Secure Your Network: IoT Inventory

[This is the 1st in a 4-part series – part 2, part 3, part 4]

I’ve written several articles about securing aspects of your home network over the years. But after my recent interview with Josh Corman, I decided that I wanted to revisit this topic and approach the subject a little more methodically. This is the first in a series of articles that will help you get a handle on your specific situation, assess your risks and exposures, and take the appropriate steps to secure your network and its devices.

Secure Your Network: Methodology

When cybersecurity professionals are hired to help organizations improve their network security, they tend to follow a standard workflow. There are a handful of popular frameworks which enumerate several phases. I’d like to propose a similar set of steps – basically the same concepts minus the attack parts. It will go something like this:

• Scan. Before you do anything else, you have to set your scope and understand what it is that you’re trying to protect. This is a discovery process where you enumerate the devices on your home network. That may sound simple, but it’s a crucial first step and you may be surprised at what you find.
• Simplify. Before going to great lengths to secure everything you just found, you should stop to see if you can reduce number or the complexity of the vulnerable devices.
• Assess. Once you’ve minimized your exposures, it’s time to analyze what remains. Do these devices have vulnerabilities? Do they have up-to-date software? Are they even still supported? What are the consequences if these devices are unavailable or are compromised?
• Remediate. Once you know what you have and understand your vulnerabilities, it’s time to fix what you can and mitigate the rest. To wrap up, you should review what you’ve learned, what you’ve done, and maybe do a re-scan to survey the results.

I think this framework can be applied to multiple areas of personal security and privacy. I hope to refine it over time and either incorporate it into the next edition of my book or perhaps make it the basis for a new book. We’ll see. But for now, let’s apply this to securing your home network.

Let’s start at the very beginning… a very good place to start. Phase one is Scan.

Scoping the Problem

Let’s set the scope of this exercise. We’re focused here on your home network. This includes wired and wireless devices – that is, devices hardwired to your network via Ethernet cables and wireless devices connected via Wi-Fi. You may not have any wired devices. You probably only have a single Wi-Fi router. But you might have a personal router as well as a combination modem/router from your ISP. If you have a mesh router system or if you have Wi-Fi range extenders, they will all be part of the same overall network. But for this process, we want to identify every object in your house that connects to the internet.

So, how do you enumerate all the devices you have that are connected to the internet? In the Internet of Things (IoT) age, you may well have several “smart” devices in your home. Honestly, it’s hard to avoid them now. Televisions, thermostats, watches, appliances, lights and switches, streaming boxes, game consoles, exercise equipment, fitness trackers, printers, and all sorts of other electronics want to be connected these days. Many of these devices even know how to automatically connect to the internet, if they can find another device on the network to help them. So it’s possible that you have devices on your network that you didn’t even know about.

Enumerate Your Devices

Enumerating all your network devices may frankly be the trickiest step in this entire process. You’re going to need some method for recording a list of things. If you’re like me, you probably immediately opened up a spreadsheet on your laptop. I’ve created a starter sheet template for you right here, if you’re interested. It’s in Microsoft Excel format, but Google Sheets and Apple Numbers can handle xlsx format, too. But you can also just get a sheet of paper, a pencil and a clipboard, if that suits you better. I would record the following information, at a minimum:

• Device name. This is whatever you want it to be. This is how you want to identify the device.
• Network name. This is how your device represents itself on your network (see next section).
• Make and model. Who makes the device and what its model number is.
• MAC address. This is the only universal network identifier that will never change. (IP addresses can change.)
• Network. If you have both a main network and guest network, you should know where this device is connected.
• Location. It’s good to note where the device is physically located in your home, especially if you have multiple devices of the same type.
• Support site. When you find the website for your device, with links for downloading things like user manuals and software updates, it’s good to save them.

We need to come at this from two different angles: physical and logical. Let’s start with physical. Walk through your house and write down every device you see that you know is connected to your network. In the next section, I’ll show you how to get a list of all connected devices from your router (including MAC address). But you’re going to need to map that list to this list, and that can sometimes be tricky. It’s good to write down what you know about first. You should be able to find the manufacturer (“make”) pretty easily. The model number is usually listed on a sticker on the back or underside.

Accessing Your Router’s Admin Page

Now for the logical angle. This requires scanning your network. There are plenty of tools out there for this – some free, some not. But I’m going to suggest that you just go straight to the source: your home router. How you access your router’s administrative interface will vary depending on the make and maybe even the model of your router.

To access your router, you’ll need to know the router’s gateway IP address, which is usually something like 192.168.0.1 or 10.0.0.1. If you can find the IP address of your smartphone or computer, the gateway address will likely have the same starting 3 numbers and “1” as the last number. For example, if your laptop’s IP address is 192.168.1.55 then the router’s address is probably 192.168.1.1. You can read my article or this one to help find this address, or you can find it in the user manual for your router. Try looking up ‘user manual PDF’ for your router’s make and model on the internet.

When you enter the router’s gateway IP address in your web browser, it should take you to the your router’s admin web page. You’ll need credentials to log in. Older routers have a fixed, default username and password. Again, my article here has some common ones, or you can search the internet or check the user manual. Newer routers may have a custom password which can be found in the original packaging or on a sticker on the device itself. Log in using these credentials. (And if your router does have a well-known default password, you should change it to something unique right now.)

Listing All Networked Devices

Your router is in charge of handing out unique IP addresses for all devices on your network. This is done using Dynamic Host Configuration Protocol, or DHCP. Your router maintains a list of all “DHCP clients” and will give you a nice table of information for each device. You just have to find it. Every router’s admin interface is different and you may have to dig around a bit to find the DHCP client list. Again, you can try searching the internet or your router manufacturer’s support website for help here.

When you find this list, it will show you all the devices connected to your router right now, listing them by IP address. Note that if you have a guest network set up (and I strongly recommend that you do), you’ll have two lists of devices – one for your regular/main network and one for the guest network.

So now you have a list of IP addresses. Great, now what? If you’re lucky, the DHCP client list will also show a human-friendly name for most of the devices in your list, too – a hostname, NetBIOS name or similar. But often times, even that isn’t enough to identify what the device is. If the list shows the device’s MAC Address, you can look those up to get vendor information. Unfortunately, sometimes you just get the vendor of the network chip inside, not the actual vendor of the overall device.

If your router’s DHCP client list doesn’t give you enough information to figure out how to map it to your list of physical devices, you can try using network scanning tools like the free open-source Angry IP Scanner app (be sure to turn on the extra Fetchers like NetBIOS and MAC Address). You would run this tool on your Mac or Windows PC. There are also smartphone apps like Network Analyzer or Fing that do similar network scans.

Sometimes the only way to figure out which IP address is assigned to which device is to unplug those devices, one at a time, to see which one disappears from the DHCP client list. Note that you may have to manually refresh the DHCP list – it may not update automatically. Also note that when you plug that device back in and it reconnects to the network, your router may give it a different IP address. MAC addresses should be unique and unchanging, though, which is why this is usually the most important identifier to write down.

Next Steps

Okay. We have now created an exhaustive list of every device that’s connected to our home network. When you’re done, you will have matched every physical item in your home to every logical item in the DHCP client list. I have 30 of them in my house, and it used to be more. But I simplified. And you will, too. We’ll cover that in the next installment of this series.