IoT (Internet of Things) security encompasses the strategies, technologies, and practices needed to protect connected devices — sensors, cameras, controllers, smart appliances, and industrial equipment — from cyber threats. With India projected to have 2+ billion connected IoT devices by 2027 and manufacturing/smart building adoption accelerating under Digital India and Make in India initiatives, IoT security is no longer a futuristic concern — it is an immediate operational requirement. Unsecured IoT devices have been exploited for data breaches, ransomware attacks, botnet recruitment, and even physical sabotage of industrial systems. Last updated October 2026.
Why IoT Security Is Different from Traditional Cybersecurity
IoT devices present unique security challenges that traditional IT security approaches cannot adequately address:
- Resource constraints: Many IoT devices have limited processing power, memory, and storage, making it impossible to run traditional security software (antivirus, endpoint detection) on them
- Long lifecycles: Industrial IoT devices may operate for 10-15 years, far beyond the typical 3-5 year IT refresh cycle. Manufacturers often stop providing security updates long before the device is retired
- Diverse ecosystems: A single smart office might have devices from 20+ manufacturers, each with different operating systems, communication protocols, and security capabilities
- Physical access: IoT devices are often physically accessible (mounted on walls, placed in public areas, installed in remote locations), making them vulnerable to physical tampering
- Default credentials: Many IoT devices ship with default passwords that users never change. Botnets like Mirai exploited this to compromise millions of devices
- Always-on connectivity: IoT devices are continuously connected, providing persistent attack surfaces unlike laptops or phones that can be powered off
Common IoT Threats in Indian Businesses
Smart office threats:
- IP cameras compromised for surveillance or credential theft (numerous incidents reported in Indian offices and hotels)
- Smart locks and access control systems exploited for physical intrusion
- Smart HVAC systems used as entry points into corporate networks
- Printers and scanners storing/transmitting sensitive documents over insecure connections
- Voice assistants and smart speakers recording confidential conversations
Smart factory/industrial threats:
- SCADA/ICS systems targeted for operational disruption or sabotage
- Production line sensors manipulated to cause quality defects
- Ransomware targeting OT (Operational Technology) networks to halt production
- Supply chain attacks through compromised vendor devices
- Energy management systems exploited to cause physical damage or waste
IoT Security Framework for Indian Organisations
1. Asset Discovery and Inventory
You cannot secure what you do not know exists. The first step is identifying every connected device on your network. Use network scanning tools (Nmap, Shodan for external exposure, or dedicated IoT discovery platforms like Armis, Forescout, or Nozomi Networks) to create a comprehensive inventory including: device type, manufacturer, firmware version, IP address, MAC address, communication protocols, and data it collects/transmits.
2. Network Segmentation
Never connect IoT devices to the same network as critical business systems. Implement network segmentation:
- Separate VLANs: IoT devices on dedicated VLANs isolated from corporate networks
- Firewall rules: Strict rules governing what IoT devices can communicate with (deny by default, allow by exception)
- DMZ for external-facing devices: Cameras or sensors that need internet access should be in a DMZ
- Micro-segmentation: For critical environments, segment IoT devices from each other so a compromised camera cannot attack a door lock
3. Credential and Access Management
- Change ALL default passwords immediately upon device installation
- Use unique, strong passwords for each device (password managers help)
- Disable unnecessary services and ports on each device
- Implement certificate-based authentication where supported
- Regularly rotate credentials for critical industrial devices
4. Firmware and Patch Management
Establish a regular firmware update schedule for all IoT devices. Many devices require manual firmware updates — assign responsibility and track compliance. For devices that no longer receive manufacturer updates (end-of-life), implement compensating controls (additional network restrictions, enhanced monitoring) or plan for replacement.
5. Monitoring and Detection
Deploy network monitoring specifically designed for IoT traffic patterns. IoT devices have predictable communication patterns (a temperature sensor sends data to a specific server every 60 seconds). Any deviation — new destinations, unusual data volumes, communication at unexpected times — signals potential compromise.
IoT Security for Smart Manufacturing in India
Indian manufacturing is rapidly adopting Industry 4.0 technologies under the Make in India initiative. Security considerations specific to manufacturing:
IT/OT convergence: As operational technology (factory floor) connects to information technology (corporate network), the attack surface expands dramatically. Many OT systems were designed for isolated environments and lack basic security features. The Purdue Model (ISA-95) provides a reference architecture for securing IT/OT boundaries.
SCADA and PLC security: Industrial control systems (SCADA, PLCs, DCS) are prime targets. Incidents like Stuxnet demonstrated that these systems can be compromised to cause physical damage. Indian manufacturers must implement: network isolation for control systems, regular security assessments, intrusion detection specific to industrial protocols (Modbus, OPC-UA, PROFINET).
Compliance requirements: Indian manufacturers in defence, pharmaceuticals, and critical infrastructure sectors face additional IoT security requirements under CERT-In directives and sector-specific regulations.
IoT Security Budget Planning for Indian Businesses
- Network segmentation hardware/software: ₹2-10 lakh for enterprise-grade switches, firewalls, and VLAN configuration
- IoT security platform: ₹5-25 lakh/year depending on device count and features
- IoT penetration testing: ₹3-10 lakh per assessment from Indian security firms
- Ongoing monitoring: ₹1-5 lakh/month for managed IoT security services
- Employee training: ₹500-2,000 per employee for IoT security awareness
For SMBs, start with the basics: network segmentation (using existing switch/router capabilities), default password changes, firmware updates, and basic monitoring. These cost-free measures address 70-80% of IoT security risk.
Frequently Asked Questions
What are the biggest IoT security risks for a typical Indian office?
In order of likelihood and impact: 1) IP cameras with default credentials accessible from the internet, 2) smart TVs and displays connected to the corporate network without segmentation, 3) printers storing sensitive documents with no access controls, 4) personal IoT devices (smartwatches, fitness bands) on the corporate WiFi, and 5) smart building systems (HVAC, lighting) with outdated firmware.
Is there an Indian standard for IoT security?
CERT-In has published IoT security guidelines. The Bureau of Indian Standards (BIS) has adopted aspects of ISO/IEC 27400 (IoT security and privacy guidelines). Additionally, TSDSI (Telecommunications Standards Development Society, India) has developed national standards for IoT communication security. For manufacturing, the NIST Cybersecurity Framework and IEC 62443 are widely referenced.
How do we secure legacy industrial equipment that cannot be updated?
For devices that cannot be patched or updated: isolate them completely from internet-connected networks, implement dedicated monitoring for anomalous behaviour, restrict physical access, place compensating controls (intrusion prevention systems, protocol-aware firewalls) between legacy devices and any connected network, and plan a phased replacement schedule.
Should we allow employees to bring personal IoT devices to the office?
Create a separate IoT/guest WiFi network for personal devices that is completely isolated from the corporate network. Never allow personal IoT devices on the corporate network. Clearly communicate this policy to all employees and enforce it through technical controls (MAC address filtering, network access control).
What should be in an IoT security policy?
An IoT security policy should cover: approved device procurement (only from vetted manufacturers), mandatory security configuration before deployment (password changes, firmware updates, disabling unnecessary services), network placement requirements (VLAN assignment), ongoing monitoring and maintenance responsibilities, incident response procedures for IoT-specific events, and end-of-life disposal (including data wiping).
