I’ve been in the IT game for nearly 20 years. Between the last two organizations that I worked for, I helped bring nearly 7,000 servers into compliance for security standards across eight countries. So you’d think that all that experience would make home security easy.
Sure, I had the basics in place. However, it wasn’t until I ran a real home security risk assessment on my home network that I realized how bad it was. For all the work and diligence that I put into ensuring that everything in my workplace was secure, I had never actually bothered to put that same level of effort into the place that matters most: my own home.
Here is the problem with most security advice that you find online. It’s all just a list. They tell you to buy a specific camera, use a specific router, and enable a specific setting and then just assume you are secure.
That works to a point, but it doesn’t really help you assess what matters most for you specifically. What works for your neighbor’s home may be completely different from what works for your home due to a huge number of factors. Your assessment needs to take into account your home, your family, and your specific risk tolerance.
A proper home security risk assessment will take this into account for you. It takes the same thinking that I use professionally, strips out all the corporate jargon, and then turns it into something you can do on a Saturday afternoon with a notebook and a cup of coffee.
Now before I go into more on this post, I want to address what risk tolerance is because it’s kind of an abstract term and I try to always explain things when they get too much into the world of geek speak.
Risk tolerance is pretty simply the line in the sand between ‘I’m okay accepting this.” And “I need to fix this.” For example, you might have a very low risk tolerance for anything related to your finances but a high tolerance for low value devices where the impact is very limited.
This is an important concept to understand because it’s the basis for the rest of this post. From here on out, I’m going to walk you through the exact framework I use. Don’t worry, it’s not complicated. It’s the same four questions that security professionals ask about a datacenter, just pointed at a house instead.
Most Home Security Advice Skips the Hard Part
Do a search for “home security tips”. I just did and I came back with a ton of articles on doorbell cameras, locking your door, and installing deadbolts. That’s great advice, but it doesn’t tell you if your biggest exposure is actually your front door.
In my professional work, this step is called risk assessment. This always comes before you ever implement any kind of remediation for security. The logic is that you don’t want to lock down a system without knowing what is on it and what could go wrong.
Home security works the same way. Buying gadgets to secure your home without performing a home security risk assessment first is like buying a deadbolt for your front door before you’ve assessed that the real issue is that your back window doesn’t have a lock on it.
What a Home Security Risk Assessment Actually Is
Risk assessments are incredibly simple and very easy to do. Once you strip away all the professional language, a risk assessment is just answering three questions:
- What am I trying to protect?
- What could go wrong?
- How likely and how bad would that be?
See? I told you it was simple! Three questions is all it is. A home security risk assessment applies those same three questions to your house, your devices, your family’s routines, and your neighborhood. The output isn’t a binder. It’s a short, ranked list of the two or three things that are actually worth fixing this month rather than ten things that you fix halfheartedly and then have to actually fix for real at some later point. Anything worth doing is worth doing right the first time.
Home Security Risk Assessments and Physical Security
Now one thing that you may note as you’re reading through this is that I mention a lot of non-technical things as part of my home security risk assessment. Things like vehicles and the physical structure of your home.
People often forget that physical infrastructure is a critical part protecting your digital life. In the enterprise world, a huge part of cybersecurity is ensuring that physical security is in place, so it makes sense that the same would apply at home.
Think about it this way: What is easier to steal? Your data on your laptop when it’s sitting on your desk at home behind a locked door or your data on your laptop when it’s sitting on a table in your front yard?
Obviously it’s easier to steal it from your front yard. That’s why I include physical security in this framework. Without assessing it, you are leaving yourself open to only seeing part of the picture.
My Simple Framework: 5 Steps
I use five steps. Each one takes less time than the last and altogether it usually takes less than an hour to accomplish. Most of that time is spent thinking rather than actually doing anything.
Step 1: List What You’re Actually Protecting
This is the most important step in the entire process. You can’t protect anything unless you know what you are protecting. Start with a plain list. Not a security list. Write down anything that matters to you. For most homes this is going to look something like this:
- People (Yourself, your family, guests, pets)
- The physical structure and its contents
- Vehicles
- Devices such as laptops, phones, smart home gear, etc.
- Data such as photos, financial records, passwords, and backups
Write these down before you think about threats. This step is important because it does a great job of changing the framing of how people see their home. Most people will realize after they’ve listed everything out, that the most important thing they want to protect is a person’s safety and their data rather than their television.
