Key takeaway
Inventory each device with an owner, purpose, security capabilities and update-support period.
An IoT device is purpose-built and still a network asset
An IoT device may combine sensors or actuators, network connectivity, local or cloud processing and a management interface. A smart thermostat can report room temperature; a camera or doorbell, images; a wearable, pulse and activity; a vehicle, location and diagnostics; and an industrial sensor, vibration for maintenance. Their roles and security capabilities differ: a compromised camera may expose images, while a weakly protected sensor may disrupt an industrial process. Inventory the model, software version, network interfaces, owner, data handled, support lifetime and available security capabilities.
Identification
The device should have a unique identity in the network and asset inventory.
Software updates
The manufacturer should document a secure update mechanism and support lifetime.
Interfaces
Expose management interfaces and services only to authorized systems.
Set security requirements before connection
During procurement and onboarding, assess more than price and features. Check unique identification, authorized configuration changes, protection of stored and transmitted data, restricted interface access, secure signed software updates and security-state reporting. Request documentation on vulnerability reporting, end of support and update policy. Match the network segment to the device’s role; a medical device and a display in a guest area should not automatically receive the same access. A compromised device may expose data, disrupt operations or provide a foothold into other systems.
IP phones and VoIP systems
An IP phone digitizes voice and sends it as packets over an IP network. SIP or H.323 may establish calls, while RTP often carries media; a particular system may use other options. If encryption is not enabled, voice or control data may be intercepted on a shared network. To reduce toll-fraud risk, review administrator credentials, PBX management access and permissions for international calls. Change default passwords, restrict the management portal, enable supported TLS/SRTP modes, patch firmware and review unexpected premium or international calls.
Map the call path
Know which segments can reach phones, the PBX, provider links and administrator interfaces.
Protect media and signaling
Enable TLS/SRTP after confirming provider and endpoint support.
Review billing anomalies
Review unusual changes in call volume, destination and timing.
BYOD: protect work data and personal privacy
Personal phones and laptops introduce risks from device diversity, outdated software, loss or theft, and mixing work data with personal accounts. BYOD can reduce hardware purchases and let staff use familiar devices, while support across operating systems, compatibility and security enforcement take more effort. Corporate-owned devices give the organization more consistent configuration and inventory, while it pays for acquisition and management. A written policy should define allowed devices, apps and data; lock, encryption and update requirements; selective work-container wipe; and how to report loss. MDM/EMM manages corporate access; explain monitoring boundaries on personal devices. On offboarding or device replacement, revoke tokens and remove work data without wiping personal content wholesale.
Access
Use MFA and role-based access; grant only the resources needed for the job.
Data boundary
App containers and selective wipe separate work data from personal photos and files.
Lifecycle
Define procedures for enrollment, updates, loss, offboarding and device return.
Where mobile EDR and MDR fit
EDR connects endpoint telemetry with investigation and response workflows. MDR can add specialists for monitoring, investigation and response. When selecting mobile protection, test supported iOS and Android versions, enrollment models, available events and device actions. For BYOD, define personal-data access boundaries, log retention, escalation and service hours. Start with the device inventory, critical data and acceptable risk.
Coverage
Check device models, OS versions, enrollment requirements and detection capabilities.
Response authority
Define which actions the provider can take independently and which require approval.