A Threat Taxonomy for the Smart Home

Brett Crawley
Brett Crawley 16 min read
Every Connected Home Fails Open Somewhere: header image of a thermal house cross-section

Every Connected Home Fails Open Somewhere: A Threat Taxonomy for the Smart Home

TL;DR

  • The Smart Home Threat Taxonomy v1.0 has 179 entries: 169 threats in 13 suits, plus 10 structural hazards that belong to the connected home as a whole.
  • It covers what general frameworks leave out: physical consequences (50 entries carry a † for physical safety), the household as many users, resale and the device lifecycle, and fleets of energy devices acting on the grid.
  • Every entry has an ID like OPH-CM-Q: one hyphenated token you can search for, the same on the card and in the taxonomy.
  • 38 entries cite a public case, from Mirai to the Ring takeovers to thermostats in a Texas heat wave.
  • The taxonomy grew out of Open House, my threat modeling card game for the connected home. You’ll find it all at ostering.com/taxonomies/smart-home.

In my launch post for Open House I said that the game came first and the taxonomy is its reference. This post is about the reference: why the smart home needs one of its own, what’s in it and where it stops.

Why the smart home needs its own taxonomy

When I started on the smart home, I went looking for a threat taxonomy I could build the game on. There’s plenty of good material on IoT security: device baseline standards, top ten lists, testing guides and vendor checklists. What I couldn’t find was a taxonomy that treated the house as the system, rather than the device.

That distinction matters. A device standard asks whether the camera has a default password. It doesn’t ask what happens when the person who set up the camera moves out and keeps the account. It doesn’t ask whether the lock fails open or fails shut when the battery dies, or what happens to the grid when ten thousand home batteries discharge at the same instant. Those are the questions that keep coming up when you sit down with a real design, and they are the ones the cards had to ask.

So the taxonomy is organised around the house: thirteen suits, from the roof to the vendor cloud, plus ten hazards that belong to the house as a whole.

The thirteen suits of the Smart Home Threat Taxonomy placed on a thermal cross-section of a house

What general frameworks miss

STRIDE, CAPEC and CWE are all mapped in the taxonomy, and I’ve written a separate post on how those mappings work. They’re essential, but on their own they leave four gaps in the smart home.

1. Physical consequences

In most threat models, impact is measured in data: what leaks, what’s altered, what’s unavailable. In a house, a software fault becomes a physical event. The heating is driven to a dangerous temperature (OPH-DM-A Heating Driven Out of Range). A lock fails open, or fails locked and traps people in a fire (OPH-AL-Q Fails Open, Fails Shut). An inverter’s grid-protection settings are changed, putting line workers at risk during an outage (OPH-EN-K Grid Protection Switched Off).

50 of the 179 entries carry a †, which marks a physical-safety consequence: 47 threats and 3 of the structural hazards. The first hazard says it outright: OPH-TR-1 The House Is the Blast Radius.

2. The household is many users

Most products model one owner. A home has partners, children, lodgers, guests, cleaners, landlords and installers, with interests that differ and change over time. The Household suit is there because the most painful smart home threats come from inside the house: OPH-HH-A House Turned Against Its People, where a partner or ex-partner with admin rights uses the cameras, locks, heating and lights to watch, control or frighten the others. That’s not an edge case; it’s been reported widely (more on the public cases below). The hazard is OPH-TR-5 Many Hands on the Keys.

3. Resale and the lifecycle

A house lasts decades. Its devices are supported for a few years. And the house changes hands with the devices still on the walls. OPH-LC-Q Previous Owner Still Connected and OPH-HH-K Ex Keeps the Keys are the same problem from two directions: devices stay with the bricks, accounts stay with people. The hazards are OPH-TR-4 Outlives Its Support and OPH-TR-6 Houses Change Hands.

4. Fleets on the grid

Solar inverters, home batteries, EV chargers and heat pumps are now controlled from a vendor’s cloud. One compromise, or one rogue operator, switches thousands of homes at once and destabilises the grid (OPH-EN-A Fleet Switched at Once). This is a threat no single house can mitigate, and it’s why the taxonomy has OPH-TR-7 Many Homes, One Grid.

