How to Secure IoT Devices: Segmentation, Updates and Defaults

A smart plug is a small computer running Linux, permanently connected to your network, built to a price, and updated at the manufacturer's discretion for as long as they feel like it. So is a camera, a doorbell, a television, a printer, a robot vacuum and a thermostat. A typical household now runs a dozen of these next to the laptop with the work files on it.

The realistic threat is not that someone cares about your lighting. It is that a device with an unpatched flaw and no security team behind it becomes the foothold on a network where everything else lives, or that a camera account with a reused password gets taken over.

This guide covers the controls in order of value, which is roughly: fix the credentials, close the inbound paths, separate the network, keep the firmware current, and stop buying things that will be abandoned.

Scope: How to Secure Your WiFi Network owns the wireless configuration, Network Segmentation Guide owns segmentation at organisational scale, and DDoS Attacks Explained owns what compromised device fleets are used for. This page owns the devices.

Why the category is the way it is

Three structural facts, and every control below follows from them.

The margin is tiny. A cheap device is often a reference design from a component vendor with a brand on the box. The firmware is whatever came with it, and nobody employed by the seller has read it.

The lifetime is long and the support is short. People replace a doorbell when it breaks, which may be a decade. Vendors ship security updates for a few years at best, and frequently stop when the model is discontinued or the company is acquired.

Nobody is watching. A compromised laptop behaves oddly and someone notices. A compromised light switch keeps switching lights, and there is no screen, no log anyone reads, and no antivirus.

The Mirai botnet of 2016 is the canonical demonstration. It did nothing clever: it scanned the internet for devices with telnet open and tried a list of default username and password pairs. That was sufficient to assemble a botnet large enough to take down significant parts of the internet's infrastructure. The lesson generalises past telnet. Anything reachable from the internet with a known credential is found by automated scanning in hours.

1. Credentials and accounts

Change every default password before the device is on the network for real. Default credentials are published in the manual, which is on the internet.

Use a unique password per device and per vendor account. A password manager holds them, as covered in Password Managers Guide.

Turn on two-factor authentication for the vendor account. This matters more than the device's own firmware for anything with a camera or microphone, because the common compromise route is account takeover using credentials reused from a breach elsewhere, not exploitation of the device. The attacker signs in to the app exactly as you would.

Check who else has access. Shared users from a previous household member, an installer's account, a support account you granted during a troubleshooting call. Review the list on anything that has one.

Register the device with an email address you control, rather than one belonging to whoever set it up.

2. Close the inbound paths

Almost no home device needs to be reachable from the internet. Most that appear to need it use an outbound connection to the vendor's cloud, which is a different and much safer arrangement.

Turn off UPnP on the router. It exists so a device can ask the router to open an inbound port to itself, automatically and silently. That is a useful capability for a games console and an ideal one for malware, and it has repeatedly exposed services the owner believed were internal.

Remove port forwarding rules you do not recognise. Then check the ones you do recognise are still needed.

Do not expose a camera or a recorder directly. Search engines that index internet-connected devices are full of exposed cameras, and the exposure is almost always a forwarded port plus a weak password.

Prefer the vendor's outbound relay to opening a port, and prefer a local-only setup to both where it exists.

3. Segment the network

This is the control that decides what a compromise costs you.

The goal: IoT devices can reach the internet, and cannot reach your computers, your phones, your file storage or your backups.

The simple version. Put every smart device on the router's guest network and everything personal on the main one. Most guest networks isolate clients from the main network by default. Confirm that setting rather than assuming it, and check whether the guest network also isolates devices from each other, which breaks some smart home features.

The better version. A separate VLAN with firewall rules: IoT to internet allowed, IoT to trusted network denied, trusted network to IoT allowed for control. This requires a router or access point that supports VLANs, which now includes many consumer models and every prosumer one.

The complication. Some smart home ecosystems rely on discovery protocols that do not cross networks, so a phone on the trusted network cannot find a speaker on the IoT network. The fixes are an mDNS reflector or proxy on the router, allowing specific discovery traffic in the firewall rule, or using a hub that bridges the two deliberately. Plan for this before moving forty devices at once.

4. Keep firmware current, and know when to stop

Turn on automatic updates where the device offers them. Most now do.

Check manually for the ones that do not, on a schedule you will actually keep. Twice a year covers most of it.

Find out the support period. UK law now requires manufacturers to state how long a product will receive security updates and bans universal default passwords, so that information is published for products sold there and is a reasonable signal anywhere. The EU's Cyber Resilience Act adds similar obligations for the European market.

Retire abandoned devices. A device out of support with a known flaw is not made safe by configuration. It keeps working perfectly, which is exactly why people keep it. If replacement is not possible, isolate it as strictly as the setup allows and remove any inbound reachability.

5. Reduce what each device does

Every feature is attack surface and most are unused.

• Turn off remote access if you only use the device at home.
• Turn off cloud recording for a camera if local storage covers your need.
• Disable microphones on devices that have one and do not need it.
• Disable telnet, SSH and web administration where the interface offers the choice.
• Turn off the smart features on a television you use as a display, and check what it reports back, because automatic content recognition on many models tracks what is on screen.
• Disable data sharing and analytics in the app.

6. Watch the network, lightly

You do not need a security operations centre for a house.

• Look at the router's client list occasionally and confirm you recognise everything on it.
• Use a filtering DNS resolver for the whole network. It blocks a category of malware communication and shows you which devices are talking to what, which is often the first sign that a television is chattier than expected.
• Notice devices that behave differently: a plug that suddenly moves a lot of data, a camera that is busy at 3am.

Buying decisions

The cheapest time to fix IoT security is before purchase.

• Does the vendor publish a security page, a contact for reporting vulnerabilities, and a support period? A company that has never thought about it does not have those.
• Does the device work locally, or does it become a paperweight when the vendor's servers are down? Local control is better for reliability, privacy and longevity all at once.
• Does it support a standard such as Matter, which reduces the dependence on one company's continued interest in the product?
• Is there a track record? Search the brand with the word "vulnerability" before buying.
• Do you need it to be smart at all? A dumb device with no network stack has no firmware to patch, no account to be taken over, and no vendor to go out of business. This is a serious question rather than a joke, and applying it to two or three purchases removes more risk than configuring the other ten.

A weekend plan

For a home with a typical assortment:

1. List what is on the network. The router's client list, plus anything you know is connected. Expect to find something you forgot.
2. Change default passwords and enable two-factor on every vendor account.
3. Turn off UPnP, and review port forwarding rules.
4. Set up the guest network and move the smart devices onto it, starting with the ones that do not need to talk to your phone.
5. Update firmware on everything, and note which devices offer no updates at all.
6. Turn off unused features, particularly remote access and microphones.
7. Write down the abandoned devices and decide which get replaced this year.

The verdict

The controls that matter for IoT are the same four in every case: credentials that are not defaults or reused, no inbound path from the internet, a network segment that limits what a compromise reaches, and firmware that is still maintained.

Segmentation is the one to do first, because it is the only control that keeps working when one of the others fails. A compromised device on a network of its own is an annoyance. The same device beside your laptop and your backups is an incident.

Related guides

• How to Secure Your WiFi Network
• Network Segmentation Guide
• Bluetooth Security Explained
• DDoS Attacks Explained
• Phone Privacy Hardening