IoT security is the set of practices, controls and tools that protect Internet of Things (IoT) devices, such as IP cameras, badge readers, sensors, smart building controls and connected equipment, along with the networks and cloud services they rely on. Because many of these devices can’t run security software or be patched like laptops, IoT security leans on inventory, device identity, network segmentation, monitoring and lifecycle management from purchase to retirement.
At a glance
- IoT security covers the devices, their firmware, the networks they connect to and the cloud or management services behind them.
- Many devices can’t run security agents, so segmentation, access control and network monitoring do much of the work.
- An accurate inventory with an owner for each device is the starting point.
- Default or shared credentials, outdated firmware and flat networks are among the most common weaknesses.
- It spans the full device lifecycle: purchase, onboarding, operation, updates and secure retirement.
What problem it solves
Connected devices accumulate quietly. Facilities installs cameras and door controllers, operations adds sensors, and a building upgrade brings smart HVAC and lighting. Many of these devices arrive outside IT’s normal processes, with default passwords, firmware that is rarely updated and network access far broader than they need. They often sit on the same network as laptops and servers.
That makes them attractive footholds. A compromised camera or controller can be used to spy, to launch attacks against other systems, to join a botnet, or as a quiet starting point for lateral movement toward business systems. IoT security brings these devices under the same discipline as the rest of IT: known, owned, restricted, monitored and maintained.
How it works
Inventory and discovery. Active scanning and passive traffic analysis find connected devices and classify them by type, location, owner and risk. This inventory drives most other controls.
Secure procurement. Security requirements go into purchasing: unique credentials per device, signed firmware updates, a published support period, a way to report vulnerabilities and, where available, a software bill of materials.
Identity and onboarding. Devices join the network with an identity, such as a certificate or unique credential, and are placed in the right segment automatically, often through network access control (NAC).
Segmentation and least privilege. Devices sit in segments grouped by function and risk, with firewall rules that allow only the traffic each device needs, such as to its controller, management service or update server. This limits what an attacker can reach from a compromised device.
Monitoring and detection. Device and network logs flow to a security information and event management (SIEM) platform or monitoring service, which baselines normal behavior and alerts on anomalies such as new destinations, scanning or unusual traffic volume. Intrusion detection and prevention at network choke points adds signature-based detection.
Updates and retirement. Firmware versions are tracked and patched on a schedule. When devices are retired, credentials are revoked, stored data is wiped and network rules are removed.
When it matters for buyers
- When facilities or operations deploy connected devices. Cameras, access control systems, building management systems and sensors need IT security input before purchase, not after installation.
- When opening or refitting a site. Network design for a new office is the cheapest time to build separate segments for building and security systems.
- When cyber insurance or audits come up. Insurers and auditors increasingly ask how unmanaged devices are inventoried and isolated.
- When devices reach end of support. Devices that no longer receive updates need tighter isolation or replacement.
- When IT and operational systems meet. Industrial and building systems bring their own constraints; see OT security for those environments.
Some jurisdictions now set security requirements for connected products, such as bans on universal default passwords, mainly placing duties on manufacturers and sellers; rules vary by country, so check what applies to the devices you buy. See our Internet of Things overview for device connectivity and management options.
Questions to ask vendors
- Does each device ship with a unique credential, and can default accounts be disabled?
- How are firmware updates signed and delivered, and for how long will this model receive security updates?
- How do you disclose and fix vulnerabilities, and where are advisories published?
- Which network destinations and ports does the device need, and is that documented?
- Can the device authenticate to the network with certificates or 802.1X?
- What logs can it send, and in what format?
- Where does device data go, how is it encrypted in transit, and who can access it?
- How is the device securely reset and wiped at end of life?
How it differs from OT security
IoT security and operational technology (OT) security overlap but are not the same. IoT security covers the broad range of connected devices, many of them commercial products such as cameras, sensors and smart building equipment, often managed through cloud services. OT security focuses on the systems that run physical processes, such as industrial control systems (ICS) in plants and utilities, where availability and safety come first, downtime for patching may be hard to schedule, and specialized protocols are common. Many organizations have both, and devices such as building controllers can fall into either. Both belong to the wider category of cyber-physical systems security. Devices connecting over cellular, including those using multi-carrier IoT SIMs, need the same controls applied at the carrier or private network level.
Problems this helps with
- Cameras, badge readers and sensors on the network that nobody manages
- Devices still using default passwords or unsupported firmware
- Facilities and operations buying connected devices without IT
- Auditors or insurers asking how connected devices are secured
