Smart TVs, thermostats, doorbells, baby monitors, and voice assistants — your home is full of internet-connected devices with weak security. Here's how to lock them down.
The average American home now contains 25 internet-connected devices. Smart TVs, thermostats, security cameras, doorbells, baby monitors, voice assistants, smart locks, appliances, and entertainment systems — all connected to your home network, all potentially accessible from the internet, and most shipped with security as an afterthought. IoT (Internet of Things) devices are the weakest link in most home networks: they run stripped-down operating systems that rarely receive security updates, use default credentials that owners never change, and often communicate over unencrypted connections. Compromised IoT devices have been used to spy on families, conduct distributed denial-of-service attacks, and serve as entry points into home networks.
The default credential problem: the most common IoT security failure is unchanged default credentials. Manufacturers ship devices with default usernames and passwords (admin/admin, admin/password, or credentials printed on the device label) that are publicly documented and actively exploited. The Mirai botnet — which in 2016 conducted the largest DDoS attack in history, taking down major websites including Twitter, Netflix, and Reddit — was built almost entirely from IoT devices compromised using default credentials. The fix is simple: change the default username and password on every IoT device you own. Use a unique, strong password for each device, stored in your password manager.
Network segmentation: the most effective IoT security measure. Your smart TV doesn't need to be on the same network as your laptop and phone. A compromised smart TV on a segmented IoT network cannot access your banking credentials on your laptop. Most modern routers support creating a separate guest network or VLAN (Virtual Local Area Network) for IoT devices. Put all IoT devices — smart TVs, cameras, thermostats, voice assistants, gaming consoles — on a separate network that has internet access but cannot communicate with your primary devices. This single step dramatically limits the damage a compromised IoT device can do.
Firmware updates and end-of-life devices: IoT devices receive security updates through firmware updates, but many owners never apply them — and many manufacturers stop providing updates after a few years. Check your device manufacturer's website or app for firmware updates and apply them promptly. For devices that no longer receive updates (a smart TV from 2017, a camera from 2015), consider whether the security risk justifies continued use. A device that hasn't received a security update in three years likely has known, unpatched vulnerabilities. Disconnect devices you no longer actively use — an unused smart speaker is an unnecessary attack surface.
Router security: the foundation of home network security. Your router is the gateway between your home network and the internet — its security affects every device on your network. Change the default admin credentials immediately. Enable WPA3 encryption (or WPA2 if WPA3 isn't available). Disable WPS (Wi-Fi Protected Setup), which has known vulnerabilities. Enable the router's built-in firewall. Disable remote management unless you specifically need it. Keep the router firmware updated — enable automatic updates if available. Consider a security-focused router (eero Pro, Firewalla, Gryphon) that includes built-in threat detection and automatic updates as core features rather than afterthoughts.
Specific high-risk devices: security cameras and baby monitors deserve special attention because a compromise has immediate privacy implications. Use cameras from reputable manufacturers with strong security track records (Arlo, Ring, Nest) rather than cheap no-name cameras. Enable two-factor authentication on the associated cloud account. Regularly review which devices and accounts have access to your camera feeds. For baby monitors, prefer local-only models that don't transmit video to the cloud, or use a monitor with end-to-end encryption. Voice assistants (Amazon Echo, Google Home) should be on your IoT network segment, not your primary network, and review your voice history settings to understand what's being recorded and stored.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.