Smart home devices sit on the same network as work laptops and family phones, yet most are bought on price, set up in minutes and never looked at again. Cameras, doorbells, speakers, plugs, thermostats, locks and hubs each bring an app, a cloud account, a radio and firmware that the owner rarely sees updated. This guide covers the regulation that now sets a floor for these products (the UK PSTI regime, ETSI EN 303 645 and the US Cyber Trust Mark, with its current status), how to choose devices, how to set up and segment a home network, and how to keep it working over time. It is written for security practitioners securing their own homes and home offices, for teams writing remote-worker standards, and for product and procurement staff who need the regulatory picture. For the wider device landscape see the IoT Security Guide; this page goes deeper on the consumer home.
Key takeaways
- The account is the real perimeter. Most smart home compromises reach devices through the vendor app or cloud account, so a unique password and 2-step verification on that account matter more than anything on the device itself.
- The UK now bans universal default passwords. Since 29 April 2024 the PSTI regime requires unique or user-set passwords, a published way to report vulnerabilities and a stated minimum security update period for consumer connectable products sold in the UK.
- The support end date is a purchase criterion. A device without security updates is a liability; check the published update period before buying and plan replacement when it ends.
- Segment rather than trust. A separate SSID or VLAN for smart devices limits what a compromised camera or plug can reach, including work devices on the same broadband line.
- The US label is still settling. The FCC Cyber Trust Mark is voluntary, its first lead administrator withdrew at the end of 2025 and a new one was named in April 2026, so treat the label as a useful signal rather than a guarantee.
What makes the smart home different
A smart home is not a small enterprise network. There is no administrator, no asset register and no patch window, and the devices are built for a frictionless first-run experience. Four properties shape the risk.
- Cloud-mediated control: most devices are controlled through a vendor cloud and a phone app. Credentials for that account (often a reused email and password) unlock every device on it, and shared household access is frequently done by sharing one login rather than inviting separate users.
- Long life, short support: a thermostat or doorbell may stay on the wall for ten years while the vendor supports it for far less, or exits the market entirely.
- Sensitive sensors: cameras, microphones, presence sensors and locks generate data about the household and control physical access, so the impact of compromise is privacy and physical safety, not just data loss.
- Flat networks: the default home router puts every device on one LAN with the work laptop, NAS and phones, and Universal Plug and Play (UPnP) can open inbound ports without the owner knowing.
Devices also act as machine identities: each holds credentials, certificates or tokens to its cloud service. The Device and IoT Identity Guide covers how those identities should be issued and protected at the manufacturer end.
Threats to connected home devices
| Threat | How it happens | ATT&CK reference | Primary control |
|---|---|---|---|
| Default or weak credentials | Automated scanning tries factory passwords on exposed Telnet, SSH or web interfaces | T1078.001 Default Accounts, T1110.001 Password Guessing | Unique per-device passwords (ETSI 5.1-1, PSTI), no exposed admin services |
| Botnet recruitment | Compromised cameras and routers are enrolled into botnets and used for traffic floods | T1584.005 Botnet, T1498 Network Denial of Service | Patching, closing inbound ports, segmentation. See the Botnets Guide. |
| Exploited firmware flaws | Unpatched web interfaces or services reachable from the internet via UPnP or port forwarding | T1190 Exploit Public-Facing Application | Automatic updates, UPnP off, support period checked before purchase |
| Account takeover | Credential stuffing against the vendor app account using passwords leaked elsewhere | T1110 family (credential access) | Unique password, 2-step verification, per-person user invites |
| Interception on the LAN | Unencrypted local protocols or weak Wi-Fi allow traffic capture or manipulation | T1557 Adversary-in-the-Middle | WPA3 or WPA2-AES, devices using encrypted communication (ETSI 5.5) |
| Abuse by people with access | Former partners, housemates or previous owners retain app access to cameras and locks | Not an ATT&CK technique | Review shared users, factory reset on transfer, remove old accounts |
The last row deserves emphasis. In practice the person most likely to misuse a home camera already has, or once had, legitimate access to it. Access reviews are as relevant at home as at work.
