Farm IoT Security: Keeping Cheap Sensors From Opening Your Network
A soil sensor costs less than a sack of fertiliser. Left on defaults, it can also be the easiest way into the farm's network.
Farm IoT security comes down to a few habits: change every default password, keep firmware updated, know which vendor clouds your devices talk to, put sensors and controllers on their own network segment, and reach them remotely through a VPN or gateway rather than open router ports. Keep an inventory of every device, so nothing is forgotten.
Key takeaways
- Every sensor, gateway and controller is a small computer, and defaults are the first thing attackers try.
- Firmware updates matter, so prefer vendors that publish them and plan who installs them.
- Put farm devices on their own VLAN with rules about what they can reach, never on the office network.
- Reach devices remotely through a VPN or a managed gateway, not by forwarding ports on the router.
- An up-to-date inventory is the foundation: you cannot secure a device nobody remembers installing.
Why are cheap farm sensors a security risk?
Cheap sensors are a risk because each one is a small networked computer, often shipped with a default password, rarely updated, and connected to the same network as everything else on the farm. One weak device is enough to give an outsider a foothold, and from there the office PCs, camera recorder or irrigation controllers may be within reach.
The problem is rarely the sensor's own data. Nobody much wants your soil moisture readings. The risk is what the device sits next to. A controller that switches pumps, a recorder full of footage, or a laptop with the farm's banking open is worth far more, and a forgotten sensor on a flat network is a path to all of them.
This is a known issue across the industry. NIST IR 8259 Rev. 1 starts from the point that IoT products often lack the security capabilities their customers need, and sets out what manufacturers should provide. Until every product meets that bar, the buyer has to make up the difference with good setup.
What should you check before buying farm IoT devices?
Check whether the device lets you change its passwords, whether the vendor publishes firmware updates, and where its data goes. Those three answers tell you more about the device's security than any marketing sheet. Standards bodies such as ETSI publish cybersecurity baselines for connected products, and the questions below follow the same thinking.
- Does each device have a unique password, or one shared default? Can you change it?
- Does the vendor publish firmware updates, and for how long will it support this model?
- Is there a way to report security problems to the vendor, and does it respond?
- Which cloud services does the device or gateway talk to, and in which country is the data held?
- Can it work locally if the internet or the vendor's cloud goes down?
- Does it expose data through a documented interface, so you are not locked into one app?
None of this rules out inexpensive hardware. It means choosing inexpensive hardware from vendors who answer these questions, and planning for the gaps in those who do not.
How do you deal with default passwords and firmware?
Change every default password before the device goes into service, and decide at the start who checks for and installs firmware updates. Default passwords are published in manuals and collected in lists that automated scanners try against anything they find. A device left on its factory login is effectively open to anyone.
Use a unique password for each device or gateway, stored in a password manager the farm controls rather than in one technician's phone. Where a device supports it, turn off services you do not use, such as old web interfaces or remote management features you have no plan for.
Firmware is the device's own software, and updates fix security holes as well as bugs. On a farm, the realistic plan is a quarterly check of each device type against the vendor's update page, with updates installed during a quiet period and tested on one device first. A controller that runs irrigation should never be updated in the middle of a hot afternoon.
Why put farm devices on their own VLAN?
A separate VLAN keeps farm devices in their own section of the network, with rules about what they can reach, so a compromised sensor cannot talk to the office PCs or the camera recorder. It is the single most useful step for a mixed farm network, and it costs little if the switches and firewall support it.
A sensible layout has separate segments for office computers, guest and staff Wi-Fi, cameras, and sensors and controllers. Sensors and gateways are allowed to send data to the dashboard or cloud service they need, and nothing else. Controllers that switch pumps or valves get the tightest rules of all.
We explain the same approach for offices in our article on IoT network segmentation. Where the farm runs industrial-style controllers for pumps, fertigation or cold rooms, the principles in our piece on SCADA and OT security also apply.
How should you reach farm devices remotely?
