Smart Home Network Security 101: Lock Down Your IoT

Section 1: Why is your router the front door to every device? (Introduction)

Your router is the front door to every smart device. Put the gadgets on a guest network or VLAN, use WPA3 where supported, change default passwords and keep firmware current. Segmentation limits what a compromised device can reach on your network.

A connected home is a small network with a large attack surface. Twenty devices is common: cameras, doorbells, locks, plugs, bulbs, a hub, a thermostat, a TV, a robot vacuum. Most of them run firmware nobody audits, ship with a default password, and are expected to work for a decade without a single update.

That combination is why cheap IoT gear is a target. A compromised camera is not usually about watching you; it is about the bandwidth, the always-on connection, and the trusted position inside your network. The device becomes a foothold.

The defense is not one product. It is three layers: a router that is not running factory defaults, a network that separates the gadgets from the computers, and device hygiene that closes the obvious doors. Each layer catches what the others miss.

This guide covers the baseline settings, the difference between a guest network and a VLAN, a worked segmentation example, what a compromised device actually does, and how to buy gear that will still get updates in three years. For the rest of the pillar, see the Security & Privacy hub, and for the wider privacy picture, the Smart Home Privacy Audit.

Section 2: Which router settings should you fix first?

Before segmentation, fix the router. It is the one device every other device trusts.

CISA’s home-network guidance is direct about UPnP: it is convenient for discovery and configuration, but it is also a security risk, because any device or app on the network can use it to open a path in from the internet. Disable it unless you have a specific device that fails without it.

The same guidance recommends the strongest encryption available, WPA3 Personal with AES, and a firewall at the boundary. Most consumer routers include a firewall by default; the problem is usually the settings above it, not the absence of one.

One more habit: know how to reboot the router and do it after firmware updates and when something behaves strangely. It is not a security strategy, but it clears a surprising number of problems.

The guest network

Most routers ship with a guest Wi-Fi network. Use it. Put the smart devices there and keep the laptops, phones, and NAS on the main network. It takes ten minutes and removes the easiest lateral path between a cheap camera and your files.

The limitation is control. On many consumer routers the guest network isolates guests from the main LAN but not from each other, and you cannot write rules about which devices may talk to which. That is where a VLAN comes in.

Section 3: Should you use a guest network or a VLAN?

Segmentation means putting devices into separate networks and deciding what may cross between them. The goal is not secrecy; it is containment. If the doorbell is compromised, it should not be able to reach the laptop.

What a guest network gives you

• Isolation from the main LAN. Guests and IoT devices cannot browse your computers.
• No new hardware. It is built into the router you already own.
• A realistic upgrade for renters. No VLAN-capable gear required.

What it does not give you is a rule set. You cannot usually say “the camera may reach the internet but not the NAS, and the hub may reach the camera but nothing else.” For that you need VLANs and a firewall.

A worked VLAN example

A VLAN-capable router or firewall lets you define separate networks on the same physical hardware. A practical home layout looks like this:

The rules matter more than the VLAN numbers. A workable default set:

• IoT to internet: allow. Cameras and plugs need their cloud services unless you run them locally.
• IoT to Trusted: deny. This is the rule that contains a compromised device.
• Trusted to IoT: allow established connections, plus the specific ports an app needs. Your phone still has to control the lights.
• Guest to anything local: deny. Guests get the internet and nothing else.
• IoT to IoT: deny by default. Allow only what the hub genuinely needs.

That last rule is the one people forget. A camera that can reach a doorbell can also attack it, and neither device needs to talk to the other to do its job.

The discovery problem

Segmentation breaks automatic discovery. AirPlay, Chromecast, HomeKit, and some smart home apps rely on multicast DNS to find devices on the local network. Once the TV is on VLAN 20 and your phone is on VLAN 10, the phone may stop seeing it.

The fix is an mDNS reflector or a discovery proxy on the router, which repeats those multicast announcements across the networks you choose. Some consumer mesh systems hide this behind a “device isolation” toggle; prosumer gear usually exposes it as a service. Budget an evening for this step, not ten minutes.

What segmentation does not do

• It does not fix a default password. A device with admin/admin is compromised on any VLAN.
• It does not stop cloud traffic. A camera can still send footage to its manufacturer.
• It does not replace a firewall. VLANs separate; firewall rules decide.
• It does not work on hardware that lacks VLAN support. Most ISP-provided gateways do not.

Section 4: What does a compromised device actually do?

The canonical example is Mirai. In 2016, malware scanned the internet for IoT devices and tried a list of 62 common default usernames and passwords. Because so many devices were unsecured, that short dictionary was reportedly enough to enslave more than 380,000 devices and assemble them into a botnet used for distributed denial-of-service attacks.

