3

I have seen several security standards and best practices for organizations (CIS, HIPPAA, PCI DSS) but are there any for homes? If yes, where can I find them?

It would be nice for homeowners to have a basic guide to securing their home network and devices. Especially considering the probability that adding (mostly unsafe) IoT devices to your network increases the attack vectors considerably.

  • A pretty good test would be to put it on the open internet and see if it starts spewing spam after a few minutes. If it does, put up a proxy to intercept the spam and forward it to the manufacturer's helpdesk. – André Borie Oct 4 '16 at 0:38
  • My parents have just a secured wireless connection (no proper anti-virus either) but still their computer is working pretty fine. I recently scanned their system. – Limit Oct 4 '16 at 0:40
  • My comment was sarcastic by the way. In all seriousness, I do not think such standards exist yet. Your best bet would be to port-scan the device and see if there are commonly exploited services listening such as telnet, SSH, etc. – André Borie Oct 4 '16 at 0:41
3

While I'm not aware of any actual, certified standards, there is no shortage of recommendations from national organisations such as NIST, CESG, Anti-fraud agencies and the like.

There are many useful blog posts as well of course.

In addition, there are various courses such as FutureLearn's Cyber course (FL is part of the UK's Open University and their courses are free). They also ran an excellent Introduction to Cyber Security course that was created in conjunction with the UK's Cabinet Office - not sure if they will run that again.


UPDATE: I realise now that I only answered part of this question. As @blownie55 points out in his answer, some architecting of the network is in order to try and isolate more vulnerable IoT devices from other services. Any diagram on enterprise networking would give you an idea as to how this goes.

You need to separate out some networks and try to isolate traffic within them, restricting any traffic that might need to span the networks. For this, you need a decent router/firewall.

Typically in a home, you will only have a single router/firewall which sits at the edge of your LAN and provides the link to the WAN. Now we need to add additional router/firewall configurations inside that initial LAN creating sub-LANs with largely isolated traffic.

You can do this by buying more routers or by adding 2 network cards into a PC and running it as a router/firewall. But this is rather costly.

Alternatively, you could buy a decent router/firewall such as the Ubiquity EdgeRouter Lite which allows you to create isolated subnets in software. Unfortunately, as Ubiquity do it right, this requires a managed switch rather than a cheap unmanaged one. The EdgeRouter Lite only has 3 Ethernet ports so you can only create 2 LAN's. Ubiquity also make routers with more ports though. I only mention Ubiquity because I've used them and they come with pro-level features for a home router price, I'm sure there will be others that can do all this.

Once set up, the EdgeRouter OS allows firewall settings for each LAN route.

You can do this with Wi-Fi as well. Since Wi-Fi will never be as secure generally as a wired network, you can use a decent Wi-Fi access point that has it's own security or that you put onto its own VLAN to isolate the traffic and prevent access to any key resources you want kept extra safe.


UPDATE 2: Apologies that this is getting a little long.

If faffing with routers is too much. One much simpler way to help isolate IoT devices would be to put all of them on a subnet that is different to your main LAN subnet.

So let's say that your Internet router is 192.168.1.1, it is likely that it automatically creates a LAN on 192.168.1.0-255 (a netmask of 255.255.255.0). But you don't have to keep things that way. You could change the netmask to 255.255.0.0 which would allow addresses anywhere between 192.168.0.0-192.168.255.255 (if you know IP networking, I know that isn't quite true but I'm trying to keep it simple).

Now, most of the devices on your network will use DHCP for which the server is also the router. If you configure DHCP to deliver something like 192.168.1.100-192.168.1.200 with a netmask of 255.255.255.0, the normal devices will only be able to talk on 192.168.1.x

So configure all of your network connected IoT devices manually to use lets say 192.168.2.x also with a netmask of 255.255.255.0 and the traffic is reasonably well isolated. Both subnets can still talk to the router and a decent router would still be capable of controlling the traffic in the different networks (the firewall rules are more complex but then we are only using a single router).

This won't stop a dedicated hack but it will prevent the casual leakage that is the bane of IoT. And it doesn't require lots of hardware.

Note that I wrote that off the top of my head rather than in a test lab so if I've got something wrong I hope someone will (politely!) point it out and I'll correct it.

  • This may sound a lot daunting to people but I think if someone wants to play with latest IoT devices, they should at least have some knowledge of networking and how the devices work interact within themselves and with the internet. – Limit Oct 5 '16 at 13:51
  • 1
    I can't disagree @Limit. I would however say that if you are cooking up your own IoT devices a lot of this is overkill. Just make sure that your IoT infrastructure has no route to the Internet and that your Wi-Fi is reasonably secure. No different to any other precautions a non-IoT network should do. I do a lot of IoT work at home, it is fun and safe - but, I don't trust any commercial, ethernet/Wi-Fi connected device and both my own and commercial devices have no direct route to the Internet. – Julian Knight Oct 5 '16 at 14:00
  • Interesting! I had never considered the idea of keeping them completely cutoff from internet. How do they get software updates? Is it through exceptions in Firewall or do you have a update server configured on one of your computers? – Limit Oct 5 '16 at 14:38
  • Commercial IoT devices I will update manually, as I say, I don't tend to buy them as they are expensive and typically poor quality or at least poor security. Home-built devices are updated from the local network. The bits that tie them together have their OS's connected to the Internet (a Pi and a NAS for example) and updated normally but the services that run the IoT part (e.g. MQTT brokers, databases and Node-RED) are not connected. I use a combination of server firewalls (IPTABLES) and the router firewall. – Julian Knight Oct 5 '16 at 14:42
  • If I want to connect an IoT service to the Internet, I typically use a proxy that provides a known and managed level of security via TLS. Harder to describe than it is to implement. – Julian Knight Oct 5 '16 at 14:43
1

Take a look at the following write ups for securing your home network:

  1. Three Dumb Routers
  2. Two or Three Router solution

The first one is based on a setup described in the Security Now! Podcast by Steve Gibson.

The main gist of both setups is to create two isolated networks, one for trusted nodes and another for untrusted nodes (IoT devices, webcams etc.). These setups have been reviewed by security professionals but have not been standardized in any way.

  • Urgh! Complex and potentially fairly expensive. If you want something simpler, you can do it with VLANs, many home routers support several. Although VLANs are not considered a high-security feature, they would be enough to stop most threats. Using VLANs you can isolate the virtual networks without having a physical router. A really good router such as the Ubuquity EdgeRouter Lite can easily apply different firewall rules to the different VLANs. – Julian Knight Oct 5 '16 at 12:31
  • I agree @JulianKnight. The Ubiquiti EdgeRouter X for $49 is also a good option which can be used to create isolated networks but you will still need a couple of Wireless APs behind it. I would argue that creating VLANs using one router or using something like Ubiquiti s also pretty complex for the average user. The three dumb routers setup can be accomplished with any cheap/existing Wireless APs you have lying around the house with very minimal configuration providing a low cost while minimizing tech skills required. – ARau Oct 5 '16 at 12:53
  • OK, well I've done that and it has its challenges for sure. But, as the OP has asked the question it may be doable for them. I don't think that the average household could/would though which, of course, still leaves most people who experiment with home automation badly exposed. – Julian Knight Oct 5 '16 at 13:04
  • Quite honestly, I think that simply putting the IoT devices onto a separate subnet (e.g. just changing the IP addresses used) would be sufficient for most purposes. – Julian Knight Oct 5 '16 at 13:06
  • The question wasn't specifically for my home. My home is still well taken care of but I have noticed people simply adding new gadgets to their home networks without taking any security measures. – Limit Oct 5 '16 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.