Smart device (IoT): what it is and how it is attacked
Everyday equipment with a network connection: cameras, sensors, door locks, TVs.
Also known as
- IoT
- internet of things
- connected device
- camera
- CCTV
- IP camera
- security camera
- sensor
- door lock
- smart TV
Typing any of them into the editor finds this object.
Why it matters on a security diagram
Bought outside IT, often with no way to update it, and usually on the same network as everything else.
How it gets attacked, and what reduces it
How it gets attacked
- Fixed passwords built into the product
- Recruitment into networks of hijacked devices
What reduces it
- Ask at purchase whether the fixed credential can be changed, and refuse products where it cannot
- Put it on its own segment with no path to anything internal
- Watch outbound traffic, since recruitment shows as traffic leaving while the device keeps working
Where it sits
- Group
- Endpoints and devices · The things people and processes touch directly.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- iot-device
Reviewed . CC BY 4.0.
Others in endpoints and devices
- Desktop computerworkstation · PC · desktopA computer somebody sits at to do their job.
- Laptopnotebook · mobile workstationA portable computer that leaves the building.
- Mobile phonesmartphone · mobile · handsetA pocket computer that reads company email.
- PrinterMFP · multifunction device · copierPrints, scans and often emails documents.
- Plant equipmentOT · ICS · SCADA · operational technologyMachinery that runs a physical process: a pump, a valve, a production line.
- Machine controllerPLC · RTU · programmable logic controllerThe small computer that tells a piece of machinery what to do.
- Door access readercard reader · badge reader · access controlReads a badge to unlock a door.
The endpoints and devices group lists all 8 of them side by side.
Smart device on your own diagram
Open the editor, press N, and type IoT. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker