20

According to this Kaspersky blog post, it is a security risk to connect IoT devices, such as Smart TVs, to my home WiFi. It claims I should use my guest WiFi network for this.

Is this true? Is it a security risk to use my regular network to get internet to my TV?

  • 3
    Note that if you do this you likely won't be able to control your smart TV from your phone, if that is something that you want to do. Well, you can if you also connect your phone to your guest network... – Conor Mancone Sep 1 at 19:13
  • 1
    The article says "it's a better idea to connect to an IoT device to a guest network", in the context of setting one up for actual guests. I think this is a reasonable answer. How much of a risk is it? It's hard to quantify. The highest risk would be any device accessible directly on the internet. i.e. open ports. I'd put that risk as "high". Indirect access via a service provider (Nest, etc) is as secure as the service provider. – Steve Sether Sep 1 at 20:08
  • 3
    As @ConorMancone mentioned, one drawback is that some devices require control from other devices. E.g. I have a chromecast smart TV which requires control from my phone or laptop, so therefore it's not feasible to use it on a separate network. – Jon Barker Sep 18 at 13:38
  • 1
    @ConorMancone - of course, if you have device isolation enabled on your guest WiFi, you won't be able to control it from your phone there, either – warren Sep 23 at 15:54
  • 2
    Sounds like a good idea. My only concern is that for many devices, like TV, Roku box, etc, I use a wired connection (one of 4 ethernet ports), and there is no "Wired Guest Network" option. :( – Alec Sep 24 at 15:16
21

Using a guest WiFi for IoT devices is essentially just a practical, easy to understand implementation for network segmentation. The goal is to prevent lateral movement between and from IoT devices. As a typical user isn't aware of such terminology and how this should be implemented, this might actually be a good tip.

However, in order to increase security, using this recommendation has some prerequisites:

  1. The home router must have a guest network feature, obviously, but not every router has it.
  2. The guest network must be isolated from the home network.
  3. Ideally, all devices on the guest network should be isolated from each other, too.

Ziv Chang (Trend Micro): Inside the Smart Home: IoT Device Threats and Attack Scenarios sums up some typical security measures for IoT devices, the network segmentation among them:

  • Map all connected devices. All devices connected to the network, whether at home or at the enterprise level, should be well accounted for. Their settings, credentials, firmware versions, and recent patches should be noted. This step can help assess which security measures the users should take and pinpoint which devices may have to be replaced or updated.
  • Change default passwords and settings. Make sure that the settings used by each device are aligned toward stronger security, and change the settings if this is not the case. Change default and weak passwords to avoid attacks like brute force and unwanted access.
  • Patch vulnerabilities. Patching may be a challenging task, especially for enterprises. But it is integral to apply patches as soon as they are released. For some users, patches may disrupt their regular processes, for which virtual patching could be an option.
  • Apply network segmentation. Use network segmentation to prevent the spread of attacks, and isolate possibly problematic devices that cannot be immediately taken offline.
| improve this answer | |
  • 7
    Point 3 is an important one: putting TVs (... etc) on a guest network may work fine, but often guests can't communicate to each other so you may not be able to put (for example) a Chromecast or security camera on a guest network because nothing else will be able to communicate with it (except over the internet). If you have this feature on your router and can't (or don't want to) disable it, you should set up a second subnet and wifi router firewalled from the first for "things you don't trust but want to be able to talk to each other" – pcdev Sep 23 at 2:19
7

The premise of the question is slightly wrong. A better way to ask is as follows:

  • Should my TV or other IoT device connect to my main home network? NO.
  • Should it connect to the my guest wifi? Again, NO.

Ideally, you want IoT devices to connect to their own separate IoT network. Rationale: The question inherently assumes the guest network is password protected. It might be an open guest network (mine is).

Either way, you don't want house guests turning on/off lights, security cameras, heating or other smart devices in your home. Nor should they have access the admin consoles of any network device in your home - especially the network router! Guests should have throttled internet access and nothing else on the guest wifi. Guest networks should be configured so that guest wifi client can not see other clients on the guest network. This is a standard feature on many guest wifi wizards, in my experience.

Set up an additional dedicated IoT network in your home instead. By proper use of VLANs and firewall rules, you can isolate your IoT devices to their own network (perhaps grant them limited internet access for software updates where necessary) Proper use of VLANs and firewall rules can still allow you to control your devices from your main WiFi network. Not all consumer network devices will have these sort of capabilities, but higher-end gear will.

I have this sort of configuration in my home. Main Wifi, Guest (which is isolated and open) and a dedicated IoT network for smart devices.

| improve this answer | |
  • Or you could not let guests use your guest network – schroeder Sep 23 at 15:50
0

It's always sensible to consider the risk of consumer devices exfiltrating sensitive info from other machines on your network; or, in a worst-case, providing a route into your network for an active attacker (though the latter normally requires the attacker to work for, or infiltrate, the device's manufacturer, so that's a fairly long shot).

However, be proportionate: is there actually data freely accessible on your network that's sensitive enough to need protection?

Let's say the only other devices on your network are the router, a PC and maybe a smartphone or two. These have their own firewalls, and only allow communication from other devices in ways laid down by the manufacturer/operating-system vendor, and normally subject to the user's control.

Where you do set them up to allow access (e.g. for Windows file and printer sharing), you can do this in a controlled manner, requiring credentials for access. If you want the TV to access media stored on your PC, you can tell the PC to share only the folder that holds those media files.

If there is no such sharing in place, your TV will only be able to see some basic metadata about your network: what type of other machines are on it, at what times, and so on.

If you can't be confident that your other devices are adequately protected against undesired access, and they hold data that is sensitive enough that you absolutely cannot take the risk of compromise, then using the guest-network is a simple remedy.

If you still require some communication between the TV and the network, you can give your router the job of controlling which specific devices are allowed to contact each other. This level of control isn't always available with consumer wifi routers, but a replacement can be had quite cheaply: either buy second-hand (although bear in mind the device could be compromised), or get one of the cheap consumer models that can be modified to run openwrt or similar highly-configurable open-source firmware.

| improve this answer | |
0

Make 3 (or more) networks:

  • Main (for family use: trusted devices)
  • Guests (For guests)
  • IoT (for smart devices such as tv's)

Set your firewall rules to accomplish the following:

  • Main has access to Main, IoT and WAN
  • Guests has access to WAN, only on specific ports such as 80 and 443
  • IoT only has access to IoT, don't let the devices 'call home'
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.