IoT Device Security: How to Harden Your Connected Devices and Network

IoT device security starts at the router: change default credentials, isolate devices on a guest network, enable firmware auto-updates, and disable unused remote access.

By Priya Anand

May 21, 2026

IoT device security is a practice that protects internet-connected hardware from unauthorized access, firmware exploits, and network intrusion. The average smart home network now carries dozens of these endpoints, from thermostats and door cameras to smart speakers and connected appliances, and every one of them widens the perimeter an attacker can probe. Manufacturers ship devices quickly and patch them slowly, which means the security burden falls largely on the owner. A structured hardening routine changes that equation.

Why IoT Device Security Is Uniquely Difficult

IoT device security is uniquely difficult because every device you add to your home network expands your attack surface, and most ship with default credentials and minimal hardening. The Internet of Things (IoT) category spans hundreds of product classes built by thousands of vendors, each with different firmware architectures, update cadences, and support windows. Unlike a laptop or phone, the typical smart sensor or camera has no screen, no obvious management interface, and no notification when a patch becomes available. Owners often forget these devices exist until something goes wrong.

The default password problem compounds the risk. Many IoT products ship with shared credentials, such as admin/admin or admin/1234, that are published in manufacturer manuals and indexed on the open web. CISA has documented how attackers scan for these devices at scale, using automated tools to test known default credential pairs across large IP ranges (CISA: Securing the Internet of Things). A device sitting on an open port with a default password can be compromised in minutes. For more context on the protocols and ecosystems that govern these devices, the understanding smart home technology overview covers how device classes connect and communicate.

Start With the Router: Your Network Security Gateway

The FTC identifies your router as the key to privacy in any IoT-connected home because it is the single control point for all device traffic. Router configuration is where most IoT device security improvements begin, and most home owners never move beyond the factory defaults. The router configuration steps below apply to consumer routers from most major vendors; the exact menu labels vary by firmware, but the settings themselves are standard.

Change the admin username and password. The router's management interface ships with a default password (often printed on the device label) that is trivially guessable. Replace it with a randomly generated, unique credential and store it in a password manager.
Change the network name (SSID). The factory SSID often reveals the router model, which helps attackers target known firmware vulnerabilities. Use a neutral, non-identifying name.
Enable WPA3 encryption. If your router supports it, select WPA3 for your primary network. If WPA3 is unavailable, WPA2-AES is the minimum acceptable configuration. Avoid WEP and WPA-TKIP entirely.
Enable the built-in firewall. Most consumer routers include a basic stateful firewall. Confirm it is active in the security settings. The FTC recommends this as a baseline step for all home networks (FTC: Securing Your Internet-Connected Devices at Home).
Disable remote management. Remote management access to your router's admin panel exposes it to the wider internet. Disable it unless you have a specific, ongoing need for it.
Set up two-factor authentication (2FA). Some router firmware supports two-factor authentication for the admin console. Enable it where available; it blocks credential-stuffing attacks even if your password is leaked.

Background on the smart home hub protocols that sit between your router and individual devices is available in the smart home hub protocols including Matter, Zigbee, and Z-Wave guide, which covers how traffic flows between coordinator devices and the router.

Network Segmentation: Isolating IoT Devices

Card showing Network Segmentation for IoT Device Security: separate subnet, guest network and IoT VLAN

Network segmentation is a core IoT device security control that places your devices on a separate subnet or guest network so that a compromised smart bulb cannot reach your laptop or NAS drive. This is the most structurally effective approach available to home users, because it limits lateral movement even when a device is fully compromised. An attacker who gains control of a thermostat on an isolated segment cannot pivot to banking credentials stored on a PC sitting on the main subnet.

Most consumer routers include a guest network feature that creates a second Wi-Fi SSID with its own isolated segment. Placing all devices on a dedicated IoT smart home network achieves basic network segmentation without additional hardware. The defense-in-depth principle behind this approach is straightforward: no single point of failure should expose the entire network. NIST's IoT cybersecurity guidance for consumer devices reinforces this layered architecture, recommending that device categories with different trust levels operate on separate network segments (NIST IR 8425A: IoT Cybersecurity Recommendations for Consumer Devices).

Create a dedicated IoT SSID. In your router's wireless settings, add a second network named something like "Home-IoT" and assign it to the guest network or a dedicated VLAN if your router supports it.
Connect all smart devices to that network. Migrate every camera, thermostat, speaker, bulb, and appliance off the primary SSID and onto the IoT segment.
Keep computers, phones, and tablets on the primary network. These carry your most sensitive data and should remain isolated from the IoT segment.
Verify inter-segment blocking. Log into your router and confirm that guest network clients cannot initiate connections to primary network clients. Most routers block this by default, but verify the setting explicitly.

Firmware Updates and Patch Management

Applying firmware updates promptly is one of the most effective IoT device security controls because manufacturers release patches specifically to close exploited vulnerabilities. The gap between a firmware vulnerability becoming public and the majority of deployed devices receiving a patch can stretch to months or years, giving attackers a large window. Devices that support secure over-the-air updates (OTA updates) can close that window automatically, but only if the feature is enabled.

Strong Credentials and Two-Factor Authentication

Replacing factory default credentials with unique, strong passwords is the single highest-impact step in consumer IoT device security. A default password left unchanged is an open door: it is printed in manuals, searchable online, and exploited by automated scanners within hours of a device going online. Strong credential hygiene closes that door without requiring any specialized knowledge or hardware.