Regulation and labels: PSTI, ETSI EN 303 645 and the Cyber Trust Mark
UK: the PSTI product security regime
Part 1 of the Product Security and Telecommunications Infrastructure Act 2022 and the Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (SI 2023/1007) came into effect on 29 April 2024. They apply to manufacturers, importers and distributors of relevant connectable products made available to UK consumers. The three security requirements are:
- Passwords: passwords must be unique per product or defined by the user, and must not be based on incremental counters or publicly available information.
- Reporting security issues: the manufacturer must publish how to report security issues, with expected timescales for acknowledgement and status updates.
- Minimum security update periods: the manufacturer must publish the minimum period for which security updates will be provided, stated so the end date is clear.
Enforcement sits with the Office for Product Safety and Standards (OPSS). Its tools include compliance, stop and recall notices, monetary penalties of up to the greater of £10 million or 4% of qualifying worldwide revenue, a daily penalty of up to £20,000 for continuing non-compliance, and court forfeiture orders.
ETSI EN 303 645: the baseline behind the law
ETSI EN 303 645 (current version V3.1.3, September 2024) is the European standard for consumer IoT baseline security. The three PSTI requirements correspond to its first three provision groups, and the standard goes further. The full list is below; it is the most useful single checklist for judging a device. The ETSI EN 303 645 Consumer IoT Guide covers conformance assessment in depth.
| Clause | Provision group | What a buyer can check |
|---|---|---|
| 5.1 | No universal default passwords | Unique password on label or forced change at setup (5.1-1, 5.1-2) |
| 5.2 | Manage reports of vulnerabilities | Published vulnerability disclosure policy with contact and timelines (5.2-1) |
| 5.3 | Keep software updated | Automatic or simple updates, published support period (5.3-13) |
| 5.4 | Securely store sensitive security parameters | Vendor states credentials and keys are not hard-coded |
| 5.5 | Communicate securely | Encrypted cloud and app traffic |
| 5.6 | Minimise exposed attack surfaces | No unnecessary open ports or debug services |
| 5.7 | Ensure software integrity | Signed firmware, secure boot where described |
| 5.8 | Ensure that personal data is secure | Clear statement of what is collected and where it goes |
| 5.9 | Make systems resilient to outages | Device keeps core local function (a lock still locks) if the cloud is down |
| 5.10 | Examine system telemetry data | Vendor monitors for anomalies |
| 5.11 | Make it easy for users to delete user data | Documented factory reset that removes personal data |
| 5.12 | Make installation and maintenance easy | Secure defaults without expert configuration |
| 5.13 | Validate input data | Not visible to buyers; ask in procurement |
US: the Cyber Trust Mark
The FCC established the voluntary US Cyber Trust Mark programme by Report and Order in March 2024, building on NIST IR 8425, the consumer profile of the IoT core baseline. NIST IR 8425 sets six product capability outcomes (asset identification, product configuration, data protection, interface access control, software update, cybersecurity state awareness) and four developer outcomes (documentation, information and query reception, information dissemination, product education and awareness). Status as of October 2026: the first lead administrator, UL Solutions, made recommendations to the FCC in June 2025 and withdrew from the role at the end of 2025; the FCC opened a new application window in January 2026 and announced ioXt Alliance as lead administrator in April 2026, with a public product registry described as being developed and expanded. Practitioners should check the FCC programme page for the current state before relying on the label in procurement.
EU
In the EU, the Radio Equipment Directive delegated act (Regulation (EU) 2022/30) has applied cybersecurity requirements to internet-connected radio equipment from 1 August 2025, and the Cyber Resilience Act's main obligations for products with digital elements apply from 11 December 2027. Both are summarised here only for orientation; see the IoT Security Guide.
