IoT security basics: protecting devices, networks and data

IoT security means making sure only the right people and systems can read your devices' data or control them, and that a weak device cannot become a back door into the rest of your business. For a small business the basics cover most of the risk: replace default passwords, give each device its own credentials, encrypt the connection, keep firmware updated, put devices on a separate network, and limit what each device and person is allowed to do. None of this needs a large budget; it needs to be planned from the start.

Why small systems are at risk too

Most attacks on connected devices are not aimed at you personally. Automated programs scan the internet all day looking for anything that answers: a camera with its factory password, a router with remote admin left open, a test server nobody switched off. A temperature sensor may not seem worth stealing, but a compromised device can be used to send spam, attack other systems, or reach the office computer that sits on the same network. And a device that controls something, such as a pump or a fan, deserves even more care.

Layer one: the device

• No default passwords. Every device should have a unique password or key, set before it is installed.
• Close what is not needed. Debugging ports and test features that helped during development should be switched off in the finished product.
• Keep secrets safe. Wi-Fi passwords and server keys stored on the device should be protected, so someone who picks up a lost unit cannot easily copy them.
• Plan for updates. Bugs will be found. A safe way to update firmware, ideally remotely and with checks that the update is genuine, is part of security. See over-the-air firmware updates.
• Physical protection. A device in a field, a pond or a shared building can be opened, moved or taken. A locked enclosure and an alert when a device goes offline both help.

Layer two: the network

• Put IoT devices on their own Wi-Fi network, separate from the computers that hold your accounts and customer data.
• Change the router's admin password and turn off remote administration unless you truly need it.
• Avoid opening ports on the router so that outsiders can reach a device directly. Devices should connect outwards to a server you control, not wait for anyone on the internet to connect in.
• For devices on mobile data, ask your provider what options exist for keeping that traffic private, and keep a list of which SIM is in which device.

Layer three: the server, broker and dashboard

Data usually flows from devices to a message broker and then to a database and dashboard.

• Encrypt the connection with TLS, the same technology that protects websites, so readings and commands cannot be read or changed on the way.
• Authenticate every device separately. If one is lost, you can switch it off without changing every other device.
• Limit permissions. A sensor should only be able to send its own readings, never commands for other equipment. With MQTT this is done through access rules on topics.
• Protect dashboard logins with strong passwords and two-step verification where available.
• Keep backups and logs, so you can recover data and see who changed what.

Layer four: people and process

Technology fails less often than process. Common gaps:

• A shared login that former staff or old vendors still know.
• No list of which devices exist, where they are and who is responsible for them.
• Nobody assigned to apply updates or review access.

Keep a simple device register, remove access the day someone leaves, and agree in writing what access an outside developer keeps after the project ends. If your devices collect information about people, such as camera footage or staff location, read about IoT data ownership and privacy and take proper advice on the rules that apply to you.

When devices control equipment

Remote control is convenient, but a wrong command can cause real harm. For pumps, motors, heaters, valves or anything near gas and electricity:

• Keep a manual override on site that works without the network.
• Leave safety interlocks, cut-outs and protective devices in place and in the hands of qualified electricians and technicians. Software adds to them; it never replaces them.
• Make the device fall back to a safe state if it loses contact.
• Record who sent each command and when.

A short checklist

1. Every device has unique credentials; no factory defaults remain.
2. Devices sit on a separate network and connect outwards only.
3. All traffic is encrypted, and each device can only do its own job.
4. There is a tested way to update firmware.
5. Dashboard accounts are personal, with two-step verification where possible.
6. A device register exists, with an owner for each device.
7. Anything that controls equipment has a local override and a safe fallback.

The easiest time to get this right is at the start. If you are planning a small IoT pilot, include these points in it from day one. My IoT device development work builds them in as standard.