Change every default password immediately after setup. This applies to the device itself, its companion app account, and any associated cloud service account. Use a unique password for each; do not reuse credentials across devices or services.
Use a password manager. A password manager generates and stores random credentials, eliminating the temptation to reuse or simplify passwords. Most support mobile and desktop apps and browser extensions.
Enable two-factor authentication on every account. 2FA (two-factor authentication) adds a verification step that an attacker cannot complete with stolen credentials alone. Prefer an authenticator app over SMS codes, because SMS is vulnerable to SIM-swap attacks.
Audit your device list periodically. Remove accounts for devices you no longer own and revoke app permissions that are no longer needed. Orphaned credentials expand your attack surface without providing any ongoing benefit.

Limit Connectivity and Disable Unused Features

CISA recommends evaluating whether continuous internet connectivity is actually needed for each device, because unnecessary exposure multiplies your attack surface. A connected device that serves no function from the cloud is simply an extra target. Disabling unused features, protocols, and remote management access is a direct way to reduce that target area without degrading the device's primary function (CISA: Securing New Internet-Connected Devices).

Disable remote management on devices that do not need to be accessed from outside the home network. Many cameras, thermostats, and routers enable remote management by default; turn it off if you control the device only from within your home.
Turn off Bluetooth and Zigbee radios on devices where those protocols are unused. Each active radio is an additional entry point.
Disable UPnP (Universal Plug and Play) on your router. UPnP allows devices to automatically open ports in your firewall, which can be exploited by malicious software running on a compromised device.
Power off or unplug devices that are not in regular use. An offline device cannot be attacked. Older devices with expired firmware update support are best disconnected entirely.

IoT Security Standards and Certifications to Look For

Industry standards from the Connectivity Standards Alliance apply a defense-in-depth principle covering device-unique authentication, secure OTA updates, and replay-attack prevention. When purchasing smart home network devices, looking for compliance with recognized standards reduces the risk of buying a product designed with IoT security as an afterthought. The following programs are worth checking at the point of purchase.

Matter (Connectivity Standards Alliance): A unified smart home protocol requiring device-unique certificates, encrypted commissioning, and mandatory secure over-the-air firmware update support. Matter devices must pass conformance testing administered by the CSA before they can carry the logo (CSA: Matter Smart Home Standard).
NIST Cybersecurity for IoT Consumer Devices (NIST IR 8425A): A federal framework that defines baseline technical cybersecurity capabilities for consumer IoT products, including device identity management, software update mechanisms, and configuration management. Vendors who align their products to this guidance indicate a structured approach to IoT security that goes beyond marketing claims (NIST: IoT Cybersecurity for Consumer Devices).
CSA Security Working Group Resources: The Connectivity Standards Alliance maintains security guidance covering the defense-in-depth architecture behind protocols like Matter, including threat modeling, key provisioning, and credential rotation requirements (CSA: IoT Security Resources).
FCC Cyber Trust Mark: A voluntary US labeling program for consumer IoT products that meet baseline security criteria, including unique default passwords, a firmware update mechanism, and a published support period. Devices carrying the label have been tested against a defined set of requirements, providing a quick signal for buyers who lack the time to audit vendor documentation independently.

Additional background on smart home technology standards and the broader ecosystem is in the smart home technology standards and ecosystems guide, which covers how protocols such as Matter and Zigbee relate to one another at the network layer.

Frequently Asked Questions

What are the most common security risks in IoT devices?

Weak default passwords and unpatched firmware are the two most common attack vectors on IoT devices. CISA notes that default passwords are easily found online and provide no real protection, so changing them immediately after setup is essential. Outdated software is equally risky because manufacturers release patches specifically to close known vulnerabilities. Disabling features you do not use further reduces the device attack surface.

How do I configure my router to protect IoT devices?

Start by changing the default administrative username, password, and network name to something unique on your router. The FTC recommends enabling your router firewall and setting up a separate guest network to isolate IoT devices from computers and phones that hold sensitive data. Disable remote management unless you actively need it, and enable WPA3 encryption or the strongest available encryption mode.

Why is firmware update support important when buying an IoT device?

Manufacturers release firmware updates to patch security vulnerabilities discovered after a device ships. A device that no longer receives updates is permanently exposed to any vulnerability found after its support window ends. The FTC has flagged that smart device software support timelines are often unclear, so checking a vendor's stated support period before purchase helps you avoid devices that become security liabilities within months.

Does every IoT device need to be connected to the internet at all times?

No. CISA explicitly recommends evaluating whether continuous internet connectivity is necessary for each device, because every internet-connected endpoint expands your attack surface. Devices such as local smart switches or offline sensors can often function without a persistent cloud connection. Disconnecting older devices you no longer actively use removes them as potential entry points entirely.

From techshooked

Deep dives Follow the wires. Where the power, the chips and the money go before a product ships. Read the deep divesRead deep dives

Priya Anand

Priya Anand edits techshooked's hardware and emerging-tech coverage, from laptops and peripherals to the gadgets at the edge of usefulness. Her standard is numbers-first: document the test conditions, report the results a spec sheet leaves out, and never call a device good on first impressions alone.