The Intersection of IoT and the Cyber World

A smart speaker orders your groceries. A fitness band tracks your heart rate. A CCTV camera watches your shop after closing hours. All of these are part of the Internet of Things (IoT), a network of everyday objects that talk to each other and to the internet without needing a human to press a button. This convenience comes at a cost, though. Every connected device is also a potential doorway for a hacker, and that is exactly why cyber security has become inseparable from IoT.

What makes IoT different from regular computing 🔗

A laptop or a smartphone usually runs a full operating system, gets frequent security updates, and has a screen where you can see if something looks wrong. Most IoT devices do not work this way. A smart thermostat, a doorbell camera, or a fitness tracker is built to be cheap, small, and always on. Manufacturers often prioritise features and price over security, which means many devices ship with weak default settings and are never updated after they leave the factory.

This gap between “smart” and “secure” is what makes IoT such an attractive target. A single vulnerable device connected to a home or office network can become the weak link that lets an attacker into everything else on that network, including laptops, servers, and payment systems.

Why IoT devices are so easy to compromise 🔗

The Open Web Application Security Project (OWASP) maintains a well-known list of the most common IoT weaknesses, and a few of them show up again and again in real attacks.

Weak or default passwords 🔗

Many IoT devices come with a factory-set username and password, such as “admin” and “admin,” printed right on the box or listed in the manual. If the owner never changes it, the device is essentially left unlocked. Attackers do not even need sophisticated tools; they simply try a short list of common default credentials across millions of devices until some of them work.

Insecure network services and outdated software 🔗

Once a device is set up, it often runs in the background for years without anyone checking whether its firmware needs an update. Unlike phones, which nudge users toward regular updates, many IoT gadgets have no visible interface for patching, so known vulnerabilities remain open indefinitely.

Lack of encryption 🔗

Some devices send data, including video feeds, voice recordings, or location details, across the network without encrypting it. This means anyone intercepting that traffic can read or misuse the information.

Poor device management 🔗

Businesses that deploy hundreds of sensors or cameras often struggle to even keep track of how many devices they have, let alone monitor them for suspicious activity. An unmanaged device is effectively invisible to a security team until it starts behaving badly.

A real-world lesson: the Mirai botnet 🔗

The clearest example of what can go wrong is the Mirai botnet, which surfaced in 2016. The malware scanned the internet for IoT devices such as home routers, digital video recorders, and security cameras, then tried a short list of factory default usernames and passwords to log in. According to a technical alert from the US Cybersecurity and Infrastructure Security Agency (CISA), Mirai used a list of just 62 common default credentials to identify and infect vulnerable devices at scale.

Once infected, these devices were turned into an army of bots that flooded targeted websites and services with traffic, knocking large parts of the internet offline for hours. What made the attack so effective was not clever code but simple neglect: thousands of device owners had never bothered to change a default password. The incident is still used as a textbook case of how a small oversight in consumer electronics can snowball into a global disruption.

How India is responding to IoT security risks 🔗

As IoT adoption grows across Indian homes, hospitals, and industries, regulators have started building a formal security framework rather than leaving it entirely to manufacturers.

Mandatory testing and certification 🔗

The Department of Telecommunications, through the Telecommunication Engineering Centre, has issued a Code of Practice for Securing Consumer IoT, which requires connected devices sold, imported, or used in the country to undergo testing and certification before they reach the market. The goal is to catch weak security design, such as unchangeable default passwords, before the device is ever sold.

A dedicated certification scheme 🔗

The Standardisation Testing and Quality Certification Directorate under the Ministry of Electronics and Information Technology runs the IoT System Certification Scheme, which evaluates everything from sensors and gateways to cloud components and user interfaces. Devices are certified at different assurance levels depending on how sensitive the data they handle is, giving buyers a way to compare the security of competing products.

Incident reporting through CERT-In 🔗

When a cyber incident does occur, including one involving IoT devices, organisations are expected to act quickly. Directions issued by the Indian Computer Emergency Response Team (CERT-In) require covered entities to report qualifying cyber security incidents within a strict time window and to retain system logs for later investigation. IoT-related attacks are explicitly listed among the categories that must be reported, reflecting how mainstream this risk has become for regulators.

Practical steps to stay protected 🔗

Good IoT security does not need to be complicated. Most of it comes down to habits that any student, household, or small business can adopt.

For individuals 🔗

• Change default passwords on every new device the moment it is set up.
• Keep firmware updated by checking the manufacturer’s app or website periodically.
• Separate networks by putting smart home gadgets on a guest Wi-Fi network instead of the same one used for banking or work.
• Disable unused features like remote access or voice recording if they are not actually needed.

For businesses 🔗

• Maintain a device inventory so every connected sensor, camera, or terminal is accounted for.
• Segment networks so a compromised device cannot reach sensitive systems like payment servers.
• Monitor traffic for unusual patterns that might indicate a device has been hijacked.
• Choose certified devices where possible, favouring vendors who follow recognised security standards rather than the cheapest option on the shelf.

Why this matters for commerce and retail 🔗

IoT is no longer just a home gadget story. Retail chains use connected point-of-sale systems, warehouses use IoT sensors to track inventory, and logistics firms use GPS trackers on shipments. A breach in any of these systems does not just leak data; it can halt operations, expose customer payment details, or damage a brand’s reputation overnight. Understanding IoT security is therefore becoming a practical business skill, not just a technical one, for anyone entering e-commerce or retail management.

What do you think? If a business you managed relied on dozens of connected devices, from smart locks to inventory sensors, how would you decide which ones need the strictest security controls first? And do you think mandatory certification, like the schemes being rolled out in India, is enough to fix the default password problem, or does real change have to start with the buyer?

References

1. https://owasp.org/www-project-internet-of-things/
2. https://www.cisa.gov/news-events/alerts/2016/10/14/heightened-ddos-threat-posed-mirai-and-other-botnets
3. https://www.tec.gov.in/pdf/M2M/Securing%20Consumer%20IoT%20_Code%20of%20pratice.pdf
4. https://www.stqc.gov.in/iot-system-certification-scheme-iotscs
5. https://www.medianama.com/2025/07/223-cert-in-cybersecurity-audit-rules-india/