keep known good copies of firmware images for all of the devices, and check with the manufacturer often for security updates. sandbox everything before deployment, and make sure there's no unusual behavior to begin with. insure the firmware settings are as locked down as you can get them. there have been a bunch of IoT botnets, some of them use up cpu time and resources for mining bitcoin, and some of them try to exfil data from machines in the local network. wherever possible, try to use IoT devices that have open source firmware and software on them. if you have a proprietary "blob" in a piece of equipment, you have no way of knowing exactly what it is doing, and who it's "phoning home" to. with open source code, you can have the code audited for security. look up on youtube for DEFCON, BlackHat, and C3 IT security conferences to get a good overview of what to look for.