IoT device security for small offices

Every small office has a shadow IT fleet that appears on no asset list: the multifunction printer that scans to email, the front-desk camera with its own app, the smart TV in the meeting room, the delivery-door buzzer with a web login, the label printer someone port-forwarded "for the vendor." Nobody patched them, nobody inventoried them, and their admin logins are usually the ones printed on a sticker on the box.

This is not a hypothetical. Printers hold PDFs in spool files and SMTP credentials in settings. Cameras are watched from the internet. TVs ship with admin panels reachable from the office LAN. A breach that starts on a $300 device ends up in the same first 24 hours as one that starts on your laptop — except nobody logged into that device, ever, so nobody will notice for weeks. This checklist makes the forgotten fleet survivable in one 90-minute session plus a quarterly 30-minute recheck.

1. Name an owner (5 minutes, changes everything)

The reason the printer has a 2019 firmware and the camera password is "admin123" is not budget — it's that the devices belong to nobody. Whoever fixes the coffee machine is not the same person who manages the laptop fleet, so the fleet simply rots:

• Assign one named owner for "non-computer devices." Office manager, ops lead, whoever. The title matters less than the fact that patching, password changes, and firmware bulletins now land in someone's queue instead of the air.
• Add the fleet to the asset list. If you already run an annual security review or a SaaS sprawl audit, add a section: hardware that has an IP address but no patch policy. That line is where the risk lives.
• Track the two facts that matter per device: when was it last updated, and can it reach the internet. Everything else is secondary.
• Treat new purchases as intake events. Any new device enters through the checklist below before it enters the office network. A five-minute ritual at purchase prevents five-hour incidents later.

2. Walk the office: build the inventory (60 minutes, once)

You cannot secure what you cannot list. One walking pass with your phone notes app:

• What to count: printers/scanners, cameras and DVR/NVR boxes, smart TVs and casting sticks, conference-room booking tablets, door access panels, buzzer/intercom systems, smart speakers, Roombas, network switches, the ISP's own router/modem box, any Raspberry Pi or mini-PC someone left running.
• For each device, record four fields: what it is, where it lives, its IP (check the router's device list — faster than touching each box), and who set it up. "Who set it up" is the call you make when it turns out the camera streams to a cloud account belonging to an ex-employee.
• Check the router's device list against your walk. Devices you find on the network but not in the office are either remote, borrowed, forgotten — or someone else's. That reconciliation is the actual audit.
• Mark the cloud-connected ones. Anything with a vendor app or an account (cameras, TVs, thermostats, doorbells) is also a vendor relationship. Those vendors belong on your vendor security review list — an IoT device that phones home is a subprocessor with a speaker.

3. Default credentials: the highest-yield 30 minutes in this whole checklist

Most small-office intrusions into this device class use the password printed on the bottom of the box. One session fixes the whole class:

• Log in to each device's admin panel once. Browser to its IP. If admin/admin, admin/password, or the sticker code works — change it now. Use a long passphrase from your password manager, and store it in a shared "devices" collection.
• Change default admin usernames too where the device allows it. "admin" is the login every automated scanner tries first; a non-default username is free brute-force resistance.
• Turn off or lock down remote/wireless admin panels. "Allow management from WAN" and "Allow configuration over Wi-Fi" are checkboxes whose only purpose is to make someone else's day easier.
• Set strong passwords on the Wi-Fi the devices use, and rotate the guest password on a schedule. The printer that shares a password with the office Wi-Fi means compromising one is compromising both — see section 5.
• Where a device cannot take a real password (cheap intercoms, old DVRs), it gets network segregation instead — that's the next section, and it's how you make an unpatchable device mostly harmless.

4. Firmware: a quarterly 30-minute ritual, not a crisis

Device firmware never auto-updates the way laptops do, so the fleet's software is effectively frozen at purchase date. Make the update a calendar event, like tax deadlines:

• Quarterly: check each device for a firmware update. Most vendor sites have a support page per model; some devices self-update if you enable it. Enable auto-update wherever it exists, even if you distrust it — vendor updates beat frozen 2023 code.
• Keep a one-line bulletin list. Vendor security bulletins for the models you own, checked quarterly. The patch management habit you built for computers extends here with a different cadence, not a different discipline.
• Replace what's unpatchable. A network device whose vendor is out of business, or whose last firmware is five years old, is not an asset — it's a liability with a power adapter. Budget to replace it; until then, segregate it hard (section 5).
• Update before deployment, not after. Every new device gets firmware-current + password-changed before joining the office network. "Update it later" is how later becomes never.

