Home Network Security: What Each Setting Covers
The connected devices in a home likely all reach the internet through one router. The Federal Trade Commission (FTC) calls the router the key to privacy in the Internet of Things (IoT) world.
The FTC describes two passwords on that router. The Wi-Fi network password connects devices to the network; the router admin password lets a person into the administrative side of the device. The Cybersecurity and Infrastructure Security Agency (CISA) says attackers may target vulnerabilities for months or even years after updates are available.
Where the Router Sits
The FTC describes a home Wi-Fi network as the home’s wireless internet connection. It usually involves a wireless router that sends a signal through the air. A person uses that signal to connect to the internet.
Home networks might have a range of wireless devices on them, from computers and phones to IP cameras, voice assistants, smart TVs, and connected appliances.
Unless the network is password protected, though, any device within range — the owner’s, a guest’s, or a stranger’s — can pull the signal from the air and use the internet connection. Others nearby who connect to an unprotected network might be able to see what a person does online, including any personal information they look at or enter. And if anyone uses the network to commit a crime, like sending illegal spam, the activity could be traced back to the owner.
The FTC adds that the more secure the router, the more secure the connected devices will be.
What Each Password and Lock Covers
Encryption scrambles the information sent through the network, the FTC says, which makes it harder for other people to see what someone is doing or get their personal information.
A router’s encryption setting can be WPA3 Personal or WPA2 Personal. WPA3 is the newer — and best — encryption available, but both will scramble the information.
Older routers have WPA and WEP. Those are outdated and not secure.
This site has a separate explainer on public Wi-Fi.
There are two passwords on a router. The Wi-Fi network password is the one used to connect devices to the network. A unique and secure Wi-Fi network password prevents strangers from getting onto the network.
The router admin password is the other one. It lets a person into the administrative side of the device, where they can do things like change settings, including the Wi-Fi network password.
If a hacker managed to log into the admin side of the router, the hacker could change the settings, including the Wi-Fi network password — undoing any other security steps the owner may be taking. From the administrator account, they could easily get into the network and devices.
Multi-factor authentication makes it harder to hack into an account, even if a hacker gets the password. It requires two or more pieces of information to access the account, such as a password plus a random number generated by an authentication app.
Router Features and Guest Networks
Some routers have features that can be convenient but weaken network security, according to the FTC. Enabling remote access to a router’s controls allows a person to change settings over the internet. Wi-Fi Protected Setup (WPS) lets a person push a button on the router to connect a device instead of entering the Wi-Fi network password.
Universal Plug and Play (UPnP) lets devices find each other on the network. These features may make it easier to add devices or let guests use the Wi-Fi — but they can make the network less secure.
The security of older devices no longer in use may be out of date, creating a weak point on the network.
Many routers let the owner set up a guest network with a different name and password. A separate login means fewer people have the primary Wi-Fi network password. In case a guest (unknowingly) has malware on their phone or tablet, it won’t get onto the primary network and the owner’s devices.
Router settings and software updates, as the FTC and CISA describe them
| Setting or feature | What it is | What the agency says it affects | Agency |
|---|---|---|---|
| Wi-Fi encryption | Scrambles the information sent through the network; router settings can be WPA3 Personal or WPA2 Personal | Makes it harder for other people to see what someone is doing or get their personal information | FTC |
| Wi-Fi network password | The one used to connect devices to the network | A unique and secure Wi-Fi network password prevents strangers from getting onto the network | FTC |
| Router admin password | The one that lets a person into the administrative side of the device | If a hacker managed to log into the admin side of the router, the hacker could change the settings, including the Wi-Fi network password | FTC |
| Remote access | Allows a person to change the router’s settings over the internet | Can make the network less secure | FTC |
| Wi-Fi Protected Setup (WPS) | Lets a person push a button on the router to connect a device to the internet instead of entering the Wi-Fi network password | Can make the network less secure | FTC |
| Universal Plug and Play (UPnP) | Lets devices find each other on the network | Can make the network less secure | FTC |
| Guest network | Many routers let a person set up a guest network with a different name and password | In case a guest (unknowingly) has malware on their phone or tablet, it won’t get onto the primary network and the owner’s devices | FTC |
| Patches | Software and operating system (OS) updates that address security vulnerabilities within a program or product | Attackers may target vulnerabilities for months or even years after updates are available | CISA |
| End-of-life (EOL) software | Software for which the vendor has discontinued support | Continued use poses consequential risk to the system that can allow an attacker to exploit security vulnerabilities | CISA |
Cameras
Cameras that stream live video — like doorbell smart cameras, baby monitors, and security cameras — are a popular way to keep an eye on property, family, and pets, the FTC says. They may be called smart cameras, connected cameras, or IP cameras. Using an app on a phone or computer, people can watch or listen to live video and audio feeds, also known as livestreams.
