People who use internet-enabled security camera systems like Amazon Ring or Google Nest to keep their homes safe could be opening up their virtual worlds to hackers, or even employees of the companies.

The devices, typically placed on the outside of homes and aimed at entryways, record live footage of who is approaching the premises, with many residents using the technology to deter package thieves and otherwise monitor their homes. But users who don’t properly secure their devices could be inviting criminals to snoop around their digital networks and potentially gain access to reams of sensitive personal data. 

In a case highlighting such vulnerabilities, Amazon this week agreed to pay $5.8 million to the Federal Trade Commission to settle allegations it gave its Ring surveillance employees “unfettered” access to personal videos. The agency in its lawsuit also claimed that Amazon failed to protect customer security, leading to hackers threatening or sexually propositioning Ring owners.

Gavin Millard, a cybersecurity expert at Tenable, a firm that alerts clients to tech vulnerabilities, said there are ways to leverage video doorbells and cameras’ security features without exposing one’s private lives and information to bad actors. Here are five ways users of the technology can protect themselves.

Reset default username and password

Never keep the username and password that a home security system assigns you by default. Because they can be easily guessed by hackers, they should be changed immediately, Millard said. 

“Often when consumers buy the devices, they don’t change them from their default, insecure configurations,” Millard told CBS MoneyWatch. 

Changing this password is crucial because once hackers breach one device, they can explore others that are connected to the same home network. For example, bad actors can use search engine Shodan to scan the whole internet for any connected devices, from webcams to smart lightbulbs. 

“I can ask it to show me every single internet-connected camera and try ‘Admin’ and ‘Password’ as the username and password, and you could access the video streams of any that are vulnerable,” he explained. 

Two-factor authentication

In…