Every connected device in a business, from a security camera or vehicle tracker to a smart meter, a card machine or a cold room sensor, is a small computer on your network. Most are installed once and forgotten, which makes them one of the easiest ways into a small business’s systems. This guide covers the practical steps to secure them. For where connected devices pay for themselves in the first place, see what connected devices actually do for a small business.
1. Change every default password
Many devices ship with a default username and password that are publicly known. Change them on installation, use a different strong password for each device, and store them in a password manager.
2. Keep devices off your main network
Put cameras, sensors and other devices on a separate network or guest Wi-Fi, away from the computers that hold your accounts and customer data. If a device is compromised, the attacker cannot reach everything else.
3. Keep firmware updated
Manufacturers release updates to fix security flaws. Turn on automatic updates where available, or check quarterly. Replace devices that no longer receive updates.
4. Buy from suppliers who support their products
Cheap devices with no named manufacturer, no update history and no support are the riskiest. Before buying, check that the supplier issues updates and has a way to report problems.
5. Switch off what you do not use
Disable remote access, cloud features and ports you do not need. Every open feature is another way in.
6. Treat recordings and data as personal information
Camera footage, vehicle location data and staff access logs can identify people. Under the Protection of Personal Information Act, you must have a lawful reason to collect them, tell people they are being recorded or monitored, secure the data and keep it only as long as needed. The Information Regulator has guidance on these obligations.
7. Keep an inventory
List every connected device, where it is, who installed it, its login and when it was last updated. You cannot secure what you do not know you have.
Frequently asked questions
Are security cameras a security risk?
They can be if they use default passwords, are exposed to the internet or never get updates.
Do I need a separate network for devices?
It is one of the most effective steps. Most business routers can create a separate or guest network.
Does POPIA apply to CCTV?
Yes, where footage identifies people. Signage, security and retention limits all matter.
How often should devices be updated?
Whenever updates are released. Automatic updates are best.
What should I do if a device is hacked?
Disconnect it, change passwords, check other systems for unusual activity and get professional help if customer data may be affected.
Originally published in May 2018. Updated September 2026.
