Nobody logs into the office printer. Nobody checks whether the door camera has an update waiting, and the smart TV in the meeting room joined the Wi-Fi the day it arrived and has not been thought about since. These devices run software, sit on your network and rarely get patched, because there is no screen nagging anyone to do it.
The free guidance
What a reasonable device should do. NIST's IR 8425 sets a baseline for consumer IoT: access control on its interfaces, a way to receive updates, protection for the data it holds. It is short, and it doubles as a buying checklist.
The manufacturer's side. NIST IR 8259A lists the core capabilities a device should ship with. Ask a vendor which of them their product supports before you buy.
Adding devices to a business network. NIST SP 800-213 was written for federal agencies, and its questions about what a device can do and what you need from it work for any organization.
The European standard. ETSI EN 303 645 is a free download and covers similar ground: no universal default passwords, a way to report vulnerabilities, and a stated update period.
Common failures. The OWASP Internet of Things project keeps the IoT Top 10. It is the 2018 edition, so treat it as a list of long-running problems rather than current news.
For staff working from home. NSA's Best Practices for Securing Your Home Network covers routers and smart devices in plain language. It is worth sending to anyone who works on a laptop next to a smart speaker.
Where to start
Write down every networked device. Walk the office and check the router's client list. Printers, cameras, door controllers, TVs, conference room kit and the thermostat all count.
Change or disable default credentials. A device that still accepts the password printed in its manual is the easiest way in. Where a device cannot have its password changed, that is a reason to replace it.
Put these devices on their own network. A separate segment or guest network means a compromised camera cannot reach the laptops that hold customer data.
What counts as evidence
The inventory is the control. An auditor will want to see a list of devices with an owner, a location and the date it was last reviewed, and then check that the list matches what is actually plugged in. CIS Safeguard 1.1 asks for exactly this kind of enterprise asset inventory.
Keeping the record
The company that made your camera is a vendor, and its cloud service may hold footage of your office. Keel's free Vendor & Third-Party Risk policy template gives you a place to record that relationship. If you want to know where you stand overall, the free readiness assessment takes a few minutes and needs no account.
Next week: the server closet, the visitor book and the box of old laptops, or physical security for a small office.