Return to Answer

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.
2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

• About DMZ from Security.SE

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.
2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

• About DMZ from Security.SE

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.

2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

About DMZ from Security.SE.

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.
2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

• About DMZ from Security.SE

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.

2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

a. http://security.stackexchange.com/questions/3667/what-is-the-real-function-and-use-of-a-dmz-on-a-network

The other answers cover a lot of the technologies that you can use to protect your system. Here are some more general thoughts/philosophies.

1. A DMZ is your friend - In almost every case where you have a service facing an external network a DMZ (see a.) will be very beneficial. In this case it will both minimize the attack surface and minimize the damage. By limiting the number of devices in the DMZ to only the ones that need external access you limit the attack surface. Also the DMZ will make it much harder for anyone to access your core network, thus minimizing the damage.

2. Whitelist, don't Blacklist - By default every single protocol, port and internal connection should be blocked by default. This blocking should be setup in the device (if possible), the firewall and the router. Only enable options that you are actively using and only for the devices that need one. If you know and must use a protocol for an IoT device that is weak (for example devices that are affected by Mirai) you should setup a device (like a RaspberryPi) to act as relay. You completely isolate the device from the network and only communicate with it via a secure protocol (ssh, vpn etc.) that the RaspberryPi transforms into the protocol that the device needs.

About DMZ from Security.SE.