Secure Home Network Partition for IoT Devices

Question

What is the best approach to partitioning IoT devices from non-IoT devices at home?

I have heard that setting up separate networks, one for IoT devices and one for everything else, is a good approach. This can be thought of as a three router "Y" network set up. One router connects the home to the outside world and connects to two other routers. One of those routers is for IoT components and one for everything else.

• My IoT devices are IP cameras, smart light bulbs, Nest, etc.
• My non-IoT devices are a PC and a network printer.
• Users of this network are one experienced computer industry professional and one non-computer savvy user.

Answer 1

What is the best approach to partitioning IoT device in the home?

I have heard of setting up separate networks, one for IoT devices and one for everything else.

Is this approach secure enough?

Well, technically, there is no such thing as absolute security. Doing so should be technically safe enough, if we consider that your router doesn't have any vulnerabilities and can separate the network well enough. Enable "Client Isolation" (or whatever your router company calls it) if your router supports it (It may be under NAS, Firewall or Wireless menus):

Are IoT devices a major security risk to have on the same network as my PC?

Kinda. While I haven't read of such an attack yet, IoT devices can technically be used to sniff the Internet communications or to make use of vulnerabilities on your operating system or the software you have installed to take it over. This can be a bigger risk if your PC has SSH or Telnet port open, and especially if it uses an insecure password. This was actually abused by the Mirai botnet: It attacked telnet ports of devices and tested common passwords to try to take over the device, to include it in the botnet. But this requires a vulnerability in both the IoT device and your computer, so it's unlikely to happen.