I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them?

It would be nice for homeowners to have a basic guide to securing their home network and devices. Especially considering the probability that adding (mostly unsafe) IoT devices to your network increases the attack vectors considerably.

  • A pretty good test would be to put it on the open internet and see if it starts spewing spam after a few minutes. If it does, put up a proxy to intercept the spam and forward it to the manufacturer's helpdesk. Oct 4, 2016 at 0:38
  • My parents have just a secured wireless connection (no proper anti-virus either) but still their computer is working pretty fine. I recently scanned their system.
    – Limit
    Oct 4, 2016 at 0:40
  • My comment was sarcastic by the way. In all seriousness, I do not think such standards exist yet. Your best bet would be to port-scan the device and see if there are commonly exploited services listening such as telnet, SSH, etc. Oct 4, 2016 at 0:41

2 Answers 2


While I'm not aware of any actual, certified standards, there is no shortage of recommendations from national organisations such as NIST, CESG, Anti-fraud agencies and the like.

There are many useful blog posts as well of course.

In addition, there are various courses such as FutureLearn's Cyber course (FL is part of the UK's Open University and their courses are free). They also ran an excellent Introduction to Cyber Security course that was created in conjunction with the UK's Cabinet Office - not sure if they will run that again.

UPDATE: I realise now that I only answered part of this question. As @blownie55 points out in his answer, some architecting of the network is in order to try and isolate more vulnerable IoT devices from other services. Any diagram on enterprise networking would give you an idea as to how this goes.

You need to separate out some networks and try to isolate traffic within them, restricting any traffic that might need to span the networks. For this, you need a decent router/firewall.

Typically in a home, you will only have a single router/firewall which sits at the edge of your LAN and provides the link to the WAN. Now we need to add additional router/firewall configurations inside that initial LAN creating sub-LANs with largely isolated traffic.

You can do this by buying more routers or by adding 2 network cards into a PC and running it as a router/firewall. But this is rather costly.

Alternatively, you could buy a decent router/firewall such as the Ubiquity EdgeRouter Lite which allows you to create isolated subnets in software. Unfortunately, as Ubiquity do it right, this requires a managed switch rather than a cheap unmanaged one. The EdgeRouter Lite only has 3 Ethernet ports so you can only create 2 LAN's. Ubiquity also make routers with more ports though. I only mention Ubiquity because I've used them and they come with pro-level features for a home router price, I'm sure there will be others that can do all this.

Once set up, the EdgeRouter OS allows firewall settings for each LAN route.

You can do this with Wi-Fi as well. Since Wi-Fi will never be as secure generally as a wired network, you can use a decent Wi-Fi access point that has it's own security or that you put onto its own VLAN to isolate the traffic and prevent access to any key resources you want kept extra safe.

UPDATE 2: Apologies that this is getting a little long.

If faffing with routers is too much. One much simpler way to help isolate IoT devices would be to put all of them on a subnet that is different to your main LAN subnet.

So let's say that your Internet router is, it is likely that it automatically creates a LAN on (a netmask of But you don't have to keep things that way. You could change the netmask to which would allow addresses anywhere between (if you know IP networking, I know that isn't quite true but I'm trying to keep it simple).

Now, most of the devices on your network will use DHCP for which the server is also the router. If you configure DHCP to deliver something like with a netmask of, the normal devices will only be able to talk on 192.168.1.x

So configure all of your network connected IoT devices manually to use lets say 192.168.2.x also with a netmask of and the traffic is reasonably well isolated. Both subnets can still talk to the router and a decent router would still be capable of controlling the traffic in the different networks (the firewall rules are more complex but then we are only using a single router).

This won't stop a dedicated hack but it will prevent the casual leakage that is the bane of IoT. And it doesn't require lots of hardware.

Note that I wrote that off the top of my head rather than in a test lab so if I've got something wrong I hope someone will (politely!) point it out and I'll correct it.

  • This may sound a lot daunting to people but I think if someone wants to play with latest IoT devices, they should at least have some knowledge of networking and how the devices work interact within themselves and with the internet.
    – Limit
    Oct 5, 2016 at 13:51
  • 1
    I can't disagree @Limit. I would however say that if you are cooking up your own IoT devices a lot of this is overkill. Just make sure that your IoT infrastructure has no route to the Internet and that your Wi-Fi is reasonably secure. No different to any other precautions a non-IoT network should do. I do a lot of IoT work at home, it is fun and safe - but, I don't trust any commercial, ethernet/Wi-Fi connected device and both my own and commercial devices have no direct route to the Internet. Oct 5, 2016 at 14:00
  • Interesting! I had never considered the idea of keeping them completely cutoff from internet. How do they get software updates? Is it through exceptions in Firewall or do you have a update server configured on one of your computers?
    – Limit
    Oct 5, 2016 at 14:38
  • Commercial IoT devices I will update manually, as I say, I don't tend to buy them as they are expensive and typically poor quality or at least poor security. Home-built devices are updated from the local network. The bits that tie them together have their OS's connected to the Internet (a Pi and a NAS for example) and updated normally but the services that run the IoT part (e.g. MQTT brokers, databases and Node-RED) are not connected. I use a combination of server firewalls (IPTABLES) and the router firewall. Oct 5, 2016 at 14:42
  • If I want to connect an IoT service to the Internet, I typically use a proxy that provides a known and managed level of security via TLS. Harder to describe than it is to implement. Oct 5, 2016 at 14:43

Take a look at the following write ups for securing your home network:

  1. Three Dumb Routers
  2. Two or Three Router solution

The first one is based on a setup described in the Security Now! Podcast by Steve Gibson.

The main gist of both setups is to create two isolated networks, one for trusted nodes and another for untrusted nodes (IoT devices, webcams etc.). These setups have been reviewed by security professionals but have not been standardized in any way.

  • Urgh! Complex and potentially fairly expensive. If you want something simpler, you can do it with VLANs, many home routers support several. Although VLANs are not considered a high-security feature, they would be enough to stop most threats. Using VLANs you can isolate the virtual networks without having a physical router. A really good router such as the Ubuquity EdgeRouter Lite can easily apply different firewall rules to the different VLANs. Oct 5, 2016 at 12:31
  • I agree @JulianKnight. The Ubiquiti EdgeRouter X for $49 is also a good option which can be used to create isolated networks but you will still need a couple of Wireless APs behind it. I would argue that creating VLANs using one router or using something like Ubiquiti s also pretty complex for the average user. The three dumb routers setup can be accomplished with any cheap/existing Wireless APs you have lying around the house with very minimal configuration providing a low cost while minimizing tech skills required.
    – ARau
    Oct 5, 2016 at 12:53
  • OK, well I've done that and it has its challenges for sure. But, as the OP has asked the question it may be doable for them. I don't think that the average household could/would though which, of course, still leaves most people who experiment with home automation badly exposed. Oct 5, 2016 at 13:04
  • Quite honestly, I think that simply putting the IoT devices onto a separate subnet (e.g. just changing the IP addresses used) would be sufficient for most purposes. Oct 5, 2016 at 13:06
  • The question wasn't specifically for my home. My home is still well taken care of but I have noticed people simply adding new gadgets to their home networks without taking any security measures.
    – Limit
    Oct 5, 2016 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .