| IoT security is the practice of protecting the connected devices on a business network that nobody logs into or patches: cameras, sensors, smart TVs, door controllers and payment terminals. These devices rarely run security software, so the protection has to be built around them. |
Count the things on your network that have an IP address and no keyboard.
A small office turns up eight or nine without trying. Four security cameras, a video doorbell, the meeting room display, two printers, an eftpos terminal, the heat pump controller and whatever the landlord installed in the ceiling.
Now name the last person who logged into any of them. For most businesses the honest answer is the installer, on the day it went in.
Those devices are the gap. Your laptops get patched, your servers get monitored and your staff get trained, while a camera running firmware from 2021 sits on the same network with a password printed in a manual anyone can download.
In April 2026 the National Cyber Security Centre joined fifteen international partners in an advisory on covert networks, the large-scale device networks, commonly called botnets, that are used to hide malicious activity. It names what those networks are built from: small office routers, internet of things and smart devices, firewalls, and network attached storage.
Read that list again. Cameras and storage boxes appear on it because they make useful infrastructure for somebody else’s attack, whatever they happen to record.
What Is IoT Security in a Business Setting?
IoT security is the set of controls that protect connected devices which cannot protect themselves. The internet of things, usually shortened to IoT, covers any device that reports to a network without a person driving it.
What these devices share has nothing to do with what they are for. You cannot install anything on them, cannot see inside them, and often cannot change how they behave.
A laptop tells you it needs updating. A camera says nothing at all, for years, and keeps sending pictures the whole time.
Which devices count as IoT in a normal business?
More than owners expect, because the label rarely appears on the purchase order. Anything below is on the list.
- Security cameras and video doorbells, along with the recorder they write to.
- Printers and multifunction devices, which hold scanned documents and often a web interface.
- Eftpos and payment terminals, and the tablets running a point of sale app.
- Access control: door readers, electric strikes and the intercom at the gate.
- Building services, meaning heat pumps, lighting controllers, alarm panels and irrigation timers.
- Meeting room displays, smart TVs and the conferencing bar under the screen.
- Network attached storage, or NAS, the box in the cupboard holding backups and shared files.
The last two on that list surprise people. A smart TV is a computer with a browser and a microphone, and a network attached storage box is a Linux server that nobody administers.
What Are the Biggest IoT Security Risks?
The biggest IoT security risks come from devices being useful, always on and unwatched, which is a different problem from data theft. An attacker who takes a camera gains a machine inside a real business network that nobody is looking at.
It gets put to work straight away. The device relays traffic so other attacks appear to come from a legitimate New Zealand address, it holds a dormant foothold for later, and it scans the network it sits on.
The economics favour the attacker. Finding one unpatched camera model gives access to every business that bought it, and the search costs nothing.
One line in the advisory explains the scale. These networks are assembled by third parties and rented out for anything from distributed denial of service attacks to network reconnaissance, so the person using your camera may never have chosen it.
For a small business that changes the risk calculation. Nobody picked you, and nobody is going to skip you either, because the whole thing runs on scanning for models with known holes.
What does an attacker do with a hacked camera?
Usually nothing you would notice. The device keeps working, the picture keeps recording, and the only sign is traffic leaving at odd hours to places your business has no reason to reach.
The damage arrives later. A foothold that sat unused for three months becomes the route to a file server, and the incident report has to explain a device nobody could name.
Some businesses find out from their internet provider. Traffic from a conscripted device draws a complaint, and the first conversation about IoT security happens with a service desk asking why.
Why Can’t You Just Install Antivirus on These Devices?
Because there is nowhere to install it. Security software needs an operating system that accepts third-party code, and a camera or a door controller runs sealed firmware with no way in.
Two different disciplines meet here. Managed computers are covered by endpoint security, where an agent reports back, and everything in this post is about the devices no agent can reach.
So the control moves off the device and onto the network around it. You cannot harden the camera, but you can control what it talks to, and that turns out to be enough.
The vendor app is not a substitute. A phone app that shows you the camera feed proves the device is reachable, while telling you nothing about whether the firmware is current or who else has logged in.
What happens when the manufacturer stops issuing firmware?
The device keeps working and stops being fixable, which is the most common IoT security problem in small business. A camera range sold in 2019 may have had its last firmware in 2022.
After that date every vulnerability found is permanent. No patch is coming, and the device will happily run for another decade because the lens still works.
This turns security into a replacement decision, which is a budget conversation. Sixteen cameras at $400 a unit is $6,400 to replace a fleet that still produces a perfectly good picture.
That is a hard sell when the equipment looks fine. The practical answer is to date the fleet, find the end-of-support year for each model, and put replacement in the capital plan before the auditor or the insurer asks.
How Do You Find Every Connected Device You Own?
Start with a network scan, then walk the building, because neither method finds everything on its own. The scan sees what is switched on and the walk finds what is on a separate connection nobody documented.
Most businesses discover two or three devices they had forgotten. A camera at the back of a store that was left when the tenancy changed, or a printer in a cupboard still holding scanned records.