The thirteen suits

The suits split across Open House’s two decks. The first seven are The Things; the last six are The Control. Each suit has 13 entries, ranked by severity from the Ace down to the 2, and each suit has its own page.

  • Hub and Bridges (HB): The hub is the house’s local brain: it holds the network keys for every device, runs the rules and speaks for the house to the cloud.
  • Radio and Mesh (RF): Zigbee, Z-Wave, Thread, Bluetooth, Wi-Fi and the 433 and 868 MHz bands carry the house’s commands through walls and past the property line.
  • Domotics (DM): Lighting, heating and cooling, blinds, plugs and relays, water valves and leak sensors: the building services that the house runs on.
  • Cameras and Doorbells (CM): Indoor and outdoor cameras, video doorbells, recorders and their clips put the inside of the house, and the people in it, on the network.
  • Alarms and Locks (AL): Intrusion alarms, smoke and carbon monoxide alarms, smart locks, keypads, garage doors and gates: the devices that decide who comes in and whether anyone hears about it.
  • Appliances (AP): Ovens and hobs, washing machines, fridges and freezers, robot vacuums and mowers, televisions and water heaters.
  • Energy (EN): Solar inverters, home batteries, EV chargers, heat pumps as flexible loads, smart meters and the energy manager that plays them against the tariff.
  • Home Network (NW): The router, the Wi-Fi, the guest network and the house’s path to the internet.
  • Vendor Cloud (CL): The vendor’s service that binds devices to accounts, relays commands, stores events and links to other ecosystems.
  • Remote Control (RC): The phone in a pocket, the computer at work, the tablet on the wall and the watch on a wrist: the clients that control the house from anywhere.
  • Voice and Automations (VA): Voice assistants, routines and scenes, rules and scripts, third-party skills and AI agents: the layer that turns words and events into actions on the house without a person pressing a button.
  • Household (HH): The people in the house: partners, children, lodgers, guests, cleaners, landlords and installers.
  • Lifecycle (LC): Manufacture, onboarding, updates, support, resale and disposal.

The ten structural hazards

The structural hazards are the game’s Trumps. They aren’t threats to any one device; they are properties of the connected home as a whole, and they make every other threat worse. They all live on one page: Structural hazards.

  • OPH-TR-1 The House Is the Blast Radius †: A software fault in a smart home becomes a physical event: fire, flood, freeze, a door open to the street.
  • OPH-TR-2 Every Device Is a Door: The house is as secure as its least secure connected device: the cheapest plug shares a network and a hub with the alarm and the lock.
  • OPH-TR-3 The Cloud Holds the Keys: Local functions and safety features depend on a remote service the household does not control, and that service can fail, change or be compromised.
  • OPH-TR-4 Outlives Its Support: A house lasts decades, its devices are supported for a few years, and vendors leave the market, so the house fills with devices nobody patches.
  • OPH-TR-5 Many Hands on the Keys †: A household is not one user: partners, children, guests, lodgers, landlords and installers share it, with interests that differ and change.
  • OPH-TR-6 Houses Change Hands: Devices stay with the bricks and accounts stay with people, so every sale, letting or separation leaves access in the wrong hands.
  • OPH-TR-7 Many Homes, One Grid †: Connected energy devices act together on the grid, so a compromise or a bad signal moves the load of thousands of homes at once.
  • OPH-TR-8 Ecosystems Inherit the Weakest Link: Bridges, multi-admin controllers and cloud-to-cloud links pass trust between ecosystems, and the strongest system takes on the weakest one’s flaws.
  • OPH-TR-9 Radio Ignores Walls: Radio, light and sound reach beyond the property line, so the attacker can be on the street, next door or across the road, with no need to enter.
  • OPH-TR-10 The House Keeps a Diary: Sensors, meters, cameras and logs record when people wake, leave, return and who they are with, and together they say more than any one of them.

Anatomy of an entry

Every entry follows the same shape, so you can read one and know where to find things in all the others.

