IoT People Counter Risks: How to Secure Devices and Firmware

An unpatched people counter can create a route into a wider business network. Reduce the cybersecurity risks of IoT people counters by isolating devices from sensitive systems, applying software and firmware updates promptly, and using strong authentication and encryption.

It is understandable to focus on the device itself, but security also depends on how it connects, what data it handles and whether known vulnerabilities are addressed. A secure setup treats the counter as part of a connected system, not as a standalone sensor.

This article covers the main risks and how network segmentation, access controls and timely updates can limit them. It also explains what to consider when managing counter software and firmware, so data can support operational decisions without creating avoidable exposure.

How can I keep IoT devices secure?

The cybersecurity risks of IoT people counters involve devices, communications and software, not just the sensor itself. Assessing these risks starts with mapping what data the counters handle and where it travels.

IoT Device Attack Surfaces

An IoT attack surface includes device hardware, network connections and the software that controls functionality. Each can expose a different weakness: default passwords can allow unauthorised access, unencrypted traffic may be intercepted, and outdated firmware can leave known vulnerabilities open. For each counter, document the data collected, connected services and users who can change settings.

Interconnected Devices as Network Entry Points

A compromised device can provide a route into other systems on the same network. For example, a smart-home camera connected alongside a work computer could expose that computer if the camera has weak security. The cybersecurity risks of IoT people counters also depend on their network connections, so separate them from sensitive systems and review which traffic is permitted.

Physical Vulnerabilities and Device Management

Physical access can expose device ports, cables or management controls, making placement and oversight important security considerations. Keep an inventory, restrict access to device interfaces, change passwords and disable unused services. Review logs for unusual activity, and reset devices to factory settings before disposal to remove stored business data.

Vendor Assessment and Data Handling

Assess vendors by mapping what information their devices collect, where it is stored, who can access it and how long it is retained. Ask how updates and vulnerability reports are handled across associated software and hardware. For 5G-connected systems, distinguish network connection data from movement records, then assess whether combining either with other information could reveal a person’s location or behaviour.

Network segmentation

Place people counters on a separate network, limiting their routes to business systems. Compare isolation, encryption, update support, access controls and monitoring. Total cost depends on device numbers, integration and support needs; pricing is provided after a quote request.

Network Isolation and Access Restrictions

Segmentation separates sensors from critical infrastructure, reducing the paths an attack on one device could take to reach other systems. Use firewall rules to allow only required connections and block unnecessary local or internet traffic. Restrict access to the counter network to authorised users and management systems. This reduces the risk that a compromised sensor can reach sensitive data or services through shared network access.

Remote Access and Private Networks

Disable remote access unless operations require it, as misconfigured settings can enable unauthorised control. If remote management is necessary, use strong authentication and secure protocols, then limit access to approved accounts. Encrypt data transfers with protocols such as HTTPS where supported. Firewalls and intrusion detection systems can help monitor traffic, flag unusual connections and restrict communication to expected destinations.

Legacy Assets and Shared Network Access

Legacy devices may lack current security features or regular software support, leaving weaknesses alongside newer equipment. Keep older counters separate from systems holding sensitive information, and review their permitted connections. A private or dedicated network can reduce exposure without requiring every connected device to share the same infrastructure. For a people-counting deployment, consider the network design alongside a people-counting system and its associated data flows.

Unpatched software and firmware

Default passwords let attackers try familiar credentials, while outdated firmware can leave known vulnerabilities open to attack. Insecure remote access may give an unauthorised user control of a counter or a route towards sensitive systems.

Build updates into device management. Keep an inventory of each counter’s software and firmware versions, monitor manufacturer notices for vulnerabilities, and apply available patches promptly. Record update status so devices that miss maintenance do not disappear from view. Where practical, test updates in a controlled environment, then confirm the counter still communicates with its associated systems.

Update support matters across the device ecosystem, not just on the sensor. A mobile app, management software and connected hardware may each need maintenance. Map which components receive updates and how vulnerabilities are reported. If one component remains unpatched, it can undermine otherwise careful security settings.

Set a response for situations when a patch is unavailable: restrict the device’s network access, disable unused remote functions and increase monitoring for unusual connections. These controls reduce exposure while teams assess the device’s role and update path. Record the risk, the restriction applied and who is responsible for review.

The same discipline applies to a smart-home device used for work. For example, an old camera with default credentials may remain online after its app is forgotten. Remove unused devices, change passwords and review access permissions. Treat updates as ongoing security maintenance, not a one-time setup task. Software updates can address vulnerabilities that emerge after installation.

Footfall Australia: FootfallCam Pro2 People Counters

Footfall Australia offers FootfallCam Pro2 People Counters for organisations planning or reviewing people-counting deployments. They can be considered alongside network segmentation, restricted access and a clear process for maintaining software and firmware.

For a wider setup, FootfallCam V9 Software, FootfallCam Pro1 IP Cameras and FootfallCam Centroid are also available. Assess each component within the full system: identify what it connects to, what data it handles and how it fits your organisation’s security controls. This helps align people-counting requirements with practical decisions about device access and network design, rather than treating a counter as an isolated purchase.

Contact Footfall Australia to discuss how FootfallCam Pro2 People Counters may fit your people-counting requirements.

Make Security Part of the Next Decision

Security works best as part of operational planning, rather than as a task completed only during installation. Assign clear ownership for device inventories, access reviews and update decisions, then revisit those responsibilities as sites and systems change. This helps keep people-counting data useful while teams respond deliberately to new vulnerabilities and changing business needs.

The cybersecurity risks of IoT people counters are easier to manage when security decisions are considered alongside the information an organisation wants to use. A clear view of data flows, system connections and maintenance responsibilities helps teams plan their next steps with confidence. For organisations looking to stay informed on emerging threats and safeguard their broader IT infrastructure, cybersecurity insights from ManagePoint can support ongoing defence strategies.

For help considering people-counting options in that context, contact Footfall Australia. A thoughtful security plan can support better decisions as your connected environment evolves.

Frequently Asked Questions

What are the risks?

Risks include unauthorised access, data exposure, disrupted counting and misuse of a compromised device. For example, an attacker who alters counter settings could affect the reliability of visitor reports, even without accessing customer records. Consider confidentiality as well as operational impact: inaccurate movement data can influence staffing, space planning and business decisions.

What should I remember?

Treat each counter as part of a wider system, with an owner responsible for its settings, data and maintenance. Record which team relies on its reports and what happens if those reports become unavailable or unreliable. This connects technical security to business continuity and helps teams prioritise devices according to their operational role.

Why does IoT security matter?

IoT security matters because connected devices can affect both information and the services that depend on it. A people counter may support decisions about staffing, opening areas or managing visitor flows. If its data is exposed, altered or interrupted, teams may lose confidence in those decisions. Security protects the usefulness and integrity of operational insight.

What cybersecurity vulnerabilities affect IoT people counters?

Common weaknesses include predictable login credentials, unsupported software, excessive permissions and insecure communication between components. Vulnerabilities can also arise when a management application or cloud-connected service is less protected than the physical counter. Review the full operating chain, including who can change settings and whether old accounts remain active after staff or suppliers change roles.

Can IoT people counters collect identifiable or personal data?

They can, depending on the sensor technology, configuration and information combined with the count. A system that captures images may process details that could identify people, while movement records linked to precise times and locations may become revealing when combined with other information. Check what is captured, retained and shared, and whether reporting can use less detailed data.