Picture the security budget at a casino: cameras on every table, guards at every door, a vault you'd need a heist movie to crack. Now picture the attackers getting in through the fish tank.
The story
In 2018, Nicole Eagan, then CEO of the security company Darktrace, told an audience in London about a casino that had put an internet-connected thermometer in its lobby aquarium, so someone could check the water temperature without walking over to look. Attackers found that thermometer, used it as a foothold into the casino's network, and went looking around. They found the high-roller database, the list of the casino's biggest spenders, and sent it back out through the thermometer and up to the cloud.
The casino was never named, and the details have never been independently confirmed. It's a story told by a security vendor on stage, so hold it loosely. But it's survived years of retelling because everyone in security has seen some version of it.
Everything with a chip is a computer
Nobody thinks of a fish thermometer as a computer. It doesn't have a screen. It doesn't get updates. It doesn't show up when IT counts laptops. But it has a network connection and software, which is all an attacker needs. A device nobody thinks about is a device nobody patches.
Give the fish their own network
The fix isn't to ban gadgets. It's to make sure the thermometer can't talk to the database. Put smart devices on their own network segment, let them reach only what they actually need, and watch for anything chatty that shouldn't be. That's a big part of why the cameras going onto my own home network are getting a network of their own.
The point
Somewhere right now, a smart coffee maker is sitting on the same network as a payroll system. Go check on yours.