The walk matters because of the ones installed by somebody else. Alarm companies and landlords put connected equipment on premises, and so do vending and coffee machine suppliers. All of it lands on your network.
What should a device inventory record?
Enough to make a decision without going back to the cupboard: what the device is, where it sits, its model and firmware version, who installed it, who can log in, and the year support ends.
That last field is the one nobody fills in and the one that drives the budget. A list without support dates tells you what you own and not what you have to do about it.
Keep it somewhere your provider can see. An inventory in one person’s spreadsheet stops working the week that person leaves.
How many suppliers can reach your network?
More than the inventory suggests, because remote access is usually installed as a convenience and never reviewed. The alarm company, the camera installer, the heat pump technician and the point of sale vendor may all hold a way in.
Each of those paths was set up for a good reason on the day. The problem is that none of them expires, and the person who used it last may have left that company years ago.
Ask every supplier three things: who at your end authorised the access, what it reaches, and how it is logged. If they cannot answer the third one, you have no way to audit what they did.
Where the access is needed, put it behind something you control. Give them a named account you can switch off, so removing the access later takes one minute and no phone calls.
What Should You Ask Before Buying a Connected Device?
Ask how long it will get security updates, and get the answer in writing before the purchase order. Price and picture quality are easy to compare in a showroom, while support lifetime sets what this device will cost you over eight years.
Four questions separate a device you can run from one you will be stuck with.
- Until what date will this model receive security updates? If the vendor cannot say, assume the answer is the day you buy it.
- Does each unit ship with a unique password, or does the whole product line share one?
- How do I report a vulnerability, and has the vendor published a disclosure policy?
- Does the device need to reach the internet to work, or only to be convenient?
That last one is worth pressing. Plenty of cameras and controllers run perfectly on a local network and phone home only for a remote-viewing app the business never uses.
One more habit deserves attention at purchase time. Installers frequently set the same password across every device they commission, so a fleet of twelve cameras has one credential between them.
One leaked credential then opens the whole fleet. Ask for unique credentials per device, get them handed over in writing, and store them where your team can find them.
Is there a security standard for connected devices?
Yes. ETSI EN 303 645, currently at version 3.1.3 published in September 2024, sets baseline cyber security requirements for consumer internet of things devices.
Its leading provisions are the ones a buyer can check without a lab: no universal default passwords, a published way to report vulnerabilities, and software that can be kept updated.
The standard notes that shared default credentials across a product line have caused many IoT security problems and that the practice needs to stop. A unique per-device password satisfies the provision.
You do not need to read the document. Ask the vendor whether the product was built against it, because a supplier who knows the standard will answer the update-lifetime question without checking.
What Privacy Rules Apply to CCTV and Security Cameras?
The Privacy Act applies to CCTV, because a camera collects personal information about identifiable people. That puts your camera footage in the same legal category as your customer database, which is the part most businesses miss.
The consequence is a right of access. Under privacy principle 6 a person can ask for footage of themselves, and the Office of the Privacy Commissioner’s guidance on CCTV access requests says the starting point is that you give it to them.
That guidance turns a camera purchase into a technical decision. You must secure the relevant footage as soon as a request arrives so it is not overwritten, and lacking the ability to blur other people in the frame is not accepted as a reason to refuse.
Newer systems include facial blurring in the management software and older ones do not, so add it when you next upgrade. Deliberately allowing footage to be deleted once a request has been made is an offence carrying a fine of up to $10,000.
Put that beside the price of a recorder. A system chosen on cost alone can turn a routine request into a bill and a complaint.
Where Should Connected Devices Sit on Your Network?
On their own segment, with rules that let them do their job and nothing else. A camera needs to reach its recorder, and it has no business reaching your file server.
The mechanics of zoning a network are covered in our post on network security, and the rules are enforced at the managed firewall where somebody reviews them. Visitor traffic is a separate question again, handled in guest WiFi.
The IoT-specific part is what the rule should say. Allow the device to its controller, allow the updates it needs, deny the rest, and log what gets denied so you find out when a device starts behaving differently.
One practical trap: putting cameras on the guest network because it is already separate. Guest networks are built to give strangers internet access, which is the opposite of what a camera needs.
What if a device has to be reachable from outside?
Put it behind a connection you control instead of opening a port to it. Forwarding a port to a recorder publishes that device to the entire internet, and scanning services index it within hours.
The alternative is a virtual private network, shortened to VPN, or the vendor’s own relay service if it supports one properly. Staff connect to the business first and reach the device from inside.
On most small networks this change does more than anything else on the list. A recorder that was directly exposed and now sits behind a VPN has stopped being findable at all.
Check what is already exposed before assuming none of it is. Installers open ports to make remote viewing work on handover, and nobody closes them afterwards.
How would you know if a device had been compromised?
From its traffic, because the device itself will not tell you. Watch for a camera that suddenly talks to an address in another country, at volume, in the small hours.
