The Internet of Things and the security challenges it creates for small business

The Internet of Things and the security challenges it creates for small business

Managing the traditional limitations of time and resources means that running a small business on a budget is a challenge, but these difficulties become more pronounced when resources are stretched even further by the increased security demands of new technology.

In recent years, high-profile data breaches have regularly hit the headlines and cybersecurity has become an increased concern for companies of all sizes. While they rarely make the news, small businesses are thought to be targeted in 43% of cyberattacks, making the need for improved security best practices a priority.

Managing the traditional limitations of time and resources means that running a small business on a budget is a challenge, but these difficulties become more pronounced when resources are stretched even further by the increased security demands of new technology. An increasing area of threat is the use of Internet of Things (IoT) devices on company networks. IoT devices certainly offer many benefits and can help to improve efficiency, but having to manage a rapid increase in endpoints on your network also poses a significant security risk.

Why is IoT such a security risk?

When trying to access a company network, hackers will look to identify weak points in the security. The front door might be metaphorically bolted with antivirus software, but if someone has left a window open so to speak, breaking in can be deceptively simple. With IoT, even the most innocuous devices can now pose a threat. It could be printers, lightbulbs, toasters or speakers - every improperly configured device that connects to your network is a potential entry point.

By 2022 Juniper estimates there will be 50 billion active IoT devices and that means plenty of additional points of entry that need to be monitored. Between managing this influx of devices and the increasing number of personal devices used for remote working, SMBs are facing the challenge of keeping pace with technological advances to ensure that they do not become an Achilles heel.

How to minimize the risk

As technology evolves, so will the type of security solutions required. The type and scale of threats is also likely to vary between companies in different industries, but the basic principles of security best practices for IoT will remain the same.

In the UK there has been an attempt by the government to improve the security on IoT devices with a labelling scheme and Code of Practice that hopes to ensure that devices are only sold if they feature a certain level of security. While this scheme may help to improve security best practices at the manufacturing level, small business owners must ensure the introduction and implementation of these devices is done correctly today, rather than waiting for the government to catch up.

Patches and updates

Security updates are often created as a response to a known vulnerability, and so it is essential that they are applied as soon as possible to ensure that your devices are protected against that threat.

While device patches and updates are usually released on a regular basis, many people forget the importance of applying them as soon as they become available. Updates might appear while a device is in use, resulting in users deciding to delay the installation for the sake of convenience. But coming back later can easily be forgotten, and in the meantime, devices will remain unprotected.

With so many devices in an office, ensuring every single one is updated could quickly become an arduous task, especially if the IT department consists of one person, or is a role that is split between people.

To ensure that all devices are protected and updated, patching has to become a shared responsibility, with staff trained to manage their own devices, leaving the IT team to focus elsewhere. This also has the added benefit of making security a daily consideration for staff, keeping it at the front of their mind rather than something that is only considered when prompted to change their passwords.

Strong passwords

One of the main selling points of IoT devices is their convenience. However, while it is easy to connect them to your network, many people do not think to change the default passwords. Simply by identifying your device, hackers will be in a position to quickly identify the default password too.

Despite regular warnings, the most commonly repeated security measure is still one that is regularly ignored. The 2019 Avast Smart Home Report found that 40% of smart homes have at least one vulnerable device, and 69.2% of these have weak security credentials.

As these devices become commonplace in offices around the world, it is crucial that easily protected security weak points are correctly managed so that bad domestic habits do not become an issue for your business. Strong passwords are not just for laptops, but any device that connects to your network, whatever its purpose.

Device security

Security does not end at strong passwords. To protect against IoT threats, endpoint security tools are essential to operate alongside antivirus, firewalls and malware scanners. While these traditional methods will perform scans and remove malicious threats, additional tools can be used to protect data from ransomware attacks, identify vulnerabilities in the WiFi and flag potential phishing emails.

Where companies have both IoT and large numbers of personal devices, SMBs should consider implementing a bring your own device (BYOD) policy to ensure that any personal devices accessing the network, in the office or remotely, are all secured with strong passwords, security software and two factor authentication.


While the idea of a malicious group of hackers may spring to mind when talking about cyber security, the reality is very different. 2018 research in the UK found that 88% of breaches were caused by human error.

Effective antivirus and strong passwords are crucial aspects of IoT security, but when your staff are the biggest risk when it comes to a data breach, effective training is crucial. It shouldn’t be a dry lecture and should be made as open and engaging as possible.

By providing regular updates about new threats, providing software training and ensuring that everyone, regardless of IT ability or position in the company, is confident when it comes to their responsibilities, your company will gradually build a culture of security. This will make it a constant consideration and will help to minimize careless errors that could have devastating consequences.

A Ponemon Institute report found that IoT-related breaches reached 26% in 2018, increasing from 15% just a year before. For small businesses to effectively manage evolving data security, it is vital that it is given the same level of consideration as physical security. This does not mean installing an expensive security system, but does require care and awareness from everyone involved to ensure that easily avoidable mistakes do not undermine your security.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3