Choosing devices: a buying checklist
The cheapest moment to fix smart home security is before purchase. Use these checks, in order of weight.
- Published support end date: under PSTI it must be stated. Prefer a period that covers the expected life of the device. If it cannot be found, treat the device as unsupported.
- Vulnerability disclosure policy: a vendor that publishes one and issues advisories is more likely to fix flaws.
- Account security: the vendor app supports 2-step verification and separate invited users with roles, rather than shared logins.
- Local function: locks, heating and alarms should keep working without internet access (ETSI 5.9).
- Standards-based ecosystem: devices certified for an interoperability standard such as Matter (IP-based, over Wi-Fi or Thread, with Bluetooth Low Energy commissioning and a certification scheme including a Distributed Compliance Ledger) reduce dependence on a single vendor hub.
- Data handling: where video and audio are stored, whether end-to-end encryption is offered for recordings, and how to delete data.
- Second-hand devices: only buy if a full factory reset and removal from the previous owner's account can be confirmed.
| Device type | Main risk | Priority setting |
|---|---|---|
| Cameras and doorbells | Privacy of video and audio, account takeover | 2SV on account, recording encryption if offered, review shared users |
| Smart locks and alarms | Physical access | Local fallback, audit log of entries, revoke codes promptly |
| Voice assistants and speakers | Audio capture, purchases by voice | Microphone mute, voice purchase PIN, review stored recordings |
| Plugs, bulbs, sensors | Botnet foothold, pivot on LAN | IoT network segment, automatic updates |
| Hubs and routers | Control of everything behind them | Admin password, firmware updates, UPnP off, remote admin off |
Setting up a secure smart home network
The router is the most important device in the home. Harden it first, then add devices.
- Router baseline: change the admin password, disable remote administration from the WAN side, disable WPS, enable automatic firmware updates and replace routers that no longer receive them. See the Wi-Fi Security Guide.
- Wireless encryption: WPA3-Personal (SAE) where all devices support it; otherwise WPA2/WPA3 transition mode or WPA2 with AES (CCMP), never WEP or TKIP. Many low-cost devices only support 2.4 GHz WPA2, which is one reason to put them on their own network.
- Segmentation: put smart devices on a separate SSID: a guest network with client isolation is the simple option, a dedicated VLAN with firewall rules the stronger one. Allow the IoT segment outbound internet and block it from initiating connections to the main LAN. Controllers and phones may need mDNS or a reflector to discover devices across segments; test this before tightening.
- Inbound exposure: disable UPnP and remove manual port forwards for cameras and NAS units. Use the vendor's cloud relay or a VPN for remote viewing instead. See the Home Office and Remote Worker Security Guide.
- DNS: a filtering DNS resolver on the router blocks known malicious domains for every device, including those that cannot run security software.
- Accounts: a unique password from a password manager and 2-step verification on every vendor account; invite household members as separate users and remove them when they leave. See the MFA Guide.
Rolling it out: a phased approach
- Inventory (week 1): list every connected device from the router's client list, with vendor, model, account owner and support end date. Unknown MAC addresses are identified or removed.
- Accounts first (week 1): secure the email account behind all vendor accounts, then each vendor account with a unique password and 2SV. Review and remove shared users.
- Router hardening (week 2): apply the router baseline above. Note the original settings so they can be restored.
- Pilot segmentation (week 2): move two or three non-critical devices (a plug, a bulb) to the IoT segment and confirm they work, including app control from outside the home and voice assistant integration.
- Full migration (week 3): move the remaining devices. Cameras and locks last, after confirming remote access and notifications still work. Rollback is simple: reconnect a device to the main SSID if it fails, then troubleshoot discovery rather than abandoning the segment.
- Retire unsupported devices (ongoing): anything past its support end date is replaced or isolated with no inbound access. Factory reset and remove from the account before disposal.
