Business IoT Security: Cameras, Alarms and Smart Devices

A dental clinic in Montréal's West Island has six cameras and a video recorder installed. To troubleshoot remotely, the installer opens a port on the router and keeps the factory password. Three years later, nobody at the clinic knows the recorder is visible from the internet.

There's nothing unusual about that story. Cameras, alarm panels, badge readers, smart thermostats, boardroom TVs, printers: each is a small computer plugged into your network. And unlike your workstations, nobody is watching them.

Here's how to secure them without becoming an expert, following the Canadian Centre for Cyber Security's recommendations.

Why connected devices are an easy target

Connected devices get targeted because they combine three weaknesses: factory credentials everyone knows, infrequent updates and a spot on the same network as your computers.

The textbook case dates from October 2016. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) described the Mirai botnet, which scanned the internet using a list of 62 common default usernames and passwords. Its victims were mostly home routers, network cameras and digital video recorders, which were then used in denial-of-service attacks.

For a small business, the danger goes beyond those attacks. A compromised camera can film a screen or a reception desk, serve as a foothold into your internal network, or expose footage of clients and staff. As the Canadian Centre for Cyber Security puts it, your organization "inherits the security issues of any connected device," so you need policies to ensure these devices are introduced, used and managed securely.

The 5 risks and the measures that reduce them

For a small business, five risks cover most of the exposure, and each has a simple fix.

The Centre also recommends turning off automatic connection services such as plug and play, which can open access without you noticing.

Step 1: take inventory

The first measure is knowing what's plugged in: list every connected device, with its location, its vendor and the person responsible for it.

For each device, record:

• the type, make and model;
• its network address and how it connects (cable, Wi-Fi, cellular);
• the firmware version and the end-of-support date announced by the manufacturer;
• the associated cloud account or app, and who has access to it;
• which vendor reaches it remotely, and how.

Your router's list of connected devices, or a network scan by your IT provider, often turns up surprises: an old printer, a smart TV, a gateway installed by the building's landlord. Before buying a new device, the Centre advises investigating its security capabilities, the types of data it sends and receives, and the security ratings of the manufacturer and product.

Step 2: isolate and harden

Isolate connected devices on a network separate from your workstations and servers: it's the measure that does the most to limit damage if one of them is compromised.

The Canadian Centre for Cyber Security recommends isolating IoT networks to restrict their access to systems managing sensitive data, and putting personal devices on a separate network such as guest Wi-Fi. In practice, for a small business:

• a network or VLAN reserved for cameras, the alarm and building systems;
• firewall rules that stop that network from reaching workstations and servers;
• no device exposed directly to the internet;
• encryption of the data the devices generate, where the product allows it.

Our article on business Wi-Fi security explains how to separate wireless networks.

Step 3: lock down cloud accounts and vendor access

The cloud accounts behind your cameras and alarm should belong to the company and be protected by multi-factor authentication, like any other critical account.

The Centre recommends two-factor authentication for devices and apps that offer it. Our guide to choosing a multi-factor authentication method helps you pick the right one.

For vendors, ask the same questions you'd ask your IT provider: who has access, how, with what logging, and what happens at the end of the contract. Our article on how to evaluate your IT provider's security offers a question list that works just as well for camera installers and alarm monitoring companies.

Camera footage and privacy law

Camera footage that can identify a person is personal information: in May 2025, Quebec's Commission d'accès à l'information reaffirmed this for cameras installed in a company's vehicles, according to a summary published by the law firm Osler in June 2025.

Under Quebec's Law 25, that means:

• reasonable security measures given the sensitivity of the footage (s. 10);
• access limited to people who need it to perform their duties (s. 20);
• limited retention: the same decision found that keeping continuous recordings for 14 days was unnecessary and ordered the destruction of footage unrelated to an incident;
• a recorder exposed on the internet and viewed by a stranger could amount to a confidentiality incident (s. 3.6).

Outside Quebec, federal and provincial privacy laws raise similar questions. These are legal issues too: confirm your situation with legal counsel.

The quarterly checklist

A 15-minute review each quarter is enough to keep connected devices under control.

• The inventory is up to date, including devices added by vendors.
• No device uses a factory or shared password.
• Every device's firmware is current.
• No port is forwarded to a device from the internet.
• The connected-device network can't reach workstations or servers.
• Cloud accounts are in the company's name and protected by MFA.
• Vendor and former employee access has been reviewed.
• Devices that no longer receive updates are scheduled for replacement.

If an audit turns up exposed devices or a flat network, our remediation and hardening service can handle segmentation and configuration alongside your IT provider.