Security cameras, video doorbells, voice assistants, TVs, robot vacuums, thermostats, smart plugs and bulbs. A modern home can have dozens of connected devices, often more than its computers and phones put together. They're convenient, but each one is a small computer on the network, running software that someone has to keep secure. This is the area known as the Internet of Things, IoT.
Why smart devices are a particular risk
- They get forgotten: once installed, nobody looks at them for years.
- Updates are irregular: some manufacturers release them for a long time, others stop early or never planned for them.
- They have limited interfaces: with no screen or keyboard, it's hard to notice when something is wrong.
- They collect sensitive data: images of the inside of your home, audio, habits, the times you're away.
- They sit on the same network as your computers: a vulnerable device can become a foothold for reaching the others.
Compromised devices can be used for spying, but also, without your knowledge, to take part in attacks against other systems on the internet.
Before you buy
Security starts in the shop:
- Choose manufacturers that state how long they'll provide security updates and that have a page dedicated to product security.
- Be wary of unbranded devices or unknown brands sold very cheaply: the apps are often poor and support non-existent.
- Check what the device needs to work: some only work through the manufacturer's cloud, others locally too. If the manufacturer shuts the service down, the first kind may stop working.
- Ask whether you really need the connection: an appliance that doesn't need the internet to do its job is one less device to protect.
Initial setup
- Change the default credentials of the device immediately and create an account with a unique password in the manufacturer's app.
- Turn on two-step verification for the app account, especially for cameras and locks: whoever gets into the account gets into your home.
- Update the firmware on first start-up and turn on automatic updates, if available.
- Turn off features you don't use: remote access, sharing with other users, the microphone on devices that don't need it.
- Review the privacy settings: stored voice recordings, data sharing with third parties, image analysis.
Isolate them from your main network
One of the most effective measures is to put smart devices on a separate network. The simplest solution is to use your router's guest network, if it isolates devices from the main network. More advanced routers let you create networks dedicated to IoT. That way, if a bulb or a camera is compromised, it can't reach the computer you use for online banking or the NAS with your family photos.
A caveat: some devices, such as speakers that receive music from your phone or TVs controlled by an app, need to be on the same network as the phone to work. In that case, decide case by case what to isolate.
Cameras: special attention
Cameras are the most sensitive devices, because they show the inside of your home:
- Don't install them in bedrooms and bathrooms unless it's truly necessary.
- Prefer models that let you turn off recording when you're home, automatically or on command.
- If the camera records to the cloud, check that the videos are encrypted and how long they're kept.
- Avoid opening ports on the router to view the camera from outside: use the official app or a VPN back to your home.
- Regularly check in the app who has access to the footage: family members, former flatmates, installers.
Voice assistants
Voice assistants listen while waiting for the wake word. You can reduce the risks by:
- using the microphone mute button when it isn't needed;
- reviewing and deleting the recording history from the app from time to time;
- turning off voice purchasing or protecting it with a code;
- limiting the commands that can unlock doors or disarm alarms.
When a device reaches end of life
If the manufacturer no longer releases updates, the device will stay vulnerable. Consider replacing it, or at least isolating it completely. Before selling or throwing it away, perform a factory reset and remove it from your account: otherwise the next owner could access data or features linked to you.
In short
- Every smart device is a small computer that needs updating and protecting.
- Choose manufacturers that commit to updates and change default credentials immediately.
- Protect the app account with a unique password and a second factor.
- Isolate IoT devices on a separate network where possible.
- Pay special attention to cameras and voice assistants, and reset devices before disposing of them.