The Mirai botnet in 2016 used 600,000 compromised IoT devices — cameras, routers, and DVRs — to conduct the largest DDoS attack recorded at the time. In 2026, the number of connected IoT devices globally has crossed 18 billion. Most ship with the same security defects Mirai exploited: default credentials, unencrypted communications, no automatic update mechanism, and management interfaces exposed to the internet. This guide covers how to assess and control IoT risk in enterprise environments.
Why IoT Is Different From IT Security
Traditional IT security operates on a patching model: vendors release updates, administrators deploy them, systems remain current. IoT breaks this model in several ways:
- Unmanaged update cycles: Many IoT devices have no auto-update capability. Firmware updates, if they exist, require manual intervention. Many organizations have cameras and sensors running firmware from 2019.
- Long operational lifespans: Enterprise IoT devices (access control systems, HVAC sensors, industrial controllers) have 10-20 year operational lifespans. Security support ends years before the device is replaced.
- Constrained compute: Many IoT devices cannot run traditional endpoint security agents due to processor and memory constraints. Your EDR does not cover your IP cameras.
- Physical access risks: IoT devices are often physically accessible in public spaces, server rooms, or manufacturing floors. Physical access enables firmware extraction, debug port exploitation, and hardware attacks.
OT/ICS distinction: Operational Technology (OT) devices — industrial controllers, SCADA systems, PLCs — carry additional risk because a security compromise can have physical safety consequences. A compromised industrial controller can damage equipment, disrupt production, or create safety hazards. OT security requires specialized expertise and frameworks (IEC 62443) beyond general IoT guidance.
Step 1: Build a Complete IoT Asset Inventory
You cannot secure devices you do not know exist. Shadow IoT — devices connected by employees or contractors without IT knowledge — is endemic in most organizations. Start by scanning your network with Nmap for non-standard device fingerprints, then validate against procurement records. Purpose-built IoT discovery tools (Armis, Claroty, Forescout, Microsoft Defender for IoT) use passive network monitoring and device fingerprinting to identify and categorize IoT devices without requiring agents.
Your inventory should capture for each device: manufacturer and model, firmware version and patch status, network location and VLAN assignment, management interface access method, owner and business purpose, and end-of-support date from the vendor.
Step 2: Network Segmentation for IoT
Network segmentation is the single most effective IoT security control because it limits the blast radius when a device is compromised. Place all IoT devices on dedicated VLANs with strict firewall rules. The rules should be explicit allow-lists, not deny-lists: allow only the specific traffic flows the device needs to function, deny everything else.
- IP cameras: allow outbound to the VMS server only, block all internet access
- HVAC sensors: allow outbound to the BMS platform only
- Badge readers: allow outbound to the access control server only
- Smart TVs and conferencing systems: internet access via isolated VLAN, no access to corporate network segments
Quick assessment: Check whether any IoT devices on your network have default credentials by querying Shodan for your public IP range. Shodan’s IoT device fingerprinting identifies default-credential devices visible from the internet. Any results are critical findings requiring immediate remediation.
Step 3: Harden Device Configuration
Before deploying any IoT device:
- Change default credentials immediately. Default username/password combinations are published in vendor documentation and exploited automatically by botnets within minutes of internet exposure.
- Disable unused services and ports. Most IoT management interfaces expose Telnet, FTP, and HTTP in addition to HTTPS. Disable every protocol you do not need.
- Enable encrypted management. HTTPS only, no HTTP. SSH only, no Telnet. Disable SNMP v1 and v2 (use SNMPv3 with authentication if SNMP is required).
- Disable UPnP. Universal Plug and Play automatically opens firewall ports. Disable it on both the device and your router/firewall to prevent devices from self-exposing to the internet.
Step 4: Monitor IoT Traffic for Anomalies
IoT devices have predictable, repetitive communication patterns. A camera should talk to the VMS server during business hours. A sensor should send telemetry to the BMS platform on a fixed schedule. Any deviation from this pattern is an anomaly worth investigating: a camera initiating outbound connections to an external IP, a sensor suddenly scanning other devices, a badge reader establishing a persistent connection to an unknown host.
Passive monitoring tools like Armis and Claroty build behavioral baselines for each device and alert on deviations automatically. Without a dedicated tool, configure your SIEM to alert on any IoT device communicating outside its permitted destinations as defined by your firewall rules.
Step 5: Manage the Firmware Update Process
Create a firmware inventory and track CVEs against your deployed device models. Subscribe to vendor security advisories for all IoT devices in your environment. Many security teams track software vulnerabilities rigorously and ignore IoT firmware entirely — creating a maintained but unpatched attack surface.
When a firmware update is available, test it in a lab environment before deploying to production. IoT firmware updates can break functionality. Establish a maintenance window process for IoT patching that mirrors your server patching process.
End-of-life planning: When a vendor stops providing security updates for a deployed device, that device becomes an unpatched risk that compounds over time. Establish a hardware refresh cycle for IoT devices based on vendor end-of-support dates, not just physical failure. Include IoT refresh costs in your security budget.
Takeaway: Start with discovery — build your IoT inventory before implementing any other control. Then segment, harden, and monitor in that order. The organizations with the worst IoT security posture are those that do not know what is connected to their network. See our Security Tools page for IoT security platform comparisons.
🔗 Further Reading
Frequently Asked Questions
What is IoT security?
IoT (Internet of Things) security encompasses the technologies, policies, and practices used to protect connected devices and networks from cyberattacks. IoT security addresses the unique challenges of connected devices: constrained compute preventing traditional security agents, long operational lifespans outlasting vendor security support, unmanaged update cycles, and physical accessibility. Enterprise IoT security includes asset inventory, network segmentation, device hardening, firmware management, and behavioral traffic monitoring.
Why are IoT devices a security risk?
IoT devices are a security risk for five main reasons: (1) Default credentials that users rarely change and are publicly documented by manufacturers. (2) Infrequent or absent firmware updates leaving known vulnerabilities unpatched. (3) Limited compute preventing installation of traditional security software. (4) Broad deployment in uncontrolled locations creating physical attack surfaces. (5) Long operational lifespans that outlast vendor security support, leaving devices running EOL firmware for years.
What is OT security?
OT (Operational Technology) security protects industrial control systems including SCADA (Supervisory Control and Data Acquisition) systems, PLCs (Programmable Logic Controllers), DCS (Distributed Control Systems), and industrial IoT devices used in manufacturing, utilities, healthcare, and critical infrastructure. Unlike IT security where the primary concern is data confidentiality and availability, OT security must also address physical safety — a compromised industrial controller can cause equipment damage, production disruption, or safety hazards. OT security follows specialized frameworks including IEC 62443 and NIST SP 800-82.
How should IoT devices be segmented on a network?
IoT devices should be placed on dedicated VLANs isolated from corporate networks with explicit allow-list firewall rules defining only the specific traffic flows each device requires. For example: IP cameras should only communicate with the video management server, HVAC sensors only with the building management system, and badge readers only with the access control server. Guest and consumer IoT devices (smart TVs, conferencing systems) should be on a completely separate VLAN with internet access only and no path to corporate resources.