5. Segregate the device network (the fix that beats patching)

You cannot count on updating everything forever. You can control what a compromised device can reach:

• Put IoT devices on a separate SSID/VLAN. Nearly every business-grade router (and many consumer ones) offers a guest network or VLAN support. Laptops and phones on the main network; printers, cameras, TVs, doorbells on the device network. A compromised TV can no longer browse the file server.
• Block device-to-device talk by default. On the device VLAN, enable client isolation (devices can reach the internet, not each other) and allow only the specific ports they need out. The printer needs SMTP; the TV needs streaming; neither needs SMB or RDP.
• Give the device network its own password. When a visitor gets the guest Wi-Fi, they get the guest network — not the VLAN with your label printer and door controller on it.
• One cable rule: unknown device, untrusted port. A device someone plugged into an office wall port lands on the isolated VLAN or gets unplugged until it's inventoried. This is the physical-world version of not opening attachments.
• If the router can't do VLANs, a $60 second router in front of the devices is an acceptable improvised DMZ — imperfect, but strictly better than one flat network for humans and cameras alike.

6. The internet-exposure audit: what's actually reachable from outside (30 minutes)

This is where device fleets leak. Someone port-forwarded the camera "to check the office while traveling" in 2022 and nobody removed the rule:

• List every port-forward and UPnP rule on the router. One login to the router admin panel, one screenshot, one decision per rule: needed or deleted. Delete the rest. UPnP enabled on a router means any infected device on the LAN can open the router for you — turn it off unless something breaks loudly.
• Ask "would I be comfortable with this login page on the open internet?" A camera DVR login, a printer admin page, a Pi-hole dashboard — each is a login form the whole internet can brute-force. Remote access belongs behind a VPN or at minimum a non-forwarded path.
• Test from the outside. From your phone on cellular, try to reach the office IP and the forwarded ports. What answers from outside is your real attack surface — whatever answers and isn't deliberate is a misconfiguration.
• Disable cloud "remote access" features you don't actively use. Many devices ship with cloud relay access enabled by default. If nobody uses the app, turn the relay off — it's one less third-party server holding credentials to your office.
• The certificate and domain disciplines apply here too: any device you expose on purpose should sit behind a real certificate and a hostname you control, not a raw IP with a self-signed warning everyone clicks through.

7. Printers: computers pretending to be furniture

The office printer deserves its own section because it's the device most likely to hold data, not just firmware:

• Spool files are documents. Printers with local storage keep copies of what was printed — contracts, invoices, HR letters. On decommission, factory-reset and, where the vendor offers it, wipe storage. The vendor offboarding data-deletion rules apply to the printer on its way to the dump.
• Scan-to-email and scan-to-folder hold live credentials. The printer's SMTP password is a real mailbox password, and scan-to-folder is a file-server login. Check it: it's often a former employee's account, or worse, a domain admin's. Rotate these like any other secret; the secrets rotation checklist covers the habit.
• Turn off features nobody uses: web-push printing, cloud print connectors, remote admin from the internet, and anonymous USB printing where it isn't needed.
• Print-release for sensitive documents. Even without fancy hardware, "walk to the printer and press OK" kills the pile of uncollected contracts by the tray — which is also a physical security problem wearing a different hat.

8. Cameras and NVRs: the embarrassing breach

Cameras are the device class most likely to be both internet-connected and catastrophically neglected. A camera breach isn't just trespass — it's surveillance of your team, and it becomes a trust event faster than any server breach:

• Segment first. Cameras and their recorder go on the device VLAN, no exceptions. A camera that can only reach the internet and its NVR cannot reposition itself to watch your file server.
• Kill default cloud accounts and rebind to a company email. If the camera app is tied to the installer's or a founder's personal email, you've inherited a data relationship with a person who left. Rebind to a role mailbox, enable 2FA, store recovery codes with the device passwords.
• Check where recordings live and who can export them. Cloud-recording subscriptions are a subprocessor; local NVR storage is a disk with a retention rule. Either way, the retention policy should say how long footage is kept — forever is a liability, not a feature.
• Disable audio and internet streaming you don't use. Fewer sensors and channels, fewer leaks. An office camera that needs no sound needs no microphone.
• Physical cameras, digital locks: the NVR's admin port-forwarded to the internet is the most common small-office camera failure in existence. Section 6 exists because of this paragraph.

9. Close the loop: ownership, calendar, and the next review

The checklist only holds if the fleet re-enters the routine machinery you already have:

• Calendar entries: quarterly firmware pass (30 min), quarterly exposure re-audit (15 min), and "update+password before any new device joins" as a standing rule on the onboarding/procurement checklist.
• Log the session. Devices checked, passwords rotated, rules deleted, exceptions accepted. The log is what turns this from a good weekend into a control — and it feeds the annual review one section for free.
• Accept documented exceptions, not silent gaps. "DVR is unpatchable, segregated on VLAN 3, exposure checked quarterly" is a professional answer. An unexamined DVR on the flat LAN is a future postmortem's opening paragraph.
• Remember what these devices are: sensors with credentials. If one is compromised, treat it like a compromised laptop — isolate, change what it could reach, rotate every credential it held, and run the first-24-hours drill without waiting for proof that data left.