I work in IT security, and one of my biggest issues with Home Automation, is that I see a lot of really insecure setups from people who, whilst very smart, don’t know much about digital security. When you have devices that control your locks, stove, gas fire, alarms etc, people don’t seem to click that it’s really important to prioritise security.
In the few Home Automation installations I’ve done for others, the cost of the security work has trumped the installation, and I refuse to do installations without making sure the security setup is top notch.
Each network is different, but broadly, this is what I aim for:
-
Segregated WIFI. One “Guest” network, which is heavily regulated, with clients unable to “see” other client devices, and one “Main” network, where clients are able to interact with other devices. For your typical household, you may well be comfortable giving visitors and friends access to your WIFI to access the internet, but you probably don’t want them unlocking your front door, or allow their already compromised device to affect your main network. Depending on your smart devices, I would also recommend using a VPN on the “Main” wifi; this means you not only need the wifi password, but also your VPN credentials to connect to the HA network and interact with smart devices, plus, your data traffic is encrypted and protected from sniffers (however, it can be quite tricky to make WIFI smart devices work with this setup, so it’s an added bonus, but probably not suitable for your average user).
-
For the HA host, I only allow connections via localhost by default, and always with SSL. If you want to connect remotely, use a VPN. However, if you absolutely need external access (for custom Alexa skills, for example) make sure to only allow specific IP address. That way, you can be reasonably confident that the vast majority of intruduers aren’t going to be allowed to connect. It’s still possible, but the type of attack needed would require the attacker to be very consciously targeting your network specifically.
-
Even with the above, I would still segregate the HA host onto a DMZ network or separate subnet and heavily regulate the traffic from the LAN. If you’re running HA, the host should only allow connections via 443 for the app to run, and probably SSH. If you are using SSH, always use public/private authentication. In this case, your DMZ either going to be private, or only accessible to specific IP ranges. Either way, I would only allow SSH access via LAN, and deny external connections entirely. If you want to make changes on the server, you should be on the LAN (either locally, or via VPN).
-
Always implement a firewall AND use IP Tables to make your hosts impenetrable.Yes, it’s a lot of work, and makes changes harder, but I can’t overstate how important this is if you’re really trying to implement robust security.
That’s my two-cents anyway… Hope that helps, and feel free to ask if you have any questions 