IoT Security: Defending Billions of Devices That Were Never Designed to Be Defended

In 2016 a botnet built from hijacked security cameras and home routers — Mirai — knocked out a large chunk of the US internet for an afternoon by flooding a DNS provider. It used a list of about sixty default usernames and passwords. A decade later there are perhaps 20 billion connected devices, many of them just as poorly defended, and they have become the preferred entry point for attackers into homes, hospitals, factories and utilities. IoT security is the problem of defending hardware that was, for the most part, never designed to be defended.

Why IoT devices are so easy to attack

• Default and hard-coded credentials. Still the number-one issue. Devices ship with admin/admin, and some have passwords baked into firmware that cannot be changed.
• No update path. Many devices can't be patched at all, or require a manual process nobody performs. A vulnerability discovered in year two is a vulnerability for the device's whole life.
• Insecure services. Telnet, unauthenticated web interfaces, debug ports left enabled, plaintext protocols for management and data.
• Long lifetimes. A camera, a PLC or an infusion pump stays in service for ten to twenty years — far outliving vendor support and the cryptography it shipped with.
• Flat networks. The device sits on the same network as everything else, so a compromised thermostat is a foothold to the domain controller.
• Economics. A $30 device has no margin for a security team, and until recently no regulation required one.

What attackers do with them

Botnets remain the mass-market use: compromised devices rented out for DDoS attacks, credential stuffing and residential proxy networks that let criminals route traffic through your home IP. Lateral movement is the targeted use: an attacker enters via an exposed device — the notorious example being a casino breached through an internet-connected fish-tank thermometer — and pivots to the systems that matter. In healthcare, vulnerable medical devices are both a patient-safety risk and a ransomware vector. In operational technology — industrial control systems in power, water and manufacturing — the consequences are physical: state-linked groups have pre-positioned in US critical infrastructure networks, and attacks on water utilities via exposed controllers have already occurred.

Architecture: assume the device is hostile

The single most effective control is network segmentation. IoT devices go on their own network segment — a VLAN at home, a properly firewalled zone in an enterprise — with rules that allow only the traffic they need (usually outbound to a specific cloud service) and nothing toward user devices or servers. Industrial environments formalise this with the Purdue model and IEC 62443 zones and conduits. If a device is compromised, segmentation is what stops it mattering.

Beyond that: zero-trust network access so devices authenticate before they get any connectivity; egress filtering so a compromised device can't reach a command-and-control server; and monitoring that baselines what each device normally talks to and alerts on deviation. A camera that starts talking to an IP in a new country is a very reliable indicator.

Device lifecycle

Security is a process that spans the device's life:

• Procurement: require vendors to provide a software bill of materials, a vulnerability disclosure policy, a defined support period and signed firmware updates. Don't buy what can't be patched.
• Onboarding: change every credential, disable unused services, register the device in an inventory with an owner. Certificate-based identity for anything that supports it.
• Operation: apply firmware updates on a schedule; monitor; re-scan for exposed services periodically because configurations drift.
• Retirement: wipe, and remove from the network and the inventory. Forgotten devices are the ones that get exploited.

An accurate inventory — what's on the network, what it is, who owns it — is the prerequisite for all of it and the step most organisations skip.

Regulation is finally arriving

The economics are changing because governments stopped waiting for the market. The EU's Cyber Resilience Act, adopted in 2024, makes manufacturers legally responsible for the security of connected products throughout their support life, with vulnerability reporting obligations starting in 2026 and full requirements from 2027. The UK's Product Security and Telecommunications Infrastructure regime already bans default passwords and requires published support periods. The US Cyber Trust Mark labelling scheme lets consumers see which devices meet baseline standards. And IEC 62443 and NIST's IoT guidance give buyers a common language for contracts. None of this fixes the billions of devices already deployed — but it means the next billion should be materially better.