I know how you feel: that irresistible need to have a smart home that responds to your commands and indulges your laziness; that unstoppable desire to control what happens inside and outside your home at any time (especially if you have a pet). Fine-but now that you've filled your house with IoT (Internet of Things) devices, are you sure you've secured them properly, or will you be among the victims featured in the next sensational article written by someone who thinks they've just discovered the existence of Shodan?
If you're not completely confident about the answer, it's worth reading the recommendations in this article for a safe coexistence with your IoT devices (especially cameras!).

Understanding home IoT

From a technical perspective, a home IoT ecosystem is composed of three main layers:

• Endpoint devices, i.e., sensors, actuators, and connected devices (cameras, smart bulbs, voice assistants, TVs, etc.);
• Local gateways or hubs, which coordinate communications within the network (home routers, Zigbee or Z-Wave hubs, NAS devices, etc.);
• Cloud services, which handle authentication, updates, storage, and analysis of data generated by the devices.

This distributed architecture introduces several critical points, because communications between devices and the cloud, for example, often rely on unencrypted or proprietary protocols, while local web interfaces or APIs may be vulnerable to classic exploits such as command injection, directory traversal, or weak authentication.
On top of that, there are manufacturers with very different levels of security expertise and policies, firmware that is rarely updated, and default configurations that prioritize ease of use over protection.

How a Wi-Fi camera works

Wi-Fi cameras are among the most widespread devices in connected homes. They can be installed in minutes, managed via apps, and promise security. Physical security, perhaps-cybersecurity a bit less so. In recent years, countless IP camera models from well-known and lesser-known brands have been involved in serious vulnerabilities, default credentials, unsigned firmware, open Telnet services, and cloud features that send data to foreign servers without the owner's knowledge.
The issue is that a home IP camera is essentially a small computer: it runs an embedded Linux system, an internal web server, a Wi-Fi module, and a video streaming service (RTSP or HTTP).

When you connect it, more happens than you might think:

• It starts an HTTP or RTSP server to allow management and streaming;
• It initiates outbound connections to the manufacturer's cloud for authentication and remote access (not always, but it can);
• It exposes ports on the local network, which on some models may remain reachable from the Internet if the router enables UPnP or automatic port forwarding.

Typically, those who end up exposing their home video streams on the Internet have purchased cameras from unreliable manufacturers that, more or less intentionally, sell a dangerous product.
In this context, the most common issues are UPnP enabled on the router, misconfigured cloud remote access, weak default credentials, and outdated firmware.
Whatever your specific problem may be, let's go through a set of checks you can apply to verify that your devices are actually configured correctly.

Concrete technical checks

Phase 1 - Before installation

• Download the latest firmware from the manufacturer's official website.
  Verify that the version corresponds to the latest available one (by checking the changelog or the model's "Support" page).
• Choose the right network: prepare a separate network or a dedicated VLAN for IoT devices.
  If your router has a "Guest Wi-Fi" option, enable it and use it for the camera.
  Avoid connecting the device to the same network as your PCs or NAS.
• Prepare a strong password: at least 12 characters, alphanumeric, with symbols. Use a password manager to store it.

Phase 2 - During initial configuration

• Connect the camera locally, without enabling remote access yet. Complete the setup via the app or web interface.
• Immediately update the firmware. If the option does not appear, check the advanced settings ("Maintenance," "Device Info," or similar).
• Change default credentials (e.g., admin/admin or user/1234). Do not reuse passwords already used elsewhere.
• Disable remote access and cloud P2P if not necessary. If you need to view the camera remotely, configure a VPN on the router (e.g., WireGuard or OpenVPN).
• Enable HTTPS or RTSPS if available. This ensures encryption of the video stream and login credentials.

From here on, we enter the "tinkerer" category. If you've never heard of Nmap or don't know how to modify your router's firewall, you can stop here: you've already done a great job and can sleep soundly.

Phase 3 - Post-installation technical checks

• Scan the device's open ports. From a computer on the same network, run:

  nmap -sV 192.168.x.x
  

  You can also search for your IP on Shodan.io to see if it is indexed.
  Disable any non-essential services (Telnet, FTP, unencrypted HTTP, etc.).

• Inspect initial network traffic. Use Wireshark or tcpdump for 5-10 minutes after connection and observe any connections to unknown domains or IPs. Block anomalous traffic via Pi-hole, pfSense, or the router's DNS/firewall rules.

• Verify stream encryption: if you see readable packets containing strings such as GET /video or RTSP/1.0, the stream is not encrypted. If the manufacturer does not support encryption, consider blocking external streaming and limiting it to the LAN.

• Check mobile app permissions. Install the app only from official stores and revoke unnecessary permissions (contacts, location, microphone).

Phase 4 - Advanced configuration and monitoring

• Isolate IoT traffic with firewall rules.
  The most effective way to limit the impact of a compromise is network segmentation. Create a separate network for all IoT devices. If your router does not support VLANs, use the "Guest Wi-Fi."
  On an OpenWRT router or similar:

  # Block IoT devices from accessing the LAN
  uci add firewall rule
  uci set firewall.@rule[-1].src='iot'
  uci set firewall.@rule[-1].dest='lan'
  uci set firewall.@rule[-1].target='DROP'
  uci commit firewall
  /etc/init.d/firewall restart
  

• Allow only outbound connections to the manufacturer's domains. Create DNS whitelists or targeted firewall rules. In case of anomalous traffic, block the IP and reboot the camera.

• Enable logging and monitoring. If the router supports Syslog, log events and periodically analyze connections. Review any unauthorized access attempts.

Phase 5 - Maintenance and periodic review

• Update firmware every 2-3 months or whenever available. Enable automatic update notifications if supported.
• Quarterly network checks with Nmap and Shodan, as shown above.

Conclusions and operational best practices

If you want to secure home IoT devices, you must adopt an architecture-aware approach. Every connected object is a node in a larger network and must be treated with the same rigor used to protect a server or a corporate endpoint.
In summary, the most effective actions remain:
• Separate IoT devices on a dedicated network;
• Regularly update firmware and applications;
• Disable unnecessary services and direct remote access;
• Use encryption and strong authentication;
• Monitor traffic and anomalous connections.

You can no longer think of digital security as optional: would you ever buy a padlock and then leave the key hanging from it? No. That's why, if you bring devices into your home that are now mini-computers in every respect, you need to be aware of what you're doing-and what they can do.
That's all for today. If you found the article useful, follow us on LinkedIn and leave a comment-your support matters to us!