Small vs large: a single household can rely on a guest network with isolation. Organisations setting standards for remote workers should specify outcomes (work device separated from smart devices, router firmware supported) rather than products, and should treat home networks as untrusted regardless, which is the zero trust position.
Monitoring and measurement
Home monitoring is light, but it is not nothing. The router client list, vendor app activity logs, lock entry logs and camera sharing settings are the main signals. Watch for new unknown clients, login alerts from vendor accounts, and unexpected outbound traffic volumes from a single device (a common sign of botnet activity).
| Metric | Target | Why it matters |
|---|---|---|
| Devices with known support end date | 100% | Unknown support means unknown patching |
| Devices past support end date still connected | 0, or isolated | Unpatchable flaws accumulate |
| Vendor accounts with 2SV enabled | 100% where offered | Account takeover is the main route in |
| Smart devices on the IoT segment | 100% | Limits lateral movement to work devices |
| Inbound port forwards and UPnP mappings | 0 | Direct internet exposure invites scanning |
| Shared users reviewed | Every 6 months and on any household change | Removes stale access to cameras and locks |
Framework mapping
| Smart home control | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ETSI EN 303 645 |
|---|---|---|---|
| Device inventory | ID.AM-01 | CM-8 | Supports 5.3 support-period tracking |
| Unique passwords and 2SV | PR.AA-01 | IA-5 | 5.1 |
| Updates and retiring unsupported devices | PR.PS-02 | SI-2, SA-22 | 5.3 |
| Disable unused services, UPnP, remote admin | PR.PS-01 | CM-7, CM-2 | 5.6 |
| Encrypted communication | PR.DS-02 | SC-8 | 5.5 |
| Vulnerability reporting by vendors | ID.RA-08 | RA-5 | 5.2 |
Common failure patterns
- Securing the device, not the account: the device password is changed but the vendor account uses a reused password without 2SV, so an attacker logs in from anywhere.
- Port forwarding for remote viewing: a camera or NAS web interface is exposed directly to the internet and is found by scanners within hours.
- Buying on features, ignoring support: the device is cheap because it has no meaningful update commitment, and stops receiving fixes within a year or two.
- One flat network with the work laptop: a compromised plug or camera can scan and attack the corporate device on the same LAN.
- Stale shared access: previous tenants, owners or partners keep app access to cameras and locks because nobody reviews the user list.
- Disposal without reset: devices are sold or recycled still linked to the account, with Wi-Fi credentials and recordings on board.
Practitioner checklist
- Inventory every connected device with owner account and published support end date.
- Secure the email account behind all vendor accounts, then enable 2SV on each vendor account.
- Replace shared logins with invited users and review them every six months.
- Harden the router: admin password, WPS off, remote admin off, UPnP off, automatic updates on.
- Use WPA3 where supported, otherwise WPA2-AES, and put smart devices on a separate isolated segment.
- Remove all port forwards for cameras and storage; use the vendor relay or a VPN for remote access.
- Before buying, check the PSTI support period, vulnerability disclosure policy and local fallback.
- Replace or isolate devices past their support end date, and factory reset before disposal.
Standards and references
- GOV.UK: The UK Product Security and Telecommunications Infrastructure (PSTI) product security regime
- ETSI: EN 303 645 Cyber Security for Consumer Internet of Things: Baseline Requirements
- NIST: IR 8425 Profile of the IoT Core Baseline for Consumer IoT Products
- NCSC: Smart devices: using them safely in your home
- Covington Global Policy Watch: FCC opens application window for new Cyber Trust Mark lead administrator
- ioXt Alliance: FCC names ioXt Alliance lead administrator for US Cyber Trust Mark program
- Connectivity Standards Alliance: Matter
Related NHI Mgmt Group resources: IoT Security Guide · ETSI EN 303 645 Consumer IoT Guide · Wi-Fi Security Guide · Home Office and Remote Worker Security Guide · Device and IoT Identity Guide. This guide summarises the PSTI regime and related labelling schemes and is not legal advice.