from, a relay for traffic, a member of a botnet, or in the case of a camera or a microphone, a way to watch and listen. Large botnets have been built almost entirely from consumer devices with default passwords, as the Mirai example in the IoT vulnerabilities guide shows.

The good news is that the same three properties point at the fixes. Change the defaults. Keep the software current. Put the device where it cannot reach anything it should not.

Change every default password

Start with the device’s own administration login, the one you use in its web page or app. If the device shipped with a password printed on a label or in the manual, change it. If it shipped with no password, set one. Use a password manager so each device gets a long, unique password you never have to remember.

Then find the other logins. Many devices have more than one: a web interface, a separate service login, a maintenance or support account, sometimes a hidden account documented only in a forum. Look through every settings page and every account the manufacturer’s documentation mentions. Disable any account you do not use.

Wi-Fi credentials count too. A device that was set up with your main Wi-Fi password holds that password in its memory. If the device is compromised, so is the password. This is one of the reasons for putting devices on their own network, below, with a password that is not shared with anything you care about.

Where a device offers two-factor authentication for its cloud account, turn it on. The cloud account is often the easier target: a password reused from a breached site is tried against every popular device service.

Keep firmware updated

Firmware is the software the device runs, and updates to it are how the manufacturer closes holes. Find the update setting. If the device can update itself automatically, turn that on. If it needs you to press a button in the app, put a reminder in your calendar and press it. If it needs you to download a file and upload it through a web page, do it now and again every few months.

Then check the manufacturer’s support page for the model and note when it last had an update. A device that has had none in years is unlikely to get one when the next vulnerability appears. That does not mean binning it, but it does mean treating it as untrusted and containing it on the network.

Before buying anything new, look for a stated support period, a public list of past updates, and a clear way to receive them. The article on firmware updates explains what a good update mechanism looks like and which questions to ask a vendor.

Turn off what you do not use

Every service a device runs is a door. Most devices open several by default: a web administration page, a remote access feature, an old file-sharing protocol, a universal plug-and-play (UPnP) service that asks your router to open ports to the internet, a telnet or SSH server, a debugging port. You use perhaps one of these.

Go through the settings and switch off anything you do not need. Two deserve special attention. Universal Plug and Play on the router lets any device on the network open holes in your firewall without asking you; turn it off on the router and add port forwards by hand for the rare case that needs one. And remote access features, which let you reach the device from the internet, are worth disabling in favor of a VPN into the house, as described in the local smart home article.

If a device cannot turn a service off, the network can do it for it: a firewall rule that blocks that port from everywhere except your own computer.

A quick way to see what a device is running is to scan it from a laptop on the same network with a port scanner, which lists every port the device answers on. Compare that list with the services you switched off. A port that is still open after you disabled its service is either a setting that did not take, or a service the manufacturer does not let you control, and either way it belongs in your notes and behind a firewall rule. Repeat the scan after a firmware update, because updates sometimes turn services back on.

Segment the network

Segmentation is the fix that works even when a device is compromised anyway. Put every IoT device on its own network, separate from the laptops, phones and anything holding data you care about, with a firewall between the two that lets your devices reach the IoT network and stops the IoT network reaching back.

On a home router that means a VLAN if it supports them, or a guest network if it does not, provided the guest network genuinely isolates clients. On a small office network it means a VLAN and a set of firewall rules, which the VLAN article sets out step by step.

The rules to aim for are simple. The main network can open connections to the IoT network, so your phone can control the lights. The IoT network cannot open connections to the main network, so a compromised plug cannot reach your laptop. And the IoT network’s access to the internet is limited to what each device actually needs, which for many devices is nothing.

A short IoT device security checklist

Work through this for every device you own, and again for every device you buy. Two published baselines say the same things in more formal language and are worth knowing if you buy for an organization: NIST’s core baseline for IoT device cybersecurity (NIST IR 8259A, with the manufacturer activities in NIST IR 8259 Rev. 1) and ETSI EN 303 645, the European consumer IoT security standard. The IoT security standards guide explains both, and the laws in the US, UK and EU that build on them.

1. Change the administrator password to a long, unique one stored in a password manager. Check for additional accounts and disable them.
2. Turn on automatic updates where they exist. Where they do not, note the update procedure and a date to repeat it.
3. Check the last firmware date on the manufacturer’s page. No updates in years means contain the device and plan its replacement.
4. Disable services you do not use: remote access, telnet, SSH, file sharing, debugging ports. Turn off Universal Plug and Play on the router.
5. Put the device on the IoT network, with the firewall rules above.
6. Block its internet access, then unblock only what it needs. Watch the firewall log for a day to see what it tries to reach.
7. Turn on two-factor authentication on any cloud account tied to the device.
8. Record the device: model, firmware version, where it is, what it may reach. A list you can review beats a memory you cannot.

None of these takes long, and together they remove almost all of what makes these devices easy to attack. The device that fails a step is the one that gets a stricter network rule until it can be replaced.