Reach them through a VPN, or through a managed gateway or vendor cloud that the devices connect out to, never by forwarding ports on the farm router. Port forwarding puts the device's login page directly on the internet, where it is found within hours by scanners looking for exactly that.
With a VPN, the farm manager or agronomist connects securely to the farm network first and then sees the devices as if on site. With a vendor cloud, the device makes an outbound connection and you view it through the vendor's app, which avoids open ports but means trusting the vendor's own security. In both cases, use strong unique passwords and multi-factor sign-in for every account that can see or change farm systems.
Remote sites on Starlink or 4G need a little extra thought, because some of those connections do not support incoming traffic at all. That is another reason to design remote access as an outbound connection from the start.
Why are gateways the right place to control traffic?
Gateways are the right place because most farm sensors do not speak to the internet directly: they talk to a gateway over LoRaWAN or another radio, and the gateway forwards their data. That makes the gateway a natural choke point, where one well-configured device protects dozens of simple ones.
Treat the gateway as the most important device on the sensor network. Change its passwords, keep its firmware current, restrict it to sending data only to the network server and dashboard it needs, and log its connections. If a gateway is lost or tampered with in a far corner of the farm, you want to know quickly and be able to replace it without reconfiguring every sensor.
Commercial IoT services in the UAE also have a registration route with TDRA. The TDRA IoT services registration asks for a network connection diagram of the service, which is one more reason to know exactly how your gateways and devices connect. Our guide to TDRA IoT registration explains when it applies.
Why does a device inventory matter so much?
An inventory matters because you cannot update, segment or retire a device you do not know exists. Farms add devices over years: a weather station here, a tank sensor there, a camera a contractor fitted. Within a few seasons, nobody has the full list.
Keep a simple register with each device's type, location, network address, owner, vendor, firmware version, where its data goes and when it was last checked. Update it whenever a device is added, moved or removed. When a vendor announces a security problem, the register tells you in minutes whether the farm is affected.
How Listonics helps secure farm IoT
We design and build the network side of farm IoT: segmented switching and Wi-Fi, gateways, firewall rules, secure remote access and the device inventory, and we handle TDRA registration where it applies. We do not sell irrigation or climate systems or give crop advice; the grower or their agronomist sets the targets, and we make the readings reliable and the systems hard to break into. Our cybersecurity service covers the security review, and our smart farm IoT page covers the wider build. Talk to us about your farm network.
Frequently asked questions
Usually not as a target in itself, but as a way in. Automated scanners look for any device with a default login or an exposed web page, regardless of what it does. Once inside, an attacker can try to reach more valuable systems on the same network, such as office PCs, the camera recorder or controllers that switch pumps.
A VLAN is a separate section of the network created inside the same switches and Wi-Fi. Devices on one VLAN cannot talk to devices on another unless a firewall rule allows it. On a farm, that lets sensors send data to their dashboard while being blocked from the office computers and the camera system.
The sensors themselves are simpler and use encrypted radio links, but the gateway that collects their data is a full network device and needs the same care as any other: changed passwords, current firmware, restricted traffic and logging. Most of the practical risk on a LoRaWAN network sits at the gateway and the accounts used to manage it.
It can be, provided the vendor has a sound security record, the account uses a strong unique password and multi-factor sign-in, and you know where the data is held. A vendor cloud avoids open ports on the farm router. Ask what happens to your devices and data if the vendor stops supporting the product.
Check for updates on a regular schedule, quarterly is practical for most farms, and promptly when a vendor announces a security fix. Test on one device first, install during a quiet period, and record the new version in the device inventory. Never update a controller in the middle of an irrigation or cooling cycle.
It depends on whether you are providing an IoT service commercially or simply running sensors for your own farm. TDRA has a registration service for companies delivering IoT services in the UAE. Check the current requirements with TDRA for your situation; we can help prepare the network diagram and the application where it applies.
Written by Srinivasan Ramachandran, Founder, Listonics · Published Nov 06, 2026 · Last reviewed November 6, 2026 · 1638 words
