Smart Office and IoT Security: Protecting Connected Devices

Walk around a typical office today and count the things that connect to the network. Laptops and phones, of course, but also the CCTV cameras, the recorder in the comms cupboard, the smart TV in the meeting room, the multifunction printer, the door entry panel, the heating controls, perhaps a wireless speaker in reception. Each of those is a small computer with its own software, its own network connection and, quite often, its own password that nobody has changed since it was installed.

These devices are often called the Internet of Things, or IoT. They are useful, but they are also easy to forget about. This guide explains why they matter for security and the practical steps that keep them in check.

Why connected devices are a target

Smart devices are attractive to attackers for a few simple reasons. They are often installed once and never looked at again. Many run older software that does not update automatically. Some ship with default usernames and passwords that are published in online manuals. And because they sit on the same network as everything else, a device that is compromised can become a foothold from which an attacker explores further.

The risks are practical rather than theoretical:

• Privacy: a camera or meeting room device that can be accessed remotely could expose images or conversations.
• Stepping stone: a poorly secured device on the main network can give an attacker a route to your computers and files.
• Botnets: compromised devices are often recruited into networks used to attack other organisations, consuming your bandwidth in the process.
• Data on printers: many multifunction printers store copies of scanned and printed documents and hold address books with email addresses.
• Physical security: door entry and access control systems control who gets into the building.

Start with an inventory

You cannot secure what you do not know about. The first step is a simple list of every connected device: what it is, where it is, who supplied it, who manages it, how it connects and when its software was last updated. A network scan will usually turn up a few surprises, such as an old wireless printer nobody uses or a device a previous tenant left behind.

Anything that is no longer needed should be disconnected and, where it holds data, wiped before disposal.

Change default passwords and lock down access

Default credentials are the single most common weakness in connected devices. For every device on your list:

• Change any default admin password to a long, unique one and store it in your business password manager.
• Turn off features you do not use, such as remote access through the manufacturer's cloud, Universal Plug and Play (UPnP) on the router, or old file sharing protocols on printers.
• Restrict the admin interface so it can only be reached from inside the network, never directly from the internet.
• Turn on multi factor authentication for any cloud management portal that offers it.

If a supplier needs remote access to maintain a system such as CCTV or door entry, agree how that access works, make sure it uses its own named account, and turn it off when it is not needed.

Separate smart devices from your business network

Network segmentation means dividing your network into separate zones so that devices in one zone cannot freely talk to devices in another. In most offices this is done with VLANs (virtual networks that share the same physical switches and cabling) and firewall rules that control what traffic can pass between them.

A sensible layout for a small business might look like this:

With this in place, a compromised smart TV can reach the internet but cannot see your file server or your laptops. That one change dramatically limits the damage a vulnerable device can do. We cover the wider network side in our guide to business WiFi.

Keep firmware up to date

Firmware is the software built into a device. Manufacturers release updates to fix security weaknesses, and those fixes only help if they are installed. Some devices update themselves; many do not.

• Check each device for automatic update settings and turn them on where they are reliable.
• For devices that need manual updates, schedule a regular check, for example quarterly, and record the version installed.
• Find out when the manufacturer will stop supporting the device. Once updates stop, plan to replace it.

What the UK PSTI regime means for buyers

The Product Security and Telecommunications Infrastructure regime, set out in the Product Security and Telecommunications Infrastructure Act 2022 and regulations made under it, came into force on 29 April 2024. According to the UK Government's guidance, it places security requirements on manufacturers, importers and distributors of consumer connectable products sold in the UK. In summary:

• No universal default passwords. Passwords must be unique to each device or set by the user, and must not be easy to guess.
• A way to report security problems. Manufacturers must publish how to report vulnerabilities and what to expect after reporting one.
• Transparency on updates. Manufacturers must state the minimum period for which a product will receive security updates.

This is good news for buyers, but there are two important limits. First, the rules apply to consumer connectable products, so some equipment sold specifically for business use may fall outside them. Second, they apply to products made available from April 2024 onwards, so older devices already on your network are not changed by the law. The practical lesson is to check the published security update period before you buy anything connected, and to keep applying the steps in this guide regardless.

Smart office security checklist

• Keep an up to date list of every connected device and who is responsible for it.
• Change all default passwords and store the new ones securely.
• Disable remote access and features you do not use.
• Place cameras, smart devices and guest access on separate network zones.
• Block device admin pages from the internet.
• Check for firmware updates on a schedule and install them.
• Ask about the security update period before buying new devices.
• Control and log supplier remote access.
• Wipe devices that hold data before disposal.

How Cyber Fits can help

We install and manage business networks, including segmented networks for cameras and smart devices, and we supply and support CCTV and access control systems for businesses across Sunderland and the North East. If you are not sure what is connected to your network or whether it is set up safely, a free IT review is a sensible place to start. Our wider cyber security services can then help you keep everything in good shape.