Cyberpediaby Brain
ENDEFR

Connected devices and isolated networks

Cameras, speakers and connected TVs can open a door into your network. Here is how to set them up and keep them apart from work.

In 30 seconds

Where it happens
On the home or office Wi-Fi, as soon as a connected camera, speaker or television is plugged into it.
What the attacker wants
To guess the device's password, log in to it, then use it to reach the network or carry out other attacks1.
The reflex
Change the original password, turn on updates and switch off unneeded functions12.
If it is already done
If you think someone has taken control of a device, reset it by following the manufacturer's instructions1.

What it is

A camera, a speaker, a television, a thermostat: all of these devices connect to the same Wi-Fi network as the laptop. The UK NCSC groups them under the name connected devices ("smart devices") and also includes ordinary appliances, such as a refrigerator, a kettle or a washing machine1.

At the office as at home, a poorly protected device can serve as an entry point to the rest of the network. This page explains why, and how to reduce the risk without any particular technical skill.

Straight answers

Why does a connected device put the network at risk?

Because it remains a device on the network, without the usual protection of one. The NCSC explains that a manufacturer must publish fixes for the flaws in its products, and that without these fixes the device becomes easier to hack1. CISA adds that many network devices, especially small office or home routers, do not run antivirus or monitoring tools3.

Is an original password really a problem?

Yes. According to CISA, default credentials can be found on the Internet or even printed on the device. Leaving them in place lets malicious actors access information, install malicious software and cause other damage2.

My network is too small to interest anyone, right?

CISA lists this idea among two common misconceptions, along with the idea that devices are "secure enough" straight out of the box. It states that most attacks are not personal and can hit any network, large or small2.

Does a voice speaker listen all the time?

The CNIL describes a speaker that is always listening for the keyword, but that in principle records nothing until it has heard it. False activations remain possible, for example when a word sounds like the activation word4. Most devices send requests to the cloud, meaning the servers of the assistant's designer4.

Do I need to buy the latest model to be safe?

No. The NCSC states that it is not necessary to buy the newest or most expensive device. It does recommend avoiding, if possible, a device that is no longer supported by its manufacturer or whose support is about to end1.

1How it works1 min

An attacker who has gained a foothold on a network first looks for what is on it. The MITRE ATT&CK knowledge base describes this step: the adversary tries to get a list of services running on remote hosts and on local network devices, including those that might be vulnerable to remote exploitation5.

This is where network separation comes in. CISA describes segmentation as a way to prevent an intruder from propagating attacks or moving laterally within an internal network. On a poorly segmented network, the intruder can extend their reach to critical devices or sensitive data3. A properly separated network can, on the contrary, contain the incident and reduce its effect3.

NIST, on the manufacturers' side, runs a program dedicated to the cybersecurity of connected devices. It publishes recommendations there for manufacturers and for companies that deploy these devices6. ENISA, for its part, published in November 2017 a study of baseline security recommendations for the Internet of Things7.

2What you do1 min
  • Change the original password. The NCSC asks you to change it if the device provides one, and to choose a strong one, for example by combining three random words1.
  • Turn on two-step verification if the device or its app offers it1.
  • Switch off remote access if you do not need to reach the device from outside your Wi-Fi1.
  • Install updates. Turn on automatic installation if it exists, and install manual updates as soon as they are offered1.
  • Remove what is not used. CISA recommends disabling unneeded services, because unused services and software can create flaws2. It also advises disabling UPnP when it is not needed: according to CISA, malicious software already on the network can use it to bypass the router's firewall2.
  • Disable the router's remote management, which allows its settings to be viewed and changed from the Internet2.
  • Separate sensitive information. CISA recommends placing it in distinct network segments3.
  • Watch for unknown connections. CISA suggests spotting unauthorized devices that join the network, using the router manufacturer's website2.
  • Before reselling or giving away a device, do a factory reset, which should also erase your personal data1.
3Pitfalls1 min

The first pitfall is the device shipped with a password shared on the Internet. In the United Kingdom, a law has applied since 29 April 2024: all connected devices must meet baseline requirements, including stating the end-of-support date, and manufacturers must make sure devices are not shipped with default passwords, which can easily be shared online1. This rule applies to the United Kingdom. Elsewhere, nothing guarantees that the device bought was designed this way.

The second pitfall is buying a device without support. The NCSC invites people to see the end-of-support date as a use-by date: after that point, the device is easier to hack or may stop working1. CISA notes for its part that internet service providers do not always replace a device once it is no longer supported by its manufacturer3.

The third pitfall is believing that the device is safe straight out of the box. Factory configurations are often too permissive, designed to make installation easy and not for security2.

The last pitfall is neglect. The CISA page on infrastructure devices says that, once installed, many devices are not maintained at the same level of security as computers, and that owners also overlook them when they look for intruders after intrusions3.

Fact sheet

Identifier
CP-344
Wing
5. Office life and reflexes
Brain skill
Safe Web Browsing (browse_safely)
Brain reflex
cr-074
Diagram
G2 · Visual vs Technical Indicators
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. NCSC (UK), “Smart devices: using them safely in your home”, 15 February 2019. https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home (accessed 3 November 2026)
  2. CISA, “Home Network Security”, 1 February 2021. https://www.cisa.gov/news-events/news/home-network-security (accessed 3 November 2026)
  3. CISA, “Securing Network Infrastructure Devices”, 6 September 2006. https://www.cisa.gov/news-events/news/securing-network-infrastructure-devices (accessed 3 November 2026)
  4. CNIL, “Le fonctionnement des assistants vocaux en 5 étapes”, 5 December 2017. https://www.cnil.fr/fr/le-fonctionnement-des-assistants-vocaux-en-5-etapes (accessed 3 November 2026)
  5. MITRE ATT&CK, “Network Service Discovery, Technique T1046 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1046/ (accessed 3 November 2026)
  6. NIST, “NIST Cybersecurity for IoT Program”. https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program (accessed 3 November 2026)
  7. ENISA, “Baseline Security Recommendations for IoT”, 20 November 2017. https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot (accessed 3 November 2026)

Cite this article

Brain, “Connected devices and isolated networks”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/iot-devices-isolated-network/

BibTeX 
@misc{brain_cp344_en_2026,
  author = {Brain},
  title = {Connected devices and isolated networks},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/iot-devices-isolated-network/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence