A wave of internet-connected consumer devices, from doorbell cameras to smart thermostats, has expanded the average household’s attack surface far beyond the computers and phones that security thinking traditionally focused on.
The average household now connects dozens of internet-enabled devices, from security cameras and smart speakers to thermostats and appliances, many of which run outdated software with known vulnerabilities and receive far less security scrutiny from their owners than a computer or phone typically would.
Security researchers have documented numerous cases of compromised smart home devices being conscripted into large botnets used for other attacks, or serving as an entry point for attackers to move laterally into a home network and access more sensitive devices and data.
Device manufacturers face little consistent regulatory pressure
Unlike software for traditional computers, security requirements and update obligations for internet-connected consumer devices vary considerably by manufacturer and jurisdiction, with many devices receiving security patches for only a limited period after purchase, or in some cases none at all once a product line is discontinued.
“A laptop gets security updates for years as a matter of course. A lot of smart home devices get maybe one update, if that, before the manufacturer moves on.”
Several jurisdictions have begun introducing baseline security requirements for connected consumer devices, though enforcement and adoption remain uneven globally, leaving most consumers currently responsible for managing security risks on devices that were rarely designed with straightforward security management in mind.
