IoT Security Basics You Shouldn't Skip

Every connected device in your home is a small computer on your network. Most are cheap, rarely updated and set up in a hurry, which makes them the easiest way into a home network. The good news is that a few habits remove most of the risk, whether you buy devices or build them yourself.

These are the rules I follow for the ESP32 devices I build and for the store-bought gadgets in my own home.

1. Change every default password

Many cameras, routers and smart plugs ship with a default username and password that is printed in the manual and listed online. Change it on day one, and use a different password for each device. Start with the router, because whoever controls the router can reach everything else.

2. Do not expose devices to the internet

Port forwarding a camera or controller so you can reach it from outside makes it visible to automated scanners within hours. Keep devices reachable only on your home network. If you need remote access, use a VPN into your home network or a well-known service with proper accounts, rather than opening ports.

This is one reason I prefer local control. My ESP32 controllers serve their dashboards only on the home Wi-Fi, so there is nothing on the open internet to attack.

3. Put IoT devices on a separate network

Most modern routers can create a guest network. Put smart plugs, bulbs and cameras there, and keep laptops and phones with banking apps on the main network. If one cheap device is compromised, it cannot easily reach your personal computers.

4. Keep firmware updated

Update store-bought devices when the maker releases fixes, and replace devices that no longer receive updates. For devices you build, add over-the-air updates protected by a password, so fixing a problem does not mean opening an enclosure.

5. If you build devices, protect the basics

• Never hard-code Wi-Fi passwords in code you share; store them in the device's flash storage instead
• Protect OTA updates and any settings page with a password
• Use MQTT with a username and password, and TLS if messages leave your home network
• Make the device fail safe: if it loses its connection or reboots, outputs should go to a safe state
• Remove debug pages and test endpoints before the device goes into daily use

6. Think about physical safety too

For devices that switch real loads such as pumps, heaters or ACs, security is also about safety. A device that can be switched by anyone on the network could run a pump dry or leave a heater on. Add limits in the firmware itself, such as maximum run times and interlocks, so even a wrong command cannot cause damage.

A quick checklist

Default passwords changed, nothing port-forwarded, IoT on a guest network, firmware current, and safe behaviour after a reboot. If your home passes those five checks, you are ahead of most connected homes.