Home Network Attack Surface: Counting What Is Connected

Additional resource for the lesson “Attack Surface: Counting What Is Connected at Home” — Online Security course

Your home network attack surface is simply everything connected to it. Most households cannot name half of what is on their own network — and the things nobody can name are, reliably, the ones nobody is updating.

A. Why this matters

The companion resource on home network security covers what to configure. This one covers a different question: how much is there to configure in the first place?

The attack surface is everything reachable — every device, every active service, every connection that stays open. It grows quietly, because devices arrive one at a time and nothing ever prompts you to remove one.

B. Key concepts

Six ideas about measuring rather than configuring.

Attack surface

The full set of points through which something could be reached: devices, services, open connections.

Why it matters to you: It is a useful idea precisely because it is countable. You can look at a list and see it, which is unusual in security.

Connected devices as small computers

A smart bulb, a camera, a television, a speaker: each runs software, holds credentials and connects outward.

Why it matters to you: The important variable is not what a device does but who maintains it. A television from a large manufacturer and a cheap camera are very different propositions.

The unmaintained device

Something connected that stopped receiving updates, or never received any.

Why it matters to you: This is the specific concern. Not that a bulb is dangerous, but that a bulb which last received an update in 2021 sits on the same network as your laptop.

Segmentation

Putting devices on a separate network, usually the guest network, so they cannot reach your computers.

Why it matters to you: The most effective single measure available at home, and it requires no ongoing effort once done.

Ports open to the internet

Services deliberately made reachable from outside — remote access to a camera, a home server, port forwarding set up once for something.

Why it matters to you: Rare in most homes and worth checking, because these are the things that were configured for a reason that may no longer apply.

Reduction as the main lever

Disconnecting what is unused is faster and more effective than hardening what remains.

Why it matters to you: It is also the step people skip, because removing something requires deciding you no longer need it.

C. A practical example: fourteen devices, four questions

A household opens the router’s connected device list and finds fourteen entries.

• Six are obvious: two phones, two laptops, a tablet, a printer.
• Four are identifiable with a moment’s thought: the television, a speaker, a thermostat, a games console.
• Two are older: a tablet nobody uses, and a camera bought for a holiday let three years ago.
• Two cannot be identified at all.

Working through it

• The two unknowns turn out to be a second speaker and a smart plug. Both identified by switching them off and seeing which entry disappears.
• The old tablet is removed from the network entirely — it is unsupported and unused.
• The camera is checked: still receiving updates, so it moves to the guest network.
• The television, speaker, thermostat and plug move to the guest network too.

Result: fourteen devices down to nine on the main network, and the five with the least oversight are now separated from the laptops.

D. Try it yourself: the inventory

Thirty minutes, and worth repeating once a year.

Step 1 — Open the device list

• Your router shows everything connected, usually under ‘connected devices’ or ‘DHCP clients’.
• Write the list down. It is easier to work with on paper than on the router page.

Step 2 — Identify every entry

• For anything you cannot place, switch the suspected device off and see which entry disappears.
• Finish this step. An unidentified device on your own network is worth twenty minutes.

Step 3 — Ask two questions of each

• Do we still use it?
• Does it still receive updates from its manufacturer?

Step 4 — Act on the answers

• No longer used: disconnect it.
• Used but unsupported: move it to the guest network and consider replacing it eventually.
• Used and supported: change the default password if that has never been done, and move it to the guest network if it does not need to reach your computers.

The two questions in Step 3 are the whole method. Everything else follows from the answers.

E. Videos, articles and further resources

Independent and institutional sources in English.

NCSC (UK) — Smart devices: using them safely in your home
The most relevant source here: what to change on a connected device, and what to check before adding another one.
https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home

CISA — Securing your home Wi-Fi
Router settings, including the guest network that makes segmentation possible.
https://www.cisa.gov/audiences/high-risk-communities/projectupskill/module5

NCSC (UK) — Install the latest software and app updates
Why an unmaintained device is the specific concern, rather than connected devices in general.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/install-the-latest-software-and-app-updates

FTC — Online privacy and security
Consumer-facing advice on protecting your identity, securing your home network and browsing safely.
https://consumer.ftc.gov/identity-theft-and-online-security/online-privacy-and-security

NCSC (UK) — Cyber security advice for you and your family
The UK national authority’s advice hub for individuals: short, practical guidance written for people who are not IT professionals.
https://www.ncsc.gov.uk/section/advice-guidance/you-your-family

CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world

Links checked in August 2026.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior

This lesson sits at level FL3 on the Awareness pillar. It is the same exercise as mapping your digital life, applied to the house.

Skills

• Reading a router’s connected device list and identifying each entry.
• Checking whether a connected device still receives updates.
• Moving devices onto a guest network.

For professionals and organizations

• Applying the same inventory logic to home working setups, where personal and work devices share a network.

Awareness

• Understanding that exposure is countable, and therefore reducible.
• Recognising that the relevant question is who maintains a device, not what it does.
• Knowing that networks accumulate devices because nothing prompts removal.

For future instructors and ambassadors

• Running the inventory live. People consistently find one device they cannot name, and that moment does the teaching.

Secure Behavior

• Reviewing the connected device list once a year.
• Disconnecting what is no longer used.
• Keeping unmaintained devices on a separate network.

For organizations

• Treating unsupported connected devices as a decision to make rather than a state to tolerate.

G. Questions to sit with

1. How many devices are on your home network? Guess first, then look.
2. Could you name every entry on that list?
3. Which connected device in your home was last updated the longest ago?
4. Is there anything connected that nobody has used in a year?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply to reducing exposure.

Reduce

• R6 — Keep everything connected up to date, and check whether updates still arrive at all.
• R1, R2 — Default passwords on connected devices are credentials: change them, store them.

Minimum commitment: Disconnecting an unused device is the fastest reduction available and requires no configuration.

Separate

• MS10 — A VPN at router level for a more advanced setup.
• R9 — Connect over HTTPS only, including to device management pages.

Minimum commitment: A guest network for connected devices is not in the framework and is the most effective step at this level.

In short

• Attack surface is countable: open the router’s device list and look.
• The concern is not what a device does, but whether anyone still maintains it.
• Subtraction beats hardening — disconnect what is unused.
• The guest network separates what you cannot control from what you depend on.

Related resources in this course

Configuring the network, and the same exercise applied to accounts:

• Home Network Security: The Router Nobody Configures
• Map Your Digital Life: Where Your Protection Really Starts
• Device Updates: What Happens When They Stop Arriving

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.