Everyday smart gadgets like baby monitors can hand hackers a way into your wider network, a risk known as lateral movement.
The same flaw hits business sites, where CCTV recorders and SCADA systems often share one flat connection.
The fixes are simple: separate networks with VLANs, isolate ports, use a VPN over open ports, patch firmware, and give CCTV its own static IP.
There was a striking piece in the press this week warning that everyday smart gadgets, including baby monitors, can give hackers a way into the rest of your home network. It is the kind of headline that is easy to skim past. The device is small, the risk feels abstract, and most of us assume the worst that can happen is someone watching a quiet nursery.
The reality is less comfortable, and the article made the point well by pairing it with a far bigger number.
The Detail Everyone Remembers
The piece pointed to a now well known case from early 2020. A bank manager in Hong Kong, working for a Japanese company, authorised around $35 million in transfers after taking a call from a voice he recognised as a senior director at the parent company. The voice was a deepfake. Court documents later uncovered by Forbes set out how it happened, and investigators believe at least seventeen people were involved in moving the money around the world.
The lesson the article draws is the one worth holding onto. As a security expert quoted in the piece put it, gaining access to the right network, in that case a home network, can hand attackers the credentials they need to pull off something far larger. The small, overlooked device is rarely the prize. It is the way in.
This has a name – Lateral Movement
An attacker compromises one device on a network, a camera, a printer, an NVR, a baby monitor, and from there moves sideways to reach everything else. Because they are now behind the firewall, where defences are weakest and traffic is rarely inspected, a single infected device can put an entire network within reach.
It is a pattern we talk about constantly at Netcelero, because the same weakness shows up far beyond the home. The outdoor CCTV camera on a long cable, the recorder sitting on the main office network, the remote site connected over 4G or Starlink: each is a device that someone, somewhere, assumed was harmless. None of them needs to be the target to become the doorway.
Why this Matters Beyond the Home
For a business, the stakes are higher and the surface is larger. A remotely monitored CCTV system that shares the same flat network as the accounts PCs is a textbook example. So is a renewable energy site where a SCADA system and a surveillance network sit on the same connection without separation. The convenience of putting everything on one network is exactly what makes it fragile.
The good news is that the fixes are well understood, and none of them require you to rip anything out. They are about putting walls between things that do not need to talk to each other.
How to Shut the Side Door
- Separate your networks with VLANs – Keep cameras, building systems and office computers on logically separate networks, so a problem in one cannot spill into another.
- Turn on port isolation – Restrict devices so they can only reach their gateway, not each other. This is the single most effective brake on lateral movement.
- Stop exposing devices directly – Avoid open port forwards to the internet. Reach equipment through a secure VPN instead, so nothing sensitive is left facing the open web.
- Keep firmware patched – Most compromised devices are running software that should have been updated months ago. Updates are not optional housekeeping, they are front line defence.
- Give CCTV its own static IP – On sites where separation really matters, our solar farm customers run CCTV on a second static IP, kept fully apart from SCADA and core systems on the same i-ctrl. The two never share a path, so a problem on one cannot reach the other.
Where Netcelero Fits
Our work is firmly on the business side of this picture, in CCTV, remote monitoring and increasingly in industrial and renewable sites. The principle that runs through everything we build is simple: give people secure remote access to their equipment without exposing the network it sits on.
In practice, that means the i-spi and i-ctrl deliver a fixed, reachable connection over 4G, 5G, Starlink or fibre, while keeping that access behind a VPN rather than an open port. The i-ctrl supports VLANs and can keep separate systems on independent networks, for example a SCADA network and a CCTV network kept logically apart on the same site. The aim is not more technology to manage, but fewer doors left open.
A baby monitor and a solar farm have very little in common. The weakness that connects them is the same one, and it is one worth designing out.
Worried about What is on Your Network?
If you would like to talk through how your sites are connected, and where the doors might be, our team is happy to help.