That means somebody has to be watching the boundary and know what normal looks like for each segment. Logging denied traffic gives you the baseline, and monitoring turns the baseline into an alert.
Without it the discovery route is external. An internet provider notice, a blocklist entry or a customer complaint all arrive after the device has been working for somebody else for weeks.
What Does It Cost to Get IoT Security Under Control?
Less than most owners assume for the first pass, because discovery and segmentation are configuration work on equipment you already own. Replacement costs real money, and you can stage it across budget years.
| What you are buying | What it covers | Indicative range |
|---|---|---|
| Device discovery and inventory | Network scan, building walk, six-field register with support end dates | $1,200 to $3,500 one off |
| Segmentation and rules | Device network, firewall rules, logging of denied traffic | $1,500 to $6,000 one off |
| Credential and firmware pass | Replace shared passwords, update every device that still can be | $800 to $2,500 one off |
| Ongoing monitoring | Watching device traffic and alerting on new or unusual behaviour | $150 to $600 per month |
| Fleet replacement | Swapping devices past end of support, staged by risk | $300 to $900 per device |
Something else is starting to force the issue. Insurers and larger customers now ask what is on your network and how it is separated, and a contract questionnaire is a poor place to discover you cannot answer.
Those ranges suit a business with ten to forty connected devices on one or two sites. Read them against a single compromised device, where the cost is incident response plus the time spent explaining it to a customer.
What can you do this week for nothing?
Two things, both free. Walk the building and write down every device with a network cable or a WiFi connection, then log into the three that matter most and change the password.
Write the date beside each entry as you go. A list with dates on it becomes a plan, because you can sort it by age and start at the top.
The recorder behind your cameras is usually the right place to start. It holds the footage, it frequently has a web interface open, and it is the device most likely to still be on factory credentials.
Get the Devices Nobody Is Managing Under Control
Exodesk has supported South Island organisations since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. We find what is on your network, put the devices somewhere they can do no harm, and tell you which ones are past saving. Our cyber security work covers the monitoring that watches them afterwards.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What does IoT stand for?
IoT stands for internet of things, meaning physical equipment that connects to a network and reports data without a person operating it. In a business that covers cameras, printers, payment terminals, door readers, building controllers and smart displays. The common thread is that no one logs into them.
Why is IoT security different from normal cyber security?
Normal cyber security assumes you can install software on the thing you are protecting. Connected devices run sealed firmware that accepts no security agent, so the controls have to be applied to the network around them instead of on the device itself.
How do I find all the connected devices on my network?
Run a network scan and then walk the building, because each method misses what the other finds. The scan lists what is powered on and responding, and the walk catches equipment installed by alarm companies, landlords or suppliers that never made it onto any register.
Do IoT devices need antivirus software?
No. Almost none of them can run it, so protection comes from segmenting them onto their own network, controlling what they are allowed to reach, and monitoring their traffic. Anyone selling you antivirus for a camera is selling you something else. The exception is a device running a full operating system, such as a Windows-based recorder, which should be treated as a computer.
What is the most common IoT security mistake?
Leaving the credentials the device shipped with. Shared default passwords are published in manuals and vendor forums, so a device still using one is reachable by anybody who identifies the model. The recorder behind a camera system is the usual offender.
Is there a security standard I can ask suppliers about?
Yes. ETSI EN 303 645 sets baseline cyber security requirements for consumer internet of things devices, and its leading provisions are no universal default passwords, a published vulnerability disclosure process, and software that can be updated. Asking whether a product was built against it tells you a lot about the supplier.
What happens when a device stops getting firmware updates?
Every vulnerability found after that date stays open permanently, because no fix will be issued. The device carries on working normally, which is why these devices survive for years past the point where they should have been replaced. Treat the end-of-support year as the retirement date and budget for it.
Do security cameras create legal obligations in New Zealand?
Yes. Camera footage is personal information about identifiable people, so the Privacy Act applies and individuals can request footage of themselves under privacy principle 6. You also have to secure the relevant footage as soon as a request arrives, and allowing it to be deleted afterwards is an offence.
Can I put my cameras on the guest WiFi to keep them separate?
No, and it is a common mistake. A guest network is designed to hand strangers an internet connection, while a camera needs a tightly controlled path to its recorder and nothing else. Connected devices need their own segment with their own rules.
How much does it cost to secure IoT devices?
Discovery and segmentation with a credential pass typically run $3,500 to $12,000 as one-off work for a business with ten to forty devices, because most of it is configuration on equipment you already own. Ongoing monitoring adds $150 to $600 a month. Replacing devices that are past support is the larger and more predictable cost.
Who is responsible for a device the landlord installed?
If it sits on your network it is your security problem, whatever the lease says about who owns the hardware. Document the make and model, find out who holds the admin login, and if the landlord’s contractor keeps remote access, put that connection on a segment of its own.
Can Exodesk help a Christchurch or Dunedin business with this?
Yes. Exodesk works with organisations across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, and has operated in the South Island since 1989. We handle discovery, segmentation, the credential and firmware work, and the monitoring that follows.
