I have a IOT device in my home that controls my security system and let me enable/disable it.
It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may be open or other aspects. I only interface with it that way.
The device has a built-in DDNS-like service that lets me redirect to the device without knowing my IP.
I have the following settings I can enable or disable:
ENABLE HTTPS ON CUSTOM PORT
SET DEFAULT HTTP PORT
SET "SOFTWARE" PORT
I enabled HTTPS on a high port and set the http port to 0
. However if I do that with the software port the mobile app wont work. I don't know if this port is working with https or http, or even if my mobile app connection to it is encrypted. The software port is not accessible on the browser. The HTTPS port is not accessible outside LAN by router rules.
What is the risk posed by this device if I expose it to the internet with a possibly plain HTTP port? Is there anything I can do to mitigate this risk?
My goal here is to have the device accessible externally, and communicate with it securely with the mobile app, and limit risk of it infecting other devices in my network if compromised.