IE 11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Defending Your Castle: Best Practices for Smart Home Security

Some ways to master the essential tools to protect your privacy without sacrificing the convenience of modern smart technology.

A view into a kitchen of a home, with a wall in the foreground with a smart touchscreen device.
Adobe Stock/KOTO
Last week, I examined how your smart home may be watching you, along with privacy considerations for smart devices in the age of AI robots.

But I left readers with many unanswered questions surrounding solutions to these challenges, beyond just unplugging and becoming a 21st-century Luddite.

So let’s jump right into some basic advice to protect your smart devices and home network.

Here are five basic best practices:
  • Segment Your Home Network: Use your router’s “Guest Network” feature specifically for your smart devices. This isolates them from your primary computers and smartphones, ensuring that if a smart lightbulb is compromised, the attacker cannot easily access your sensitive personal or financial data.
  • Enable Multifactor Authentication (MFA): Wherever possible, turn on MFA for your smart home accounts. This adds a critical second layer of protection, such as a code sent to your phone, which prevents unauthorized access even if someone manages to steal your password.
  • Audit and Disable Unnecessary Features: Review the privacy settings for each device and its associated app to turn off features you do not use, such as microphones, cameras or location tracking. For voice assistants, you should also regularly review and delete your voice recording history through the Amazon Alexa or Google Home settings.
  • Automate Firmware Updates: Ensure all devices, including your Wi-Fi router, are set to update automatically. Manufacturers frequently release patches for newly discovered security vulnerabilities, and running outdated software leaves your home open to known exploits.
  • Change Default Credentials: Never keep the factory-set user names or passwords for your router or smart devices. Use a password manager to create and store strong, unique passwords (at least 12 characters long) for every individual account to prevent a single breach from compromising your entire home.

This video goes further and describes how to limit permissions on device data collection:



WHAT ABOUT PRIVACY FOR RENTERS?


This MSN article covers some privacy tips and the law when it comes to what landlords and owners can do with smart devices and cameras, and also highlights what are reasonable expectations of privacy: “For homeowners, that typically means places like bedrooms and bathrooms are off limits. For renters, their reasonable expectation of privacy typically extends to any inside rooms or shared common areas like washing rooms.”

And diving into smart mirrors, this article describes many of the disadvantages of smart mirrors that you may want to consider before buying one.

When prompted, Gemini offered many tips for securing smart mirrors, most of which are covered above, such as passwords and updating software and firmware. But these two tips were different, and could apply to other devices:
  • Cover the camera: Use a physical slider or tape over the lens when you aren’t using video features.
  • Disable voice listening: Turn off the microphone in settings if you don’t use voice commands to prevent accidental recordings.
Nevertheless, it seems like these steps could greatly limit your ability to gain benefits from the smart mirrors for such uses as detecting skin cancer or other health benefits.

HAS MY SMART DEVICE ALREADY BEEN HACKED?


One article I really liked on the wider topic of hacking smart homes was written over five years ago, but still has relevance today. The article is “How hackable are the smart devices in your home? We reveal the most vulnerable rooms.” Here’s an excerpt:

“Here’s an exhaustive list of all the hackable smart home devices that might be found in your abode. Please note that with new devices being imagined every day, this list is bound to expand over time.

“We’ve divided this catalog by the rooms that contain the most likely-to-be-hackable smart home devices vs. rooms that contain smart devices that are less likely to be hacked. For example, while a security camera might be an enticing challenge for a criminal to crack, it’s unlikely anyone would want to hack your smart scale or smart water-level monitor.”

Going further, this recent article gives details on “9 Signs That Your Smart Home Device Has Been Hacked.” Here are the nine signs in a table format, with more details in the article:
Sign
Description
Possible Hacker Activity
Recommended Action
Unexpected Behavior
Device acts erratically (lights flickering, thermostat settings changing, smart locks unpredictable)
Hackers manipulate smart devices to create disturbances
Investigate irregularities early to prevent further damage
Unusual Network Traffic
Sudden surge in data usage, unusual patterns in network traffic
Hackers exploit devices to launch attacks or steal information
Check router activity logs regularly
Strange Sounds or Voices
Unfamiliar voices or strange sounds from smart speakers/assistants
Hackers eavesdrop or communicate with household members
Ensure devices respond only to authorized voices
Device Settings Modification
Unauthorized changes to settings (camera angles, sensor sensitivity, device preferences)
High likelihood device compromised by hacker
Review and update device settings regularly
Unexplained Data Transfers
Unexplained data usage or transfers from smart devices
Hackers extract sensitive information
Review data usage patterns to identify suspicious activity
Device Inaccessibility
Locked out of devices, passwords changed, two-factor authentication enabled without consent
Hackers take control of accounts
Act promptly to regain control and secure accounts
New or Unknown Devices on the Network
Unfamiliar or unauthorized devices connected to home network
Hackers breach network and exploit device vulnerabilities
Secure network with strong passwords, consider network segmentation
Frequent Software Glitches
Frequent glitches or failed updates
Malicious actor interferes with device
Ensure devices run latest firmware with security patches
Emails or Messages Confirming Changes You Didn’t Make
Notifications or emails confirming changes (settings, passwords, device access) not made by you
Unauthorized access
Change passwords, review access permissions immediately

FINAL THOUGHTS


Some people love a good movie to help them understand and take action on areas like cybersecurity and privacy of devices. Here is a list (from creepycatalog.com) of 11 smart home movies that bring privacy issues to life. (I am not endorsing any of these, but just thought the list was interesting and goes back to the 1980s.)

Nevertheless, as more and more smart devices show up in our homes, vacation rentals and hotel rooms, we all need to take steps to ensure that we are comfortable with the security and privacy being used to protect us.
Daniel J. Lohrmann is an internationally recognized cybersecurity leader, technologist, keynote speaker and author.