Step 2: Identify Realistic Threats
For each item on your list, ask what could actually happen to it. Do yourself a favor and keep this grounded in reality. A home security risk assessment isn’t useful if it spends equal energy on a home invasion, a meteor strike and a zombie invasion. You should be prepared for two of those three things, I’ll let you figure out which ones.
Common categories worth checking against your own list are:
- Break-in or forced entry
- Package theft
- Smart home device compromise such as a camera or a lock with default credentials
- Router or Wi-Fi compromise
- Fire or water damage
- Social engineering such as someone posting as a utility worker or a delivery driver
- Data loss from a failed drive with no backup
Note that most of these don’t involve a stranger climbing through a window. Most home risk lives in devices and habits rather than movie-plot burglars.
Step 3: Score Likelihood and Impact
In order for the assessment to be useful, you need to give every threat a score. This model scores the two values of likelihood and impact on two values from 1-5.
- Likelihood is how realistic is this for your specific home?
- Impact is how bad would it be if it happened?
Multiply the two numbers. A threat that scores 2 for likelihood and 5 for impact such as a house fire would score a 10. A threat that scores 4 for likelihood and 2 for impact such as a package being stolen off the porch would score an 8.
Both of these things deserve attention, but they deserve different kinds of attention and different budgets. This is the same math I use when I’m doing threat assessment to rank vulnerabilities in a corporate environment. It scales down to a single house quite nicely without losing any of its value. This scoring doesn’t need to be scientific, it just needs to be honest.
Here is a sample for a typical household
|
Threat |
Likelihood (1-5) |
Impact (1-5) |
Score |
|
Unpatched router / default admin password |
4 |
4 |
16 |
|
Package theft |
4 |
2 |
8 |
|
House fire |
2 |
5 |
10 |
|
Break-in through an unlocked door |
3 |
5 |
15 |
|
Smart camera with weak credentials |
3 |
4 |
12 |
Dramatic threats always seem to get more attention. Think about it. Any time there is a shark attack, it makes the news. Yet you are statistically more likely to be killed by a cow than a shark, but you never hear about death by cow.
So back to our threat modeling. When you sort it by score, an unpatched router and an unlocked door outrank the fire and the camera even though the fire seems much scarier. This is why we score things. It corrects for the fact that dramatic threats get more attention than they statistically deserve, while boring, high probability threats get ignored.
Step 4: Prioritize and Act on the Top Threats
Sort your list by score, high to low. Pick your top three. Now it’s very important that you limit it to your top three and don’t go beyond that. Otherwise you risk overwhelming yourself and then nothing gets fixed. Trust me, I’ve been there. When everything is a priority, nothing is a priority.
Take those top three, and then write down the action you’ll take in the next 30 days to remediate it. For example, if your highest risk is that all of your bank accounts are behind a reused password, then the solution would be to get a password manager and update your passwords. If your highest score threat is that you have an unsecured router, the action you’d write down might be to update the firmware and change the default admin password.
The action shouldn’t be something like buying a whole new mesh network…at least not in most cases. If you are sitting there with an unsecured router from 2012, then maybe that is the solution after all. If it’s that old, there are a whole host of reasons security and otherwise to upgrade to something new. But then that is getting into a whole different scenario beyond the scope of this risk assessment framework. It’s usually pretty safe to assume that your router is probably less than 10 years old.
Fix the highest-leverage problem first, with the smallest reasonable fix, before you spend money on anything else.
Step 5: Revisit it Twice a Year
A home security risk assessment isn’t a one-time document. Your risks are going to change any time you get a new device, move to a new neighborhood, change from working in office to remote, or if you have kids. It’s a good idea to revisit it every 6 months. Time it with that awful time change that we are for some reason forced to do every year. Yes…I have opinions on daylight savings time. You are welcome to message me if you’d like to hear them.
Usually revisiting this should only take about 15 minutes because the list already exists. You’re just updating scores and adding anything new rather than starting over.
A Real Example From My Own House
When I first ran through this assessment in my own home, my expectation was that it was probably going to be a digital picture frame or a smart bulb that was my biggest threat. I knew it wasn’t going to be my router because I’ve got it set to auto-update the firmware every month and it’s been doing that successfully for years.
