Internet-of-Things (IoT) devices have increasingly been the target of malicious attacks. Even after numerous reported incidents the use of IoT devices in organisations has not slowed down. Being relatively cheap, small, and easy to deploy, IoT devices provide many useful capabilities including environment monitoring, surveillance, data streaming, and acting as direct communication between parties. So how do organisations protect themselves from being a target?