A security camera costing three hundred thousand rupiah is a small computer. It has an operating system, connects to the internet continuously, and holds your home Wi-Fi password inside it.
The difference from a laptop: your laptop receives security updates every month. That camera may never have received a single one since it left the factory.
That is the heart of the matter. Not that smart devices are dangerous, but that they age without maintenance while remaining connected to the same network as the devices holding your important data.
Why these devices are different
Three characteristics make smart devices need different treatment:
- A short update lifespan. Manufacturers stop issuing fixes long before the device fails. A camera that still works perfectly well physically can be running software whose security holes have been publicly known for years.
- No interface for checking. You cannot open the security settings on a smart bulb. Even where there is an app, the information it shows is usually minimal.
- Always on. Unlike a laptop closed at night, these devices stay connected twenty-four hours. If someone is scanning for vulnerable equipment, it is always available.
The real risk is usually not someone watching your camera, though that happens. More often: the device is used as a foothold for reaching other equipment on the same network, or recruited into a network of machines used to attack third parties.
The step that matters most: separate the network
Security cameras are the group that most warrants attention here, and they are covered separately in the guide to Wi-Fi camera security.
If you do only one thing from this article, do this one.
Almost every modern router has a guest network feature. Its purpose is not merely providing Wi-Fi for visitors: devices on the guest network cannot see devices on the main one.
Which means that if your camera is compromised, the intruder finds only the camera, not the work laptop, not the files shared on the network, not the NAS.
| Device | Network | Reason |
|---|---|---|
| Laptops, personal phones | Main | Need access to the printer and shared files |
| Cameras, bulbs, smart plugs | Guest | No need to see other devices |
| Smart TV | Guest, if not used for screen sharing | Internet access is all it needs |
| Printer | Main | Must be visible from laptops and phones |
| Human visitors' devices | Guest | No need for access to the household |
How to enable it differs by brand, but it is generally in a menu called Guest Network. Make sure the client isolation option, sometimes called AP Isolation or Client Isolation: is switched on.
An exception worth thinking through. Chromecast, AirPlay, and some multi-room audio systems require sender and receiver to be on the same network. If that matters to you, leave the TV on the main network and move only the other devices. Security that makes a home uncomfortable rarely lasts.
A fuller discussion of this separation is in the guide to separating a guest network.
Default passwords and the accounts attached to them
Many devices ship with the same password combination across an entire production run. Those lists circulate openly.
There are two things to change, and people often change only one:
- The device's own password: for reaching its settings interface, usually through a local IP address or the bundled app.
- The cloud account password: the account you created in the manufacturer's app. This is what actually grants access to camera footage from anywhere, and this is more often the way in.
Turn on two-step verification for the cloud account where available. For cameras, this matters more than any setting on the device itself.
Updates that do not arrive on their own
Some devices update themselves automatically. Others wait for you to press a button buried somewhere in the app.
Once installed, take the time to check:
- Is there an automatic update option? Switch it on.
- If there is not, note it down to check manually every few months.
- Find out when the manufacturer stops supporting that model. This information is sometimes on the support page, sometimes only findable in user forums.
A device no longer supported that holds sensitive data, an indoor camera, say, is worth considering for replacement, not because it is broken, but because it is no longer being fixed.
Router settings that help
A few router settings make a large difference for devices you cannot configure yourself:
| Setting | Should be | Reason |
|---|---|---|
| UPnP | Off | Lets devices open ports to the internet without your consent |
| Remote router access | Off | The router's settings panel need not be reachable from outside |
| WPS | Off | A quick-pairing method with a long-known weakness |
| Wi-Fi encryption | WPA3, or WPA2 if older devices need it | WEP and old WPA no longer offer meaningful protection |
UPnP is the one most often overlooked. It was designed so devices could arrange their own inbound routes without bothering the user, and that is precisely the problem when the device asking turns out to be vulnerable.
Router hardening is covered more fully in the guide to securing a home router.
What to check before buying
The cheapest decision is the one made before the device enters the house:
- Does it genuinely need to be connected? Some devices offer smart features you will never use. A bulb that only needs switching from the wall does not need a cloud account.
- Is there a stated support period? Manufacturers who publish one generally take it more seriously.
- Can it work without the cloud? Devices supporting local protocols such as Matter keep working if the manufacturer's service shuts down.
- What is the manufacturer's track record? Search the brand name together with "vulnerability". A history of quick fixes is a good sign.
A sensible order
If you want to start today, work through these in order:
Switch on the guest network
Move cameras, smart plugs, and similar devices there. This gives the largest result for the smallest effort.
Change the cloud account password
Especially for cameras. Turn on two-step verification if available.
Turn off UPnP and remote router access
Two settings, done once, applying to every device.
Check for updates
Enable the automatic ones, note the manual ones.
Take stock of the devices
Look at the connected device list on the router. If there is something you do not recognise, look into it rather than ignoring it.
Not one of the steps above needs extra hardware or money. All it takes is one afternoon to rearrange what is already there.
Frequently asked questions
Can a Wi-Fi CCTV camera be accessed by someone else?
Yes, particularly if the default password was never changed or the software has gone a long time without updates. There are search engines that index cameras exposed to the internet. Most cases are not sophisticated hacking but cameras that were simply never locked.
Should a smart TV go on the guest network?
Ideally yes, if you do not use screen sharing from a phone. If you use Chromecast or AirPlay, the TV and phone have to be on the same network, so this separation becomes inconvenient. Weigh which you need more.
How long do smart devices receive security updates?
It varies and is often not announced. Major brands usually two to five years. Cheap unbranded devices frequently never receive a single update after leaving the factory.
Will turning off UPnP break anything?
Some games consoles and file-sharing applications may need manual adjustment. For general use, switching it off is rarely noticed. If something does break, you can open specific ports manually rather than letting every device open its own.
