A hospital's network alarms one afternoon because an infusion pump is scanning the internal network for other devices. The pump was never meant to do anything but deliver medication on a schedule, yet it has an operating system, a network connection, no way to run antivirus, and firmware the vendor last updated years ago. It is a computer that nobody treated as one, and now it is a foothold.
This final lesson of the section covers the vectors that reach devices and spaces outside the traditional idea of a computer. On the CompTIA Security+ SY0-801 exam, objective 2.3 lists Internet of Things (IoT) devices (cameras, sensors and printers), operational technology (OT), physical vectors (locks and keys, access vestibules and access passes), and signal-based vectors (Bluetooth, radio frequency and near-field communication). For each, this lesson explains how it is used, what it looks like, and the primary defense. The physical controls themselves, locks, vestibules and badges, are taught in depth in the physical-security section, so here they appear only as vectors.
IoT devices ship insecure and are rarely patched
The Internet of Things is the mass of network-connected devices that are not general-purpose computers: cameras, environmental and motion sensors, printers, smart building systems, medical devices and more. Each runs software, holds a network connection, and so is a computer, but it is rarely managed like one. That gap is the vector.
IoT devices earn attackers' attention for a short list of reasons. They very often ship with well-known default credentials that buyers never change, so an attacker can log in across thousands of identical devices at once. They receive few or no security updates, so known vulnerabilities stay open for the device's life. They seldom run endpoint protection and are easy to leave off the asset inventory, so they go unmonitored. And they are built for function and low cost, with security an afterthought. The named examples each add a twist: internet-exposed cameras have been infected en masse and used in enormous botnets, sensors can feed false data to whatever relies on them, and network printers store documents, hold cached credentials, and are almost never patched.
What it looks like is a device doing something outside its single purpose, a camera reaching across the network, a printer making outbound connections. The defenses are to change default credentials immediately, place IoT devices on a segmented network isolated from sensitive systems, keep them off the public internet unless truly required, patch firmware where the vendor provides it, and inventory and monitor them like any other asset. On the exam, a camera, sensor or printer compromised through defaults or missing patches is the IoT vector, and segmentation plus credential changes is the answer.