Securing the Connected Home
The average home now runs more networked computers than a 1990s small business: cameras, TVs, doorbells, speakers, thermostats, plugs, vacuum robots, sometimes the washing machine. Each is a full computer with a network stack, a cloud account, and a firmware team of unknown ambition. You are, whether you enjoy it or not, the administrator of a small enterprise. Administer it like one — it takes an afternoon.
Why anyone would hack a lightbulb
Nobody wants your lightbulb. They want what it's connected to: a foothold inside your network to reach real devices, a residential IP to launder traffic through, a node for a botnet, or — for cameras and microphones — your actual home life. IoT devices are targeted precisely because they're numerous, unpatched, and forgotten.
The five-step pass
1. Start at the router
Everything flows through it, so harden it first: change default admin credentials, update firmware, disable WPS and remote administration, use WPA3 or WPA2 with a long passphrase. Full detail in the Wi-Fi guide.
2. Segment: gadgets on the guest network
The single highest-value move in home security. Put every IoT device on the guest network (or an IoT VLAN if your gear speaks that language), isolated from laptops and phones. When the discount camera turns hostile, it finds itself alone in a room with other appliances instead of beside your tax documents. Client isolation on, if the router offers it.
3. Change every default password
Default credentials are public knowledge — literally scripted into scanning tools. Any device with an admin page or cloud account gets a unique generated password in your password manager, and MFA on the cloud account if offered. Cameras first: they are the devices with eyes.
4. Update, or admit it's abandoned
Enable auto-update on everything that supports it. Twice a year, check the stragglers. A device whose manufacturer stopped shipping security updates — or went out of business — is not vintage, it is unguarded. Replace it or wall it off.
5. Buy like an administrator
Before the next gadget: does the vendor publish security updates, and for how long? Does it work without a cloud account? Is the company likely to exist in five years? A no-name camera that's $20 cheaper is subsidized by someone — usually your network.
Cameras and microphones, specifically
- Point cameras at entry points, not living spaces. What the camera can't see can't leak.
- MFA on the camera cloud account is non-negotiable — most "camera hacks" are just credential stuffing against reused passwords.
- Know your mute switches, and use the physical ones; software mute is a promise, hardware mute is a fact.
Stop plugging in and forgetting. Think of every gadget as an employee with a network badge. Connect them in their own room, not yours.