The Internet of Things (IoT) is the network of physical devices – cameras, routers, smart home gadgets, medical and industrial equipment – that collect data and connect to the internet.
How IoT works
IoT devices combine sensors or actuators with a small processor, firmware and a network connection such as Wi-Fi, Bluetooth, Zigbee or cellular. They usually report to a cloud service and are controlled through a mobile app. Billions of such devices are in use, from smart TVs, doorbells and baby monitors to building automation, cars and the industrial IoT (IIoT) in factories and utilities.
Why IoT security matters
Many devices are cheap, run outdated software, ship with default passwords and stop receiving updates after a short time. They rarely run security software and are often exposed directly to the internet. This makes them attractive targets:
- Botnets – the Mirai malware (2016) turned hundreds of thousands of cameras and routers into zombies; its DDoS attacks disrupted the DNS provider Dyn and many major websites. Mirai variants and other botnets still hijack IoT devices today.
- Privacy breaches – in 2021 attackers gained access to about 150,000 Verkada security cameras in hospitals, schools and companies through an exposed admin account.
- Physical safety – in 2015 researchers Charlie Miller and Chris Valasek remotely took control of a Jeep Cherokee, prompting a recall of 1.4 million vehicles.
- Network entry point – a compromised device can be a foothold into home or corporate networks.
Regulators have responded: the ETSI EN 303 645 standard sets baseline requirements, and the UK has banned universal default passwords on consumer devices since 2024.
How to secure IoT devices
- Change default passwords and disable unused services such as Telnet and UPnP.
- Install firmware updates and replace devices that no longer receive them.
- Place IoT devices in a separate network segment or guest Wi-Fi.
- Prefer vendors that publish support periods and a vulnerability disclosure policy.