What makes my home special is that I have a home lab that I turn on and off depending on what I’m studying and learning at any given time. It changes a lot. I’m always creating and destroying virtual servers and client machines.
What that meant is for the prior six weeks, the lab I’d been working on was exposing several services directly to the Internet. Something I’d never allow in a workplace setting.
This was a high likelihood because I had patching turned off for it because it was disrupting what I was doing in the lab. High impact because those servers have direct access to my NAS because I was using it as a location to transfer data. That same NAS that hosts all of my media and my most critical files.
The fix wasn’t something dramatic. I patched everything, moved everything onto its own virtual network, and life was good.
Now I’m going to go out on a limb here and guess you probably don’t have a home lab that you are dealing with on your network that changes frequently. I know there are a lot of us out there that do, but let’s face it, it’s not that common. More likely you are going to find that your highest threat is going to be weak and reused passwords or a smart device. Trust me, during my audit I have found a lot of that on my accounts.
However, this does show the importance of scoring and making sure you are identifying realistic threats. This found something I wouldn’t have thought about otherwise because “it’s just a lab”. It changed my behavior when working on the lab so that I wasn’t exposing my network unnecessarily to threats just because it was the simplest manner to accomplish my lab. Twenty minutes of scoring ensured that I was going for the right problem rather than the most obvious one.
Common Mistakes People Make With This Framework
Scoring everything as high.
If every threat is a 5, you’ve built a list. Not an assessment. I said this earlier and I’m going to say it again one more time for you people in the back who may have missed it the first time. When everything is a priority, nothing is a priority. Force yourself to spread scores out.
Skipping the boring threats
Someone breaking into your house and holding you at gunpoint while his partner rummages through your wife’s jewelry is dramatic, but not very likely to happen. A stolen package off your doorstep? I live in a really safe neighborhood with multiple police officers in it. We had four packages stolen off doorsteps in our neighborhood last winter. Yes, it’s less dramatic than the break-in, but it’s far more likely to happen. Ranking proper likelihood is as important as impact.
Doing it once and filing it away
A big part of the value of the home security risk assessment is revisiting it. Things change in your house all the time. A stale assessment is no better than having no assessment at all.
Buying a fix before scoring the problem
It’s very tempting to solve the problem by buying something that you’ve already formed an opinion about. I’ve done that before and ended up with several hundred dollars in security cameras that looked really good on paper. I’d been wanting them for a while.
The company pulled a bait and switch on me, they were a gigantic headache for years, and they never worked very well. Seriously, my in-laws setup a 12 foot skeleton in front of our house, right in front of the camera and it never notified us of a single thing.
I got them because someone was messing with our garage door keypad. We never caught them and clearly we never were going to if it couldn’t even pick up my in-laws spending 45 minutes assembling a giant skeleton. We could have achieved the same thing with a dummy camera with a blinking light for a fraction of the cost. So the lesson is, score first, buy second. Don’t just buy because you like the product.
Frequently Asked Question:
How long does a home security risk assessment take?
The first one should take about an hour, with most of that time spent listing out assets and threats. Every assessment after that generally takes about fifteen to twenty minutes because you’ve already got the list, you are just updating it.
Do I need any special tools or software?
No. You can use a notebook if you like paper. I use a simple spreadsheet. I like Excel but Numbers or Google Sheets will work just as easily. I like spreadsheets because it automatically does the math for me and I can sort it in a half a second.
Is this different from a professional home security audit?
A paid security audit usually inspects your physical property and gives you a vendor’s recommendations. A home security risk assessment is something you do yourself. It’s less about products and more about understanding your own priorities before you start spending money on things.
What is a reasonable number of threats to track?
Ten to fifteen is pretty reasonable for most households. Any more than that and the list becomes hard to act on, which defeats the purpose.
Building This Into a Habit
The reason this framework works at scale from a hospital to a datacenter to a single household is that it’s highly repeatable and it doesn’t demand perfection. What it does demand is honesty about what matters and what’s likely. If you run through these steps once, you end up with a short list of real priorities rather than a long list of generic advice.
You don’t need a security background to do this. You just need a notebook or a spreadsheet, an hour, and a willingness to be honest about what is actually likely to wrong in your own home. Start with the list of what you are protecting. The rest will all follow from there.