IoT Security: Protecting the Devices You Forgot About

IoT security is the security challenge of devices that weren't designed with security in mind. The cameras watching your office, the badge readers at the door, the smart thermostats, the building automation, the network printers, the IP phones — collectively they outnumber the computers on most business networks and individually they each have a security profile somewhere between "embarrassing" and "actively dangerous." Here's what IoT security looks like in practice and what controls actually move the needle.

The Specific IoT Problem

Why IoT devices are particularly hard to secure compared to laptops and servers:

• Limited or no patching mechanism — many IoT devices ship with firmware that's never updated
• Default credentials still factory settings on a substantial portion of deployed devices
• No EDR or endpoint protection — the device platforms don't accept security agents
• Limited visibility — IT often doesn't know what IoT devices are on the network or what they're doing
• Indirect access — IoT devices often connect to cloud services with broad permissions, creating attack paths that traditional perimeter controls miss
• Long deployment lifecycles — devices stay in place for years after their software stops being maintained
• Diverse vendor ecosystem — managing security across dozens of small IoT vendors is operationally difficult

The Realistic Defensive Approach

Because direct hardening of IoT devices is often impossible, IoT security depends primarily on architecture rather than device-level controls:

• Network segmentation — IoT devices on dedicated network segments separated from user and server networks. Default-deny between IoT and corporate, with explicit allow rules for legitimate communication.
• Outbound traffic restrictions — IoT devices can only reach the specific cloud services they need. Block everything else at the firewall.
• Discovery and inventory — knowing what IoT devices are on the network is the prerequisite for managing them. Tools like Forescout, Armis, or native discovery in cloud-managed network platforms identify and profile IoT devices.
• Default credential remediation — every IoT device should have its default credentials changed at deployment. Many don't.
• Vendor patching when available — for the IoT devices that do support firmware updates, those updates should be applied on schedule
• End-of-life device replacement — devices whose vendors no longer provide security updates should be replaced rather than left in place
• Traffic monitoring — unusual outbound traffic from IoT devices indicates compromise; baseline behavior and alert on deviation

The Highest-Risk IoT Categories

Not all IoT is equally risky. The highest-risk categories at most businesses:

• IP cameras and surveillance systems — frequently compromised, often deployed with default credentials, with broad network access
• Building automation and access control — directly tied to physical security; compromise produces high-impact outcomes
• VoIP phones with extra capabilities — speakerphones, cameras, integrated systems that go beyond just voice
• Network printers — often have administrative interfaces accessible from the network with weak authentication, and can be used as pivot points
• Smart conference room equipment — displays, control systems, audio gear that can become listening devices if compromised
• HVAC and environmental controls — the Target breach started through HVAC vendor access; the pattern repeats
• BYOD smart devices — employee personal IoT (smartwatches, fitness trackers) connecting to corporate Wi-Fi

The Compliance Implications

For businesses in regulated industries, IoT security has specific compliance implications. HIPAA-covered entities need to consider whether IoT devices on their network can access or affect ePHI. PCI environments need to verify that IoT devices aren't in scope or that they're appropriately controlled. CMMC requirements explicitly address asset inventory and access controls that apply to IoT.

For unregulated businesses, the compliance pressure is less explicit but still real — cyber insurance underwriters increasingly ask about IoT inventory and network segmentation during application reviews.

Where to Start

For SMBs without a current IoT security program, the priority sequence: inventory IoT devices on the network (often surprising in scope), verify they're on a separate network segment from user and server traffic, change default credentials on every device that supports it, configure outbound traffic restrictions at the firewall to limit what each device class can reach, and identify devices past end-of-life that need replacement. These steps don't require enterprise IoT security platforms; they require operational discipline. A free assessment can scope IoT security improvements for your environment.