IoT Security for Small Business: Your Cameras, Printers, and Smart Devices Are Attack Vectors
That security camera protecting your office might be the easiest way into your network. Here's how IoT devices create risk and what SMBs should do about it.
IoT Security for Small Business: Your Cameras, Printers, and Smart Devices Are Attack Vectors
Your office has more connected devices than you think. Security cameras, network printers, smart thermostats, badge access systems, VoIP phones, and conference room displays — each one is a computer on your network.
And most of them are running outdated firmware with default passwords.
Why IoT Devices Are a Security Problem
IoT devices were designed for function, not security. Unlike your Windows workstations and servers, most IoT devices:
Real Attack Scenarios
The Camera Botnet
In the largest DDoS attack in history, the Mirai botnet compromised over 600,000 IoT devices — primarily security cameras and DVRs — using default passwords. Your office cameras could be part of the next one.
The Printer Pivot
An attacker gains access to a network printer through a known vulnerability. From there, they can see network traffic, intercept print jobs (which may contain sensitive documents), and pivot to other systems on the same network segment.
The Smart Thermostat Data Breach
A casino's high-roller database was famously exfiltrated through a smart fish tank thermometer. The device was on the same network as the database server. Attackers used it as a stepping stone.
These aren't theoretical — they're documented incidents.
How Many IoT Devices Are on Your Network?
Most SMBs significantly undercount. A typical 20-person office might have:
That's 30-50+ IoT devices, often with no security management whatsoever.
The IoT Security Framework for SMBs
1. Inventory Every Connected Device
Run a network scan to discover every device with an IP address. You'll find devices you forgot about — and probably a few you never authorized.
Tools like Nmap, Advanced IP Scanner, or your managed firewall's device inventory can help.
2. Segment IoT Devices Onto Their Own Network
This is the single most important step. IoT devices should be on a separate VLAN with no access to your corporate network, servers, or sensitive data.
Basic segmentation:
Firewall rules should block IoT-to-corporate traffic entirely. If a camera needs to be accessed from a workstation, route it through a firewall with specific allow rules.
3. Change Every Default Password
Audit every IoT device and change default credentials. Use unique, complex passwords stored in a password manager. This eliminates the easiest attack vector.
4. Update Firmware
Check manufacturer sites for firmware updates. For devices that haven't received updates in 2+ years, consider them end-of-life and plan for replacement.
Set a quarterly reminder to check for IoT firmware updates.
5. Disable Unnecessary Features
Many IoT devices have features enabled by default that you don't use:
6. Monitor IoT Network Traffic
Your firewall should log and alert on unusual IoT traffic patterns. Pair this with managed detection and response for around-the-clock visibility. A security camera that suddenly starts sending 500MB of data to an IP address in Eastern Europe is a clear indicator of compromise.
7. Include IoT in Your Security Policy
Add IoT device management to your security policy:
The Printer Problem Deserves Special Attention
Network printers and copiers are often overlooked, but they:
Secure your printers: change admin passwords, disable unnecessary protocols, enable encryption, and segment them from sensitive systems.
Bottom Line
IoT security isn't about buying more tools — it's about visibility, segmentation, and basic hygiene. Know what's on your network, isolate it from sensitive systems, and maintain it like any other IT asset.
Not sure what's lurking on your network? Contact Sonic Systems for an IoT security assessment — we'll inventory every device and build a segmentation plan for your business infrastructure.