Measures for security in the Internet of Things (IoT)
Smart devices, such as speakers, light switches and fridges, can be vulnerable to attack. The NCSC recommends taking preventive measures to improve the cybersecurity of your IoT devices.
The term Internet of Things (IoT) refers to objects and devices that are connected to a network (such as the internet) and communicate with one another or provide information via that network. These are generally sensors, actuators and control elements that are often controlled via a cloud-based application.
Examples of IoT devices include smart network speakers, digital assistants, smart light switches, ovens, fridges and smart TVs that are connected to an internal network or directly to the internet via a network interface.
Many of these smart devices require an internet connection in order to work properly. This increases not only the number of devices communicating online, but also the number of vulnerable devices that attackers can exploit – for example, to send spam emails or carry out attacks on others online, such as DDoS attacks.
This is why these devices should be secured with individual passwords and restricted access, and updated regularly. If critical security vulnerabilities are discovered in the software used by these devices that could be exploited by attackers, updates should be installed quickly. Unlike with laptops, desktop computers or smartphones, however, hardly anyone thinks about the fact that smart light switches or fridges also need software updates.
This is why these devices should be secured with individual passwords and restricted access, and updated regularly. If critical security vulnerabilities are discovered in the software used by these devices that could be exploited by attackers, updates should be installed quickly. Unlike with laptops, desktop computers or smartphones, however, hardly anyone thinks about the fact that smart light switches or fridges also need software updates.
Objects and devices that can be found by anyone on the internet – for example, via a port scan or search engine such as Shodan – pose an even greater risk. The risk is particularly high if they can be accessed using default credentials that have not been changed.
Preventive measures
To prevent smart light switches, digital assistants and other IoT devices from being taken over by attackers, the NCSC recommends taking the following preventive measures. Before purchasing or installing any network-enabled objects or devices, make sure you find out about the IT security precautions in place.
- How often are software updates released?
- Are they installed automatically, or do you need to take action?
- How will you know that an update is available?
- Can the device be accessed via the internet?
- What measures does the device have in place to prevent unauthorised access?
- Does the operating system support access via secure connections such as SSH or HTTPS?
- Can the access credentials set by the manufacturer, such as the username and password, be changed?
If the device does not require internet access, make sure that it cannot be accessed online. You can achieve this using a firewall or by placing the device on a separate network that is not connected to the internet.
If the device needs to be accessible via the internet – for instance, if information is to be made available online – the NCSC recommends taking the following measures:
- Create a separate network segment for your connected devices that does not have access to your personal data, such as your laptop/desktop computer or NAS. This way, the devices can only communicate with the internet and not your internal network. Many modern routers support this, and it ensures that your internal network cannot be attacked via one of your IoT devices.
- Restrict access to the device from the internet by using an IP address filter to allow access only from certain IP addresses, or a GeoIP filter to restrict access to IP addresses from a specific location, such as Switzerland.
- Only use protocols that enable a secure connection, such as SSH or HTTPS. Never use cleartext protocols such as Telnet or HTTP.
- Do not use default ports (such as 443 for HTTPS), as these can make your device easier to find using a simple port scan. Instead, use a port with a high number (such as 43443 instead of 443 for HTTPS). This will make the device harder to find.
- Never use the default username and password. These are widely known and can easily be exploited by attackers. Change the username and password as soon as you start using the device.
- Use a complex password consisting of at least 12 characters, including numbers, uppercase and lowercase letters, and special characters.
- Wherever possible, use two-factor authentication, such as a text message, Google Authenticator or a hardware token.
- If you no longer need a device, disconnect it from your network / the internet.
- You should also disable the "universal plug and play" (UPnP) function on your router.
- Ask your internet service provider or router supplier about the configuration options available, any functional restrictions and other potential consequences this measure could have.
Measures after a device has been compromised
If one of your connected devices has already been compromised, the NCSC recommends resetting the device to its factory settings. After performing a factory reset, follow the steps outlined under "Preventive measures" to protect the device from being compromised again.
Information on performing a factory reset can be found in the device's user manual or on the manufacturer's website.