CISA’s alert on the incident is blunt about why: many IoT devices are unsecured or weakly secured, and a short list of defaults unlocks hundreds of thousands of them. The devices were not targeted for their data. They were targeted for their bandwidth and their always-on connections.

A modern compromise can do more:

• Recruit the device into a botnet. The camera or router participates in attacks without you noticing, apart from slower internet.
• Use it as a pivot. From the IoT network, an attacker probes the rest of the house. Segmentation turns that into a dead end.
• Reuse credentials. If the camera account shares a password with your email, the breach is no longer about the camera.
• Watch or listen. Cameras and doorbells can expose video and audio if the account is taken over.

How you notice

Check the router’s client list once a month. You are looking for devices you do not recognize, or a known device behaving oddly: constant traffic, repeated reconnects, or a hostname that does not match anything you bought.

Router logs and app alerts help, but most consumer routers keep logs for a short window and bury them. A simple baseline — a written list of every device you expect on the network — is more useful than a fancy dashboard you never open.

If something looks wrong: cut its network access first, then factory-reset it, update the firmware, and set a new unique password. If the device has no update path, retire it.

Section 5: What makes a device safe to keep for years?

What good password advice actually says

NIST’s digital identity guidance, SP 800-63B, is the reference most security teams follow. Its current rules are simpler than the old advice:

• Passwords used alone should be at least 15 characters; passwords used as part of multi-factor authentication may be shorter, with a minimum of eight.
• Do not require composition rules such as a capital, a number, and a symbol. Length beats a puzzle.
• Do not force periodic rotation. Change a password when there is evidence of compromise, not on a calendar.
• Screen against a blocklist of commonly used and breached passwords.
• Allow password managers, autofill, and paste. They make longer, unique passwords practical.

That last point is the practical one. A password manager is not a nice-to-have; it is how a normal person keeps 40 unique device and account passwords. Use it, and let it generate.

Multi-factor authentication

Passwords are not phishing-resistant, and NIST says so directly. Where an app or router offers a passkey or an authenticator app, prefer it. SMS codes are better than nothing, but they can be intercepted or SIM-swapped.

Turn on MFA for the accounts that control your home: the camera and doorbell apps, the hub, the router admin login if it supports it, and the email address those accounts use. That last one matters most, because password resets flow through it.

Firmware is a subscription you did not know you had

Every connected device depends on its manufacturer continuing to ship patches. When that stops, the device does not become safe because it is old; it becomes permanently vulnerable.

Before buying, find the vendor’s support page for the model and look for a stated security-update period. If the answer is vague, assume the shortest plausible window. The FCC’s U.S. Cyber Trust Mark is a voluntary label for wireless consumer IoT products, built to give buyers a security signal the way Energy Star gives an efficiency signal; it is worth looking for, but it is not yet universal.

Three buying filters worth more than any spec sheet:

1. A stated support period. “We update it” is not a date.
2. An update path you can see. Firmware downloads or automatic updates on the product page.
3. Local control where it matters. A camera that records to a card or an NVR keeps working, and keeps your footage home, even if the cloud account is breached. Local video storage covers that trade-off.

Section 6: What is the three-step starting plan, and who can stop at step one? (Conclusion)

1. Fix the router. Change the admin password, turn off remote administration, WPS, and UPnP, switch to WPA3 if every device supports it, and turn on automatic firmware updates. This is one afternoon and it helps regardless of everything else.
2. Segment what you can. Put the smart devices on the guest network today. If your router supports VLANs, build the three-network layout above and add the deny rules; if it does not, the guest network is the honest ceiling until you replace it.
3. Fix the accounts. Install a password manager, give every device and service a unique password, turn on MFA, and write down the list of devices you expect on the network so an unknown one stands out.

Some homes should stop at step one. If you have three smart devices and a locked-down router, the guest network is enough, and a VLAN project is a hobby rather than a security need. If you have a NAS, a home server, or twenty devices, the segmentation earns its complexity.

Segmentation will not make your smart home bulletproof. It will make a compromised camera a contained problem instead of a path to your laptop, and that is the difference worth paying for.

Where to buy

Related reading

• Local Video Storage — keeping camera footage on your own hardware.
• Smart Cameras 101 — camera-specific privacy and storage trade-offs.
• Video Doorbells 101 — the doorbell on your network, and where its footage goes.
• The Smart Hub Blueprint — where the hub sits, and why the network path matters.

Sources

• Home Network Security — CISA, router settings, UPnP, WPA3 and firewalls
• Securing the Internet of Things (IoT) — CISA, default passwords and patching
• Heightened DDoS Threat Posed by Mirai and Other Botnets — CISA, 62 default credentials and 380,000 enslaved devices
• Digital Identity Guidelines: Authentication and Lifecycle Management — NIST SP 800-63B, password length, blocklists and MFA
• U.S. Cyber Trust Mark — Federal Communications Commission, voluntary IoT labeling program