Smart Home Security
Secure your IoT devices, cameras, and smart speakers with proper segmentation and privacy practices.
Why Your Smart Devices Are the Weakest Link
The average smart home now contains 20-30 connected devices: smart speakers, cameras, doorbells, thermostats, light bulbs, locks, plugs, robot vacuums, appliances, and more. Each one is a computer connected to your network — and most of them have the security of a 2005-era desktop.
Why IoT Devices Are Uniquely Vulnerable
Cheap hardware, minimal security investment. The smart plug you bought for $12 runs on a microcontroller that costs the manufacturer about $1.50. The profit margin doesn't leave room for a security team, code audits, or ongoing firmware development.
Long lifespans, short support windows. Your smart thermostat might work fine for 10 years, but the manufacturer may stop issuing security updates after 2-3 years. An unpatched device with a known vulnerability is an open door on your network.
Always on, always listening, always connected. Unlike your laptop (which you close and carry with you), IoT devices are permanently powered and permanently connected. A compromised device operates 24/7 without your knowledge.
Weak or hardcoded credentials. Many IoT devices ship with default passwords like admin/admin or admin/1234. Some have hardcoded credentials that cannot be changed — the username and password are baked into the firmware.
Minimal user interfaces. Most IoT devices have no screen and limited apps, making it hard to check for updates, review security settings, or detect unusual behavior.
Real-World IoT Attacks
Mirai Botnet (2016): Malware that scanned the internet for IoT devices with default credentials. It compromised over 600,000 devices (mostly cameras and DVRs) and used them to launch the largest DDoS attack in history, taking down Twitter, Netflix, Reddit, and GitHub.
Ring Camera Breaches (2019-2020): Attackers used credentials from data breaches to access Ring cameras inside people's homes. They harassed children through the camera speakers and livestreamed private footage.
Robot Vacuum Spying (2024): Researchers demonstrated that certain robot vacuums could be remotely compromised, allowing attackers to access the onboard camera and microphone — turning a vacuum into a roaming surveillance device.
Smart Lock Vulnerabilities (ongoing): Multiple smart lock brands have been found to have Bluetooth vulnerabilities that allow attackers within physical range to unlock doors without authorization.
The Core Problem: Your Network Is Flat
Most home networks put all devices on the same network segment. That means your smart light bulb — running firmware from 2022 with a known vulnerability — can directly communicate with your work laptop containing sensitive documents.
If an attacker compromises any IoT device, they can:
- Scan your network to find other devices
- Intercept traffic from computers on the same network
- Pivot to more valuable targets like your laptop or NAS
- Exfiltrate data using the device's existing internet connection
- Join a botnet and use your internet connection to attack other targets
The Solution: Defense in Depth
Securing a smart home requires multiple layers:
- Network segmentation — Isolate IoT devices from your trusted devices
- Device selection — Choose devices from security-conscious manufacturers
- Configuration hardening — Change defaults, update firmware, disable unnecessary features
- Monitoring — Watch for unusual device behavior
- Lifecycle management — Replace devices when they stop receiving updates
We'll cover each of these in the following lessons.