Keeping Your Smart Devices Secure

Your smart alarm wakes you up. You brush your teeth in front of a smart mirror while your coffee machine prepares your morning coffee. The lights come on as you move around the house, your pet's smart feeder serves them breakfast and, as you leave for work, your smart door locks behind you.

For many people, this isn't the future. It's an ordinary morning.

From smart alarms, cameras and doorbells to televisions, heating systems, appliances and even pet care, connected technology has become increasingly embedded in our homes and daily lives. These devices can make life easier, more convenient and, in many cases, more secure.

But every device connected to the internet can also introduce another potential route for criminals to exploit. As our homes become smarter, understanding how to secure the technology within them is just as important as securing the doors and windows.

So, what is the Internet of Things, how can criminals exploit connected devices, and what can you do to keep your smart home secure?

What is the Internet of Things?

The Internet of Things, commonly known as IoT, describes physical devices that connect to the internet or another network so they can communicate, collect information or be controlled remotely.

For consumers, this can include:

Smart doorbells and security cameras
Smart locks and alarms
Smart speakers and voice assistants
Smart TVs
Smart thermostats and heating controls
Smart lighting
Connected appliances
Smart watches and other wearable technology

The number of these devices in people’s homes continues to grow. Government research found that 64% of surveyed consumers owned a smart TV, while estimates from Ofcom suggest that around 40-50% of UK consumers own a smart speaker.

In fact, the Government’s 2024/25 Participation Survey found that just 1% of adults in England did not own any of a range of smart devices for the home, including smart speakers, smart home security devices, smart energy devices, smart appliances and smart toys or baby monitors.

Why Can Smart Devices Be Targeted?

Smart devices are designed to connect to networks and communicate with other systems. If they are not properly secured, criminals may be able to exploit weaknesses to gain access.

One route is through weak or easily guessed passwords. Criminals can also attempt to exploit software vulnerabilities in devices or their associated services.

Government research into consumer IoT security notes that cyber attacks against IoT devices can potentially give criminals access to sensitive user data or provide opportunities for further exploitation. Research cited in the report also found that attacks targeting IoT devices doubled between 2020 and 2021.

The consequences can vary depending on the device.

A compromised smart camera, for example, could potentially allow someone to view a property remotely. Access to a smart lock or other connected security product could have more direct implications for physical security, while a compromised device could potentially provide a route into other devices or accounts connected to the same network.

How Does This Affect Victims?

The impact of a comprised smart device can extend beyond the device itself.

Victims could face:

Loss of privacy
Unwanted access to cameras or microphones
Exposure of personal information
Compromised online accounts
Disruption to connected devices
Financial loss
Increased risk to physical security

For people using smart technology as part of their home security, the potential consequences are particularly important. A device intended to help protect a property should not become a weak point in its security.

Choosing Secure Smart Devices

Security should be considered before buying a connected product, rather than being treated as an afterthought.

Look for products from manufacturers that take security seriously and provide clear information about how their devices are protected, how security problems can be reported and how long the product will receive security updates.

The UK introduced new legislation covering consumer connectable products on 29th April 2024. The Product Security and Telecommunications Infrastructure (PSTI) Act establishes baseline security requirements for relevant consumer products sold in the UK. Among other requirements, manufacturers must not supply products with easily guessable default passwords and must provide information about the minimum period for which security updates will be provided.

Look for Secure Connected Device Accreditation

Secured by Design has introduced its Secure Connected Device accreditation scheme, developed in consultation with the Department for Science, Innovation and Technology.

The accreditation highlights products that have achieved the appropriate IoT standards and certifications, helping consumers make more informed choices when purchasing connected devices.

This is particularly relevant when connected technology forms part of a property’s security. Consumers can use the Secured by Design website to search products that meet SCD requirements.

Keep Your Device Updated

Software updates aren’t just about adding new features. They can also contain security fixes that protect against newly discovered vulnerabilities.

Enable automatic updates where available and regularly check that your devices and their associated apps are running the latest software.

The National Cyber Security Centre recommends checking how long a particular smart device will be supported and advises consumers to keep their devices updated.

If a device is no longer supported by its manufacturer, consider whether it should remain connected to your network.

Change Passwords and Use Two-Step Verification

Never leave a device using an easily guessable or default password.

Create strong, unique passwords and change any default credentials during setup. Secured by Design and the National Cyber Security Centre recommend using three random words as a password, avoiding any predictable information and to never reuse the same password for other accounts or devices.

Where available, enable two-step verification/multi-factor authentication on the account used to control your device. Two-step verification provides an additional layer of protection if somebody obtains your password.

Check Your Settings

Take time to understand what your device can do and review its security and privacy settings.

Consider:

Which devices can connect to it?
Who has access to the account?
Does the device need remote access?
Which notifications are enabled?
Are the camera, microphone or location services active when they don’t need to be?
What information is being collected and stored?

Disable features you do not need, particularly if they could create unnecessary security or privacy risks.

Secure Your Home Network

Your router provides the connection between many of your smart devices and the wider internet, so it is an important part of your overall security.

Change the router’s default administrator credentials and Wi-Fi password, keep its software updated and use appropriate encryption.

Where possible, consider placing IoT devices on a separate or guest network. This can help limit the potential impact if one connected device is compromised.

Disconnect Devices You No Longer Use

Old smart devices can easily be forgotten about, particularly after being replaced.

If you no longer use a connected device, disconnect it from your network and, where appropriate, remove its associated account or reset it before disposing of or giving it away.

Think About Your Physical Security Too

Cyber security and physical security are increasingly interconnected.

A smart doorbell, camera, lock or alarm may form part of your property’s wider security, so consider how the device itself is positioned and protected.

For example, make sure cameras cannot easily be tampered with and consider who can physically access devices, routers and other network equipment.

Security should work as a complete system rather than relying on one device or technology.

Security by Design

As homes become increasingly connected, security needs to be considered alongside convenience from the moment a product is designed.

Secured by Design works with manufacturers and the security industry to promote products that meet appropriate security standards and can help protect people and property from crime.

The Secure Connected Device accreditation provides another way for consumers to identify connected products that have achieved appropriate IoT standards and certifications. By considering security when choosing and setting up smart technology, consumers can make better-informed decisions and reduce opportunities for criminals to exploit their connected homes.

Smart technology can provide valuable benefits, but it should never be assumed that a connected device is secure simply because it is new or convenient.

Choose securely, configure carefully, keep devices updated and regularly review what is connected to your home network.