IoT Security for Small Business: Your Cameras, Printers, and Smart Devices Are Attack Vectors
That security camera protecting your office might be the easiest way into your network. Here's how IoT devices create risk and what SMBs should do about it.
IoT Security for Small Business: Your Cameras, Printers, and Smart Devices Are Attack Vectors
Your office has more connected devices than you think. Security cameras, network printers, smart thermostats, badge access systems, VoIP phones, and conference room displays, each one is a computer on your network.
Some may retain default credentials, old firmware, unclear ownership, or network access that was never reviewed.
Why IoT Devices Are a Security Problem
IoT security and support practices vary widely. Compared with managed workstations and servers, a connected device may:
- Can't run endpoint protection software, no antivirus, no EDR
- Have limited update support, with a lifecycle and update method that must be confirmed with the manufacturer
- Ship with default credentials, admin/admin, admin/password, or well-known manufacturer defaults
- Communicate externally, many IoT devices phone home to cloud services, often over unencrypted channels
- Are invisible to IT management tools, your RMM and security tools probably don't monitor them
Real Attack Scenarios
The Camera Botnet
In the largest DDoS attack in history, the Mirai botnet compromised over 600,000 IoT devices, primarily security cameras and DVRs, using default passwords. Your office cameras could be part of the next one.
The Printer Pivot
An attacker gains access to a network printer through a known vulnerability. From there, they can see network traffic, intercept print jobs (which may contain sensitive documents), and pivot to other systems on the same network segment.
The Smart Thermostat Data Breach
A casino's high-roller database was famously exfiltrated through a smart fish tank thermometer. The device was on the same network as the database server. Attackers used it as a stepping stone.
These aren't theoretical, they're documented incidents.
How Many IoT Devices Are on Your Network?
Start with an inventory rather than an estimate. Useful prompts include:
- 4-8 security cameras
- 2-4 network printers/copiers
- 1-2 smart TVs or digital signage displays
- VoIP phones (one per user)
- Access control panels and badge readers
- Smart thermostats
- Conference room equipment (Poly, Yealink, etc.)
- Network-attached storage devices
- UPS devices with network management cards
That's 30-50+ IoT devices, often with no security management whatsoever.
The IoT Security Framework for SMBs
1. Inventory Every Connected Device
Run a network scan to discover every device with an IP address. Compare discovered devices with purchasing, facilities, and IT records, then investigate anything without a clear owner.
Tools like Nmap, Advanced IP Scanner, or your managed firewall's device inventory can help.
2. Segment IoT Devices Onto Their Own Network
Segmentation can limit unnecessary paths from IoT devices. Use separate network segments where the workflow and device capabilities support them, then allow only documented communication that is required.
Basic segmentation:
- Corporate VLAN, managed workstations and servers
- IoT VLAN, cameras, printers, smart devices
- Guest VLAN, visitor Wi-Fi
Firewall rules should block IoT-to-corporate traffic entirely. If a camera needs to be accessed from a workstation, route it through a firewall with specific allow rules.
3. Change Every Default Password
Audit every IoT device and change default credentials. Use unique, complex passwords stored in a password manager. This eliminates the easiest attack vector.
4. Update Firmware
Check manufacturer sites for firmware updates. Check current support status, available updates, known issues, business criticality, and compensating controls. Plan replacement when a device no longer fits the approved risk and support requirements.
Set a quarterly reminder to check for IoT firmware updates.
5. Disable Unnecessary Features
Many IoT devices have features enabled by default that you don't use:
- UPnP (Universal Plug and Play), disable it
- Remote management interfaces, disable if not needed
- Cloud connectivity, if you don't need remote camera access, don't enable it
- Telnet and HTTP management, use HTTPS/SSH only
6. Monitor IoT Network Traffic
Your firewall should log and alert on unusual IoT traffic patterns. Pair this with managed detection and response for around-the-clock visibility. A security camera that suddenly starts sending 500MB of data to an IP address in Eastern Europe is a clear indicator of compromise.
7. Include IoT in Your Security Policy
Add IoT device management to your security policy:
- Who approves new IoT devices on the network?
- What security standards must devices meet?
- How often are devices audited and updated?
- What's the replacement plan for end-of-life devices?
The Printer Problem Deserves Special Attention
Network printers and copiers are often overlooked, but they:
- Store copies of every document printed, scanned, or faxed
- Have hard drives that should be encrypted and wiped at end-of-lease
- Run embedded operating systems with exploitable vulnerabilities
- Often have default admin portals accessible to anyone on the network
Secure your printers: change admin passwords, disable unnecessary protocols, enable encryption, and segment them from sensitive systems.
Bottom Line
IoT security isn't about buying more tools, it's about visibility, segmentation, and basic hygiene. Know what's on your network, isolate it from sensitive systems, and maintain it like any other IT asset.
Not sure what's lurking on your network? Contact Sonic Systems for an IoT security assessment, we'll inventory every device and build a segmentation plan for your business infrastructure.