In the light of recent events around Mirai not being the only IoT botnet, but being joined by IoTroop / IoT_reaper (see here and here ), I wondered what steps need to be taken to securely operate an IoT device. Obviously, just plugging the device into your public-IP internet connection is unwise. But I don't feel that this is the usual deployment scenario. My personal setup is a rather typical home-user's: ISP -> cable modem -> wireless router, and all computers/devices behind this router. This means that there is some firewalling between any given device and the internet. As far as my experience from several companies and universities goes, there is a similar amount of firewalling, if you'd plug your IoT device into any of their company-in-house-network sockets.
So, the first part amounts to the question: What (network) attack vectors need to be considered?
In the above-mentioned setup I regarded the IoT-device as not directly accessible from the internet. This does not seem to be true in the presence of an UPnP-enabled router. On several sites I found that deactivating UPnP increases your security. By my mediocre understanding what UPnP does, this seems very logical, as I don't want insecure devices to poke holes into my firewall. But the same sites that suggest turning UPnP off, never seem to mention what possible side-effects this might have. (I read that some software like Windows Live Messenger relys on UPnP?)
Without UPnP, and without manually redirecting any ports to my IoT device, it seems that my IoT-device would need to make active connections. I can imagine two reasons to make such connections: Connecting to an automatic firmware upgrade mechanism, and to connect to a manufacturer/third-party service, which allows the device to be available from outside of my LAN (e.g. like the Ivideon service).
So, the second part of the question is: Do these active connections pose a threat? (Given that any accounts on such sites have decent passwords.) Does one need to be afraid of man-in-the-middle attacks on the FW-upgrade mechanism, or maliciously altered FW-images?
But what else am I missing out?
[ Of course, there are two most-basic suggestions, one hears on a daily basis: Change default passwords and apply firmware updates (if the manufacturer even cares to provide them). ]