7 Tips to Keep Your Smart Home Safer and More Private

Credit: R. Wilson/NIST

From thermostats to baby monitors, “smart” or “connected” devices have become very common in many homes. In fact, it’s hard to find household items without connected features, as I learned when I recently shopped for a new washer and dryer.

With the convenience and fun of these tools comes potential security and privacy risks.

As the lead for NIST’s Human-Centered Cybersecurity Program, my goal is to encourage secure technology that protects people without burdening them.

As part of that effort, our team recently has worked to better understand how people think and feel about the security and privacy of smart home devices. This research is especially crucial since these devices are often placed in intimate areas of our homes, like a newborn’s nursery.

In a series of studies involving people with smart homes, we learned that our participants had several concerns about their devices but often still used them out of convenience. We also found that some people thought certain types of devices (such as smart thermostats) weren’t as important to protect — even though they really are! Finally, even participants who believed that security and privacy should be a priority were often confused about what to do to protect themselves and their devices.

The good news is you don’t have to swear off smart accessories to limit your risk. While nothing connected to the internet is completely secure, there are steps you can take to help protect yourself while still enjoying these products.

I use the practices below in my own home, and you can, too.

1. Plan Before You Buy

You should make an informed decision before you buy a smart home product. First, check with members of your household to see if they’re comfortable with the device. If it’s in your home, everyone should agree to its use.

Once you have buy-in from the people you live with, I suggest doing some market research. If you’re looking to buy a device, consider a few questions. Has that manufacturer or product had any privacy or security breaches or complaints recently? What security or privacy features does the device offer, and how can you configure those settings? These are questions you should consider before buying.

2. Enable Authentication

So, you’ve done your research and found a smart home device that fits your needs. Now, you’ll want to make sure you set up a secure way to access it. This is usually done through an app on your cellphone, tablet or computer. Some devices let you set up a password or PIN. A much better option is to use multi-factor authentication, which will help protect you if your password or PIN is exposed. For example, you might be able to verify your identity by using biometric methods, such as facial recognition or a fingerprint, that are already set up on your phone or tablet.

3. Don’t Reuse Those Passwords

You’ve probably heard this one before, but it’s worth repeating: Do not reuse your passwords! Many attacks on smart home devices, including the incidents of hackers talking to babies through connected video monitors, have been linked back to reused passwords. If you use the same password in multiple places and one is compromised, it creates vulnerability elsewhere.

4. Disable Unused Features

If your device has a feature you prefer not to use, turn that feature off if you can. For example, in my house, we’ve disabled the ability to order things directly from our voice assistants. This is an especially useful tip if you have children.

5. Monitor Your Privacy Settings

Look at the privacy settings on your smart home devices. Ideally, the manufacturer is opting you in to strong privacy settings by default. But if you can control these settings, such as how long your video or audio will be saved or whether you can prevent your information from being sent to the manufacturer, adjust them to your comfort level.

6. Update Automatically

Tech companies update smart home devices often, sometimes to fix security holes. My lab studied people’s awareness of updates, and we found that many participants didn’t even know if their smart home devices were being updated. Ideally, you want to set these updates to happen automatically, so you don’t forget. If your device is older and can no longer receive updates, you should consider replacing or retiring that item.

7. Segment Your Network

Your home Wi-Fi router is a key part of your cybersecurity plan. It should have a strong password. Also, you should consider setting up a separate network for your smart home devices. Ideally, you don’t want the network that has your computer with your sensitive financial documents to be on the same network as your smart doorbell, which might be more easily compromised. Separating the networks can take time to set up, but it’s worth the effort.

Cyber Trust Labels

In the coming years, we’ll be able to add an additional tip to this list — look for the U.S. Cyber Trust Mark. NIST has used our cybersecurity expertise to contribute criteria for this forthcoming security label for smart devices. The Federal Communications Commission is now finalizing the actual label. Once it’s placed on products, consumers can look for the label and know that the device has met some important security standards.