Cameras usually have default settings that keep videos private and require a password. Default choices and reused passwords can be easy for hackers to find online. Many IP cameras are vulnerable to digital snooping.
If a camera stores videos in the cloud, it should already require the owner to set up a password for the cloud account. Two-factor authentication for that account requires something in addition to a password — like a verification code sent by email or generated from an authenticator app — to log in.
A camera may let a person log in using a web browser. If that login page does not have a URL that begins with https, the username and password entered won’t be encrypted. A hacker with access to the online traffic could then get the username and password, and use them to access the camera feed.
Once a person has logged in to a camera’s webpage, the URL should still show https. If it doesn’t, the livestream isn’t encrypted, and other people may be able to view it.
Many cameras let the owner watch live video remotely, so they can check on the home while away. If the video isn’t secure, a hacker might be able to watch it too.
Cameras can also sit on a separate network from other devices, like a computer or printer. With that arrangement, someone who hacks into the computer or gets onto the main network wouldn’t also have easy access to the cameras.
Most cameras have software that needs occasional updates to fix security bugs and other glitches.
Voice Assistants and Smart TVs
Voice assistants operate through stand-alone smart speakers or on a computer, tablet, or phone, the FTC says. Some of these devices can listen for certain sound patterns — for example, they may be activated by a “wake word.” But they might mishear, causing them to start recording when the owner least expects it.
Each time someone interacts with it, a voice assistant records what they say. It might also record when someone says something that sounds like the wake word. Some voice assistant manufacturers have had employees listen to audio recordings in certain circumstances — say, to make their products work better.
Usually the owner can set the length of time the manufacturer stores voice recordings, and even delete old recordings. A person may also be able to opt out of human review of recordings.
When the password for the app or online account that controls a voice assistant is reused from other accounts and one of those accounts gets hacked, a hacker could try that same password to get into the voice assistant.
Depending on the voice assistant and which permissions the owner gives, voice assistants might read emails out loud and access the calendar and contacts.
Apps people do not use on a smart TV can collect data on their behavior even when they are not using them.
Updates, Firewalls, and Software Support
CISA describes patches as software and operating system (OS) updates that address security vulnerabilities within a program or product. When vendors become aware of vulnerabilities in their products, they often issue patches to fix them. Attackers may target vulnerabilities for months or even years after updates are available.
Some software will automatically check for updates, and many vendors offer users the option to receive updates automatically. Users can install updates manually or elect for their software programs to update automatically.
Firewalls provide protection against outside cyber attackers by shielding a computer or network from malicious or unnecessary network traffic. They can also prevent malicious software from accessing a computer or network via the internet. Categories of firewalls include hardware and software.
Firewalls do not guarantee that a computer will not be attacked. They primarily help protect against malicious traffic, not against malicious programs (i.e., malware), and may not protect a computer if someone accidentally installs or runs malware on it.
Sometimes vendors discontinue support for a software program, also known as end-of-life (EOL) software. Continued use of EOL software poses consequential risk to the system that can allow an attacker to exploit security vulnerabilities.