IoT security for small business: ten practical steps

What is IoT security?

IoT stands for the Internet of Things: everyday devices that connect to a network and the internet, such as security cameras, printers, smart TVs, door controllers, sensors and Wi-Fi access points. IoT security is the practice of keeping those devices from becoming a way into your business.

Most of these devices are not computers in the traditional sense, so they are easy to forget when you plan your protection.

Why do connected devices put a business at risk?

Many connected devices are built to be cheap and simple, and security is often an afterthought. They may ship with weak default passwords, receive few updates and offer little visibility into what they are doing.

Once an attacker controls one, they may use it to watch your network, steal data, move to more valuable systems, or attack other targets. The device itself may be unimportant, but the access it provides is not.

What are the common IoT weaknesses?

The most frequent problems are easy to fix once you know about them:

• Default or shared passwords that are never changed.
• Old firmware that never receives security updates.
• Devices placed on the same network as business computers and servers.
• Remote access features left switched on without being used.
• Devices nobody remembers installing, or that were set up by a supplier and never documented.

Step 1: Do you know which devices are connected?

You cannot protect what you cannot see. Make a list of every connected device, where it is, who manages it and what it does.

Check your router or access point for connected devices and compare it with your list. Anything you do not recognise deserves a closer look.

Step 2: Have you changed every default password?

Default usernames and passwords are widely known and are tried automatically by attackers. Change them on every device as soon as it is installed.

Use a different, long password for each one, and store them in a business password manager. Our guide to managing your passwords like a pro explains how to do this without making work harder for staff.

Step 3: Are devices on a separate network?

Place connected devices on their own network segment, apart from staff computers, servers and financial systems. If one is compromised, the attacker is boxed in.

Most business-grade routers and access points support separate networks or VLANs. This is one of the most effective single steps for reducing risk, and it is a task for your IT provider if you are not sure how to set it up.

Step 4: Is firmware kept up to date?

Manufacturers release updates to fix security flaws. Install them promptly, and enable automatic updates where the device supports them.

Before buying new devices, check whether the manufacturer still provides updates. A device that no longer receives security fixes should be replaced rather than left on your network.

Step 5: Have you turned off features you do not use?

Every active feature is another possible way in. Disable remote access, voice control, Bluetooth, file sharing and cloud connections if you do not need them.

If a supplier needs remote access for support, switch it on only for the duration of the work, and make sure it is protected by strong authentication.

Step 6: Is your Wi-Fi properly secured?

Use a current encryption standard on your Wi-Fi, such as WPA2 or newer, and avoid older standards that are easy to break. Choose a long passphrase and change it when staff or contractors leave.

Provide a separate guest network for visitors, and do not give guests access to the business network. Rename the default network name so it does not reveal the router model or your business details.

Step 7: Is multi-factor authentication enabled where possible?

For devices and management portals that support it, turn on multi-factor authentication. This applies particularly to cloud-managed cameras, access control systems and network equipment.

If a management portal offers only a username and password, treat that as a risk and keep it off the open internet where you can.

Step 8: Do you review privacy settings and data handling?

Some devices collect and send data to the manufacturer, including images, audio and usage details. Review the privacy settings and read how the supplier handles that data before deployment.

This matters most for cameras, microphones and anything used in meeting rooms. If personal information is involved, your privacy obligations apply.

Step 9: How do you handle remote and home devices?

When staff work from home, their smart speakers, TVs and other gadgets share a network with a work laptop. You cannot control those devices, so protect the laptop itself with up-to-date software, encryption and a secure connection.

Our guide to cyber security for remote workers covers what to ask staff to do.

Step 10: Do you monitor and review regularly?

Set a regular review, at least a few times a year, to check the device list, passwords, firmware and network separation. Remove devices that are no longer used.

Monitoring helps too. Unusual traffic from a printer or camera at three in the morning is the kind of signal that managed monitoring can pick up.

How does this fit with your wider security?

IoT security is one part of a layered approach. Devices sit within your network, and the network sits within your wider controls such as patching, access and backups. Our guide on layered cyber security shows how the pieces fit together.

How can Fast Response IT help?

Fast Response IT provides network management and cyber security for small and medium businesses in Sydney, including device inventories, network separation, firmware management and monitoring.

If you are not sure what is connected to your network, the IT health check is a good place to start.