You will have more connected devices than ever on your network in 2021, especially if you\u2019re in healthcare, retail, or logistics, industries that are among the early adopters of the Internet of Things (IoT). You\u2019ll have devices on your network edge, in your headquarters, on vehicles, in machinery, in your stores, in employees\u2019 homes, and on public property.\nAnd there\u2019s a good chance that some or many of these IoT devices have built-in security vulnerabilities that can endanger your network. In trying to capitalize on the voracious global appetite for connected commercial devices, many IoT manufacturers and developers are shoveling out enterprise IoT devices with, shall we say, varying levels of regard for security.\n\nEnterprise pros in the U.S. may have some help in the near future if new mandatory minimum security standards for connected devices are established under the IoT Cybersecurity Improvement Act, which was signed into law by President Trump on Dec. 4, 2020.\nThe Act directs the National Institute of Standards and Technology\u00a0(NIST) to create and systematically update IoT security standards for any device purchased by a government agency. The reason that may be helpful to enterprise pros outside the government is the standards are expected to influence private-sector enterprises. Still, the law won\u2019t help with the billions of older IoT devices already connected to a network or waiting to be purchased, or those that will be manufactured between now and whenever standards are set and manufacturers and developers begin adhering to them.\nSo what\u2019s an enterprise professional to do?\nFor its part, NIST has already been working on IoT security, and has prepared four draft documents it says \u201cwill help address the challenges raised\u201d in the IoT Cybersecurity Improvement Act. Three of them are written for manufacturers and suggest guidelines they might follow in designing and building secure IoT devices. The fourth is about what organizations that might buy these devices should ask for when they\u2019re buying them. \u201cThe document has background and recommendations to help agencies consider what security capabilities an IoT device needs to provide for the agency to integrate it,\u201d NIST says in announcing the four documents.\nDespite being drafts, the documents in their current form can provide valuable guidance.\nAnother good step: Familiarize yourself with the eight key security principles of IoT devices created by the Internet of Secure Things, an industry alliance advocating for security standards and compliance:\n\nNo universal passwords\nSecured interfaces\nProven cryptography\nSecurity by default\nVerified software\nAutomatic security updates\nVulnerability reporting program\nSecurity expiration date\n\nIf the IoT device you\u2019re considering for your own network fails to meet one or more of the principles above, you probably should look for a safer alternative, even if that means getting nothing. At least you won\u2019t be jeopardizing your network with an insecure IoT device.\nIf you have the time and resources, another option is to test devices yourself to assess their trustworthiness, as did Laurens Leemans, cofounder, co-owner, and lead developer of SignIPS, whose experience is a cautionary tale.\nBack in February, Leemans recounts, in a tweet thread titled \u201cInfosec fail thread\u201d, doing a quick assessment of an IoT device his company was considering offering its customers. The device is a counter system for tracking how many people are in a building or public venue.\nFirst, Leemans makes clear that he is cautious. \u201cAs per usual, I usually do some basic security\/sanity checks on a product before offering it to our customers,\u201d he writes. Then it was a recounting of \u201cbest practices\u201d in action.\n\u201cSo, we powered it on, and followed the instructions to set it up. It gets powered over Ethernet, but also has Wi-Fi to count the number of devices passing it.\n\u201cThe first thing that caught our eye, is that it sets up a network, with a broadcasted SSID and a default password. Bit strange, since it's also connected over Ethernet, but fine. Whatever. Except: you can't change the SSID or the password!\u201d\nThings quickly unraveled from there, to the point where the SignIPS and the device manufacturer were in a nasty public spat that involved accusations of extortion, a police report, a newspaper article, and, somehow, the music of Bruno Mars.\nYou don\u2019t have to go public with your IoT due diligence, as Leemans did. But he offers an excellent example of how IT pros can and should run a connected device through its paces, get under the hood, and really vet it instead of plugging it into the network and hoping for the best because you are optimistic and trusting.