Should I only let my TV connect to the guest WiFi?

Using a guest WiFi for IoT devices is essentially just a practical, easy to understand implementation for network segmentation. The goal is to prevent lateral movement between and from IoT devices. As a typical user isn't aware of such terminology and how this should be implemented, this might actually be a good tip.

However, in order to increase security, using this recommendation has some prerequisites:

  1. The home router must have a guest network feature, obviously, but not every router has it.
  2. The guest network must be isolated from the home network.
  3. Ideally, all devices on the guest network should be isolated from each other, too.

Ziv Chang (Trend Micro): Inside the Smart Home: IoT Device Threats and Attack Scenarios sums up some typical security measures for IoT devices, the network segmentation among them:

  • Map all connected devices. All devices connected to the network, whether at home or at the enterprise level, should be well accounted for. Their settings, credentials, firmware versions, and recent patches should be noted. This step can help assess which security measures the users should take and pinpoint which devices may have to be replaced or updated.
  • Change default passwords and settings. Make sure that the settings used by each device are aligned toward stronger security, and change the settings if this is not the case. Change default and weak passwords to avoid attacks like brute force and unwanted access.
  • Patch vulnerabilities. Patching may be a challenging task, especially for enterprises. But it is integral to apply patches as soon as they are released. For some users, patches may disrupt their regular processes, for which virtual patching could be an option.
  • Apply network segmentation. Use network segmentation to prevent the spread of attacks, and isolate possibly problematic devices that cannot be immediately taken offline.

The premise of the question is slightly wrong. A better way to ask is as follows:

  • Should my TV or other IoT device connect to my main home network? NO.
  • Should it connect to the my guest wifi? Again, NO.

Ideally, you want IoT devices to connect to their own separate IoT network. Rationale: The question inherently assumes the guest network is password protected. It might be an open guest network (mine is).

Either way, you don't want house guests turning on/off lights, security cameras, heating or other smart devices in your home. Nor should they have access the admin consoles of any network device in your home - especially the network router! Guests should have throttled internet access and nothing else on the guest wifi. Guest networks should be configured so that guest wifi client can not see other clients on the guest network. This is a standard feature on many guest wifi wizards, in my experience.

Set up an additional dedicated IoT network in your home instead. By proper use of VLANs and firewall rules, you can isolate your IoT devices to their own network (perhaps grant them limited internet access for software updates where necessary) Proper use of VLANs and firewall rules can still allow you to control your devices from your main WiFi network. Not all consumer network devices will have these sort of capabilities, but higher-end gear will.

I have this sort of configuration in my home. Main Wifi, Guest (which is isolated and open) and a dedicated IoT network for smart devices.

Tags:

Wifi

Smart Tv

Iot