How to Secure Industrial IoT Devices

If you need to know how to secure IoT devices, this week gave you a loud reminder. The U.S. government warned of ongoing mass hacks hitting industrial, retail and military freezers, according to TechCrunch.

That detail sounds almost funny until you picture a warehouse full of spoiled stock, or a cold chain that quietly stops working. These freezers are connected devices, usually installed once and then forgotten. The same weaknesses exist in sensors, cameras, meters and controllers across factories and shops. Here is a practical method to lock them down without ripping anything out.

What You Need Before You Start

Gather three things. First, a list of who installed and who maintains your connected equipment, including vendors and contractors. Second, access to your network gear: the router, firewall and any managed switches. Third, a laptop with a network scanner such as Nmap or the free Wireshark for looking at traffic.

It also helps to read the CISA guidance on industrial control systems before you begin. You do not have to follow every line, but it gives you a vocabulary to use with vendors. Plan on a half day per site for a small facility, and keep a facilities person next to you, because you will be touching real equipment.

Step 1: Find and Inventory Every Connected Device

Most companies underestimate their device count by half. Start with a network scan of every subnet to see which addresses respond. Compare that against purchase records and walk the floor. You will find a thermostat, a badge reader and a camera that nobody remembers buying.

For each device, log the make, model, firmware version, IP address, location and the person responsible. Add one more column that matters a lot: does it need internet access to work? Many devices have cloud features turned on by default that you never use. Each one is an open door.

Next, search for your own public exposure. Run your IP ranges through Shodan and see whether any controller, camera or management page is visible from the open internet. If a freezer controller login page shows up there, treat it as an incident, not a to-do item.

Step 2: Lock Down Credentials, Updates and Remote Access

Attackers rarely need clever exploits against connected devices. They use default passwords, old firmware and remote access nobody monitors. So fix those three things on every device you listed.

Change default credentials. Replace factory logins with unique, long passwords stored in a password manager. If a device only allows a shared admin account, record who knows it and rotate it when people leave.

Update firmware. Check each vendor’s support page for current versions and security advisories. Schedule updates in a maintenance window, test on one unit first, and keep the previous firmware file in case you need to roll back. If a vendor no longer ships updates, mark the device for replacement and isolate it harder in the next step.

Control remote access. Disable any management interface that faces the internet. Where vendors need access for support, give them a time-limited VPN account with multi-factor authentication rather than a permanent port forward. Log every session. Turn off protocols you do not use, such as Telnet, UPnP and unused web ports.

Step 3: Segment the Network and Monitor It

Even a well-patched device can be compromised, so assume it might be and limit the damage. Put IoT and operational equipment on their own VLAN, separate from office laptops and servers. Then write firewall rules that only allow the specific traffic each device group needs. A freezer controller should talk to its monitoring server and nothing else. It has no reason to browse the web or reach your finance share.

Block outbound traffic by default from the IoT segment, and add exceptions one at a time as you confirm they are needed. This single change stops a large share of botnet behavior, because compromised devices can no longer call home.

Finally, set up basic monitoring. A lightweight tool like Zeek or your firewall’s own logs can alert you when a device suddenly talks to a new country or sends unusual volumes of data. Write a one-page response plan too: who gets called, which switch port to disable, and how to run the equipment manually if the network goes down. For cold storage or manufacturing, that manual fallback is what protects your stock while you investigate.

Common Mistakes to Avoid

Assuming the vendor handles security. Many vendors ship the device and move on. Ask directly who is responsible for patches, how fast they respond to advisories, and what happens when a product reaches end of life.

Flat networks. If your cameras, freezers and accounting laptops share one network, a single weak device exposes everything. Segmentation costs little and pays back quickly.

Forgetting about decommissioned devices. Old units that were unplugged but still have credentials, or that sit in a cupboard on Wi-Fi, keep working for attackers. Wipe and remove them properly.

Skipping tests of the fallback. A response plan nobody has practiced will fail when you need it. Run a short drill once a quarter.

Key Takeaways

• Inventory first: you will almost certainly find more connected devices than anyone expected.
• Kill the easy wins: default passwords, old firmware and exposed management pages cause most compromises.
• Segment and restrict: a separate VLAN with tight outbound rules limits the damage of any single device failing.
• Monitor and rehearse: alerts and a tested manual fallback keep operations running during an incident.
• Hold vendors accountable: ask about patch timelines before you buy, not after a breach.

Need Expert Help?

If this feels like a lot to manage alone, TecniForge can handle the heavy lifting. Our team specializes in custom software development and AI integration. Get in touch with our experts.

Also read: IoT Security and the Freezer Hacks, our earlier coverage on why this matters today.

Your challenge for this week: run one scan on one network segment and count the devices. If the number surprises you, you already know where to start.