I audited my own home network. My smart fridge had some explaining to do.
An asset inventory and risk assessment of a typical home network: what's connected, how sensitive it is, and how I'd lock it down.
Before you can protect anything, you have to know what you have. That sounds obvious, but it's the step most people skip, at home and at work. In Course 5 of the Google Cybersecurity Certificate, the lab asked me to treat a home network like a company would: list every device, note who owns it and where it lives, and rate how sensitive the data on it is.
Coming from criminal justice, this felt familiar. It's basically an evidence log. You catalog every item, you document who handled it, and you decide who is allowed to touch it. Same mindset, different crime scene.
The objective
Classify each device by location, ownership, network access, and data sensitivity. That classification is the foundation for defense in depth: layered access controls that make it hard for an attacker who gets into one device to move sideways into the rest of the network (that sideways move is called lateral movement).
| Asset | Network access | Owner | Location | Notes & data stored | Sensitivity |
|---|---|---|---|---|---|
| Network router | Continuous | ISP | On-premises | Dual-band (2.4/5 GHz). Core gateway routing all home devices on 5 GHz. | CONFIDENTIAL |
| Desktop PC | Occasional | Homeowner | On-premises | Stores private personal files, financial records, and sensitive photos. | RESTRICTED |
| Guest smartphone | Occasional | Friend / guest | On & off-premises | Untrusted endpoint connecting to the primary home Wi-Fi network. | INTERNAL-ONLY |
| Gaming console | Continuous | Homeowner | On-premises | Always connected; used by residents and visiting guests. | INTERNAL-ONLY |
| Amazon Alexa | Continuous | Homeowner | On-premises | IoT voice assistant storing PII, search history, and private audio. | INTERNAL-ONLY |
| Smart fridge (LG) | Continuous | Homeowner | On-premises | IoT appliance storing resident data, store apps, and credit card info. | PUBLIC |
Asset inventory & sensitivity classification matrix
The guest phone, the fridge, and Alexa all hold personal or payment data, and they all sit on the same network as the desktop with my most private files. In a company, unsegmented IoT and guest devices like these are an open door for lateral compromise. One hacked smart appliance shouldn't be a hallway to your tax documents.
Four sensitivity tiers
Each tier maps to an access rule based on the principle of least privilege: give every person and device only the access it needs, and nothing more.
Highest sensitivity. Only authorized owners get access, because losing this data is a serious privacy hit. Example: the desktop with personal photos, tax forms, and PII.
High sensitivity. Admins and network management only. Covers gateway configuration, router firmware, and ISP controls.
Medium sensitivity. Everyday data for people already on the home network, like gaming consoles and smart assistants.
Lowest sensitivity. Public-facing services or default device interfaces that hold no network infrastructure data.
How I'd fix it
- Segment the network. Move the fridge, Alexa, and guest phones onto their own guest/IoT network (a VLAN, or the router's guest Wi-Fi). If a smart device gets compromised, it can't snoop on traffic to the desktop.
- Add firewall rules. Set access control lists (ACLs) on the router so the IoT segment can't reach admin pages or shared drives on the main network.
- Clean up credentials and encryption. Change the ISP router's default admin password, use WPA3 (or at least WPA2) encryption, and turn off saved credit cards on smart appliances.
What I learned
This lab taught me asset inventory, data classification, and basic network risk assessment. Those are the same building blocks that IT auditors, SOC analysts, and security consultants use in frameworks like NIST SP 800-53 and ISO 27001. A few takeaways:
You can't protect what you can't see
Every security control starts with an inventory. Writing down "who owns this, where is it, what does it store" made the risks obvious before I touched a single setting.
Linux: build the inventory yourself
On a real network you wouldn't type this table by hand. From a Linux terminal, you can list devices your machine has recently talked to, or scan your own home subnet to find everything that's online. Only scan networks you own or have permission to test.
# devices this machine has recently seen on the local network
ip neigh
# ping-scan your own home subnet to list live hosts
sudo nmap -sn 192.168.1.0/24SQL: ask the inventory questions
Once the inventory lives in a database table, finding risky devices is one query. This one finds anything that's always online, owned by a guest or tied to IoT, and sitting on the main network:
SELECT asset, owner, sensitivity
FROM assets
WHERE network = 'main_lan'
AND (owner = 'Guest' OR device_type = 'IoT');Python: automate the check
A few lines of Python can flag any device that holds sensitive data but is rated too low, so mistakes get caught every time the inventory changes:
assets = [
{"name": "Smart fridge", "stores_payment_data": True, "sensitivity": "Public"},
{"name": "Desktop PC", "stores_payment_data": True, "sensitivity": "Restricted"},
]
for a in assets:
if a["stores_payment_data"] and a["sensitivity"] in ("Public", "Internal-only"):
print(f"Review: {a['name']} stores payment data but is rated {a['sensitivity']}")My criminal justice brain helped
Classifying assets is a lot like handling evidence: document everything, limit who can touch it, and keep a clear record. If you're coming from a non-tech background, the habits you already have count for more than you think.
