Overview

While many have come to rely on Internet of Things (IoT) devices for added efficiency and convenience, these devices are also entry points that cybercriminals can use to compromise your security and privacy. 

We can all take steps to secure the smart devices and appliances connected to our home network, each other, and the Internet. Review the actions below to establish proper management and security of your IoT devices and protect your personal data.

Do Your Homework First

Before buying something, consider researching the device's security options and understanding which features you need and which you can turn off.  For example: Does your fridge really need to be connected to the Internet? Do you want copies of your doorbell’s videos automatically saved to the cloud? Other things to look for are:

• How easy is it to change the default password?  A red flag is if devices don’t allow you to change the default password, because this is a basic security measure.

• Does the manufacturer talk about security on their website?

• Do any of the reviews discuss the security features or shortcomings?

• What benefits do you get if you connect the device to the Internet?

• Avoid devices with Peer-to-Peer (P2P) capabilities – they are particularly vulnerable and hard to secure.

Set a New Password

Generally, manufacturers program the same username and password into every device they sell.  This means that if you keep the default password for your IoT device, anyone with access to Google can look it up. So, step 1 is to change the password to a more complex one. Be sure to follow passphrase requirements if your device stores or accesses any University data.

Set Up Multi-Factor Authentication

Most devices require an online account to set up, access, and manage them. If Multi-Factor Authentication (MFA) is available, you should use it. This is another layer of securing access to your IoT device and data.

Keep it Updated

Even the new gadget you’ve just unwrapped could have out-of-date software, so one of the first things you should do is check for updates.  You can usually do that in its user interface or website; it might even be part of the setup process. 

Then you need to keep it up to date.  Some devices automatically update (set that as the default if you can), others will tell you when there are new updates - which you should install right away.  If it doesn’t do either of those things, check for updates at least every 3 months (more frequently when security really matters, like a smart door lock, doorbell camera, or wireless router).  Also, if the device is doing something unexpected, or if your entire internet connection regularly slows down for no reason, that might be a sign of a security problem.  Try taking the device off the network and see if that helps with the problem. If it’s still acting unexpectedly, check for updates, then try resetting it.

Turn Off Unused Features

To make setup easier, many devices come with features that are turned on by default. But do you want or intend to use all these features? If not, consider turning them off to limit your device’s possible avenues of entry for an attacker (aka attack surface). 

Secure Your Router

Securing your home router is one of the most important steps to having a secure home network. Visit our Securing Home Wi-Fi article for more information.

Devices On Campus

Keep in mind that any device you connect to the campus network must meet campus security requirements. This includes personal IoT devices. Some departments also restrict what can be connected to their network, so check with your department’s IT before connecting any personal IoT devices to the internal network. Finally, if you’re looking to purchase a new device for your department, work with your IT and Procurement Offices to ensure it meets campus security requirements. And be sure to establish clear guidelines on who is responsible for keeping the device up to date and secure.

Devices and Research

IoT devices, from smart watches to internet-enabled blood pressure monitors, can contribute valuable data to research. However, there’s potentially a lot of risk involved in using IoT devices to collect health data -- or sensitive information of any kind.  Make sure to talk with the IRB and OPHS as early as possible in your planning process.

Devices and HIPAA

Your smart speaker is always listening, so it’s not appropriate to have these devices in areas where privacy is expected. Also, don’t have private conversations or talk about any research subjects within its range.  Similarly, any devices that may come into contact with personally identifiable information will need extra security measures (and possibly special contract language) in place.  For more information on HIPAA-compliant device use, contact: security@berkeley.edu.

Additional Resources:

• Securing the Internet of Things (IoT) (U.S. Cybersecurity & Infrastructure Security Agency, February 2021)

• Smart Home Devices: Lock Them Down Before Cyber Criminals Do (Jan 2025 SANS Ouch! Newsletter)

• Router Passwords is officially the most up-to-date default router password repository on the internet. To find your router's default password, select the manufacturer from the drop-down menu and click the Find Password Button. https://www.routerpasswords.com/ 

-Co-authored by Andrea McColl, UCLA, and Ronise Zenon, UC San Diego