Anatomy of an entry, using OPH-DM-J Thermostat Held to Ransom: the ID and title, the threat, the mitigation principle, three design measures, the STRIDE, CAPEC and CWE mappings, and the public case
  • ID and title, with a † if the threat has a physical-safety consequence.
  • The threat, written the way a builder would meet it, not the way an attacker would describe it.
  • A mitigation principle: one sentence that a sound design follows.
  • Three design measures: concrete things to build or change. On the cards, these become the three mitigation prompts.
  • Mappings to STRIDE, CAPEC 3.9 and CWE 5.0, checked against MITRE.
  • Seen: a public case, where one exists, with a reference.

The ID format

Every entry has an ID made of the game, the suit and the value: OPH-SUIT-VALUE. So OPH-CM-Q is the Queen of Cameras and Doorbells, and OPH-TR-7 is the seventh structural hazard.

The hyphens are deliberate. A dotted ID like OPH.CM.Q gets split into separate words by most search engines and indexers. A hyphenated one is treated as a single token, so if a vendor advisory, a test report or a conference talk cites OPH-CM-Q, you can search for exactly that and find it. I want to be able to see where the taxonomy gets used, and the ID is how.

The ID is printed in full on every card, so what the Scribe writes in the findings log during a game is exactly what you look up afterwards. The ranks are fixed from v1.0: if the wording of an entry improves, its ID stays the same.

Public cases

I don’t want the taxonomy to be a list of things that might happen. Where a threat has happened in public, the entry cites the case. 38 of the 169 threats have one, and each was checked against its source. Three suits, Hub and Bridges, Alarms and Locks, and Remote Control, have no public case yet. That says more about what gets reported than about how safe those parts of the house are.

Radio and Mesh

Domotics

Cameras and Doorbells

Appliances

Energy

Home Network

Vendor Cloud

Voice and Automations

Household

Lifecycle

Where the taxonomy stops

The smart home overlaps with my other taxonomies, and I’ve tried to keep the boundaries clean, so that each threat has one home.

  • Care monitoring. Sensors and cameras used to look after an older person, a baby or someone with a health condition at home belong to the Care Assistant Threat Taxonomy. The same camera can appear in both; the smart home taxonomy covers it as part of the house, the care taxonomy covers it as part of someone’s care.
  • The vendor’s build pipeline. Whether a device refuses an unsigned update is here (OPH-LC-A Unsigned Update Accepted). How the vendor builds, signs and ships that update belongs to the Software Factory Threat Taxonomy.
  • Email. Notifications and account recovery by email touch the house, but the mail infrastructure itself belongs to the Email Infrastructure Threat Taxonomy.
  • AI agents. The Voice and Automations suit covers what happens to the house when an assistant, a routine or an agent acts on it. The threats inside an agent, such as prompt injection and runaway autonomy, belong to Elevation of Autonomy.

Getting the taxonomy

The taxonomy lives at ostering.com/taxonomies/smart-home, with a page per suit and one for the structural hazards. The overview page also has the downloads: a PDF, an Excel workbook, a SKOS vocabulary in JSON-LD and a STIX 2.1 bundle, so you can load it into your own tooling. It’s published under the same licence as my other taxonomies, Creative Commons BY-NC-ND 4.0 with some extra permissions, which the overview page sets out.

Note to product teams

  • Start from the house, not the device. Pick the suits that cover your product, then add Household and Lifecycle, whatever you build.
  • Treat the † as a gate. A physical-safety threat shouldn’t be accepted without the person who owns product safety.
  • Cite the ID. In tickets, advisories and test reports, use the full ID, such as OPH-AL-Q. It’s one token, and it’s how the next team finds what you found.

Final thoughts

The smart home is the largest space I’ve built a game and a taxonomy for, and the one with the least prior art for the house as a whole. I’m sure there are threats I’ve missed and suits that will need more than 13 entries. Version 1.0 is a start, and the IDs will hold while the rest improves.

If you’d rather play it than read it, the Open House launch post shows you how. If you want to see how it lines up with STRIDE, CAPEC and CWE, and the 27 threats that line up with neither, read Mapping the Smart Home Threat Taxonomy.

Stay tuned!

Tags: Threat Modeling, Smart Home

You may also like: