Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them?
It would be nice for homeowners to have a basic guide to securing their home network and devices. Especially considering the probability that adding (mostly unsafe) IoT devices to your network increases the attack vectors considerably.
While I'm not aware of any actual, certified standards, there is no shortage of recommendations from national organisations such as NIST, CESG, Anti-fraud agencies and the like.
There are many useful blog posts as well of course.
In addition, there are various courses such as FutureLearn's Cyber course (FL is part of the UK's Open University and their courses are free). They also ran an excellent Introduction to Cyber Security course that was created in conjunction with the UK's Cabinet Office - not sure if they will run that again.
UPDATE: I realise now that I only answered part of this question. As @blownie55 points out in his answer, some architecting of the network is in order to try and isolate more vulnerable IoT devices from other services. Any diagram on enterprise networking would give you an idea as to how this goes.
You need to separate out some networks and try to isolate traffic within them, restricting any traffic that might need to span the networks. For this, you need a decent router/firewall.
Typically in a home, you will only have a single router/firewall which sits at the edge of your LAN and provides the link to the WAN. Now we need to add additional router/firewall configurations inside that initial LAN creating sub-LANs with largely isolated traffic.
You can do this by buying more routers or by adding 2 network cards into a PC and running it as a router/firewall. But this is rather costly.
Alternatively, you could buy a decent router/firewall such as the Ubiquity EdgeRouter Lite which allows you to create isolated subnets in software. Unfortunately, as Ubiquity do it right, this requires a managed switch rather than a cheap unmanaged one. The EdgeRouter Lite only has 3 Ethernet ports so you can only create 2 LAN's. Ubiquity also make routers with more ports though. I only mention Ubiquity because I've used them and they come with pro-level features for a home router price, I'm sure there will be others that can do all this.
Once set up, the EdgeRouter OS allows firewall settings for each LAN route.
You can do this with Wi-Fi as well. Since Wi-Fi will never be as secure generally as a wired network, you can use a decent Wi-Fi access point that has it's own security or that you put onto its own VLAN to isolate the traffic and prevent access to any key resources you want kept extra safe.
UPDATE 2: Apologies that this is getting a little long.
If faffing with routers is too much. One much simpler way to help isolate IoT devices would be to put all of them on a subnet that is different to your main LAN subnet.
So let's say that your Internet router is 192.168.1.1, it is likely that it automatically creates a LAN on 192.168.1.0-255 (a netmask of 255.255.255.0). But you don't have to keep things that way. You could change the netmask to 255.255.0.0 which would allow addresses anywhere between 192.168.0.0-192.168.255.255 (if you know IP networking, I know that isn't quite true but I'm trying to keep it simple).
Now, most of the devices on your network will use DHCP for which the server is also the router. If you configure DHCP to deliver something like 192.168.1.100-192.168.1.200 with a netmask of 255.255.255.0, the normal devices will only be able to talk on 192.168.1.x
So configure all of your network connected IoT devices manually to use lets say 192.168.2.x also with a netmask of 255.255.255.0 and the traffic is reasonably well isolated. Both subnets can still talk to the router and a decent router would still be capable of controlling the traffic in the different networks (the firewall rules are more complex but then we are only using a single router).
This won't stop a dedicated hack but it will prevent the casual leakage that is the bane of IoT. And it doesn't require lots of hardware.
Note that I wrote that off the top of my head rather than in a test lab so if I've got something wrong I hope someone will (politely!) point it out and I'll correct it.
Take a look at the following write ups for securing your home network:
The first one is based on a setup described in the Security Now! Podcast by Steve Gibson.
The main gist of both setups is to create two isolated networks, one for trusted nodes and another for untrusted nodes (IoT devices, webcams etc.). These setups have been reviewed by security professionals but have not been standardized in any way.
