The most dangerous computer in your office is the one nobody logs into.
It's the printer that scans to email. The front-desk camera with its own phone app. The smart TV in the meeting room. The door buzzer with a web login. Every office has this shadow fleet: devices with an IP address, an admin panel, and credentials nobody ever changed — because the sticker on the bottom of the box already "worked."
The scary part isn't that they're insecure. It's that nobody has a login history for them. Your laptop has an access log; the printer's last firmware update was the factory. When something goes wrong on those devices, you'll find out weeks later, from the outside, as the opening paragraph of someone else's breach disclosure.
We just shipped the playbook that makes the fleet survivable: IoT Device Security Checklist for Small Offices. Ninety minutes plus a quarterly 30-minute recheck. Here's the shape of it.
1. The inventory walk is the actual audit.
One pass through the office: printers/scanners, cameras and NVRs, smart TVs, booking tablets, door panels, buzzers, speakers, the ISP's box, any Raspberry Pi someone left running. For each: what, where, its IP (the router's device list is faster than touching every box), and who set it up — because "who set it up" is the call you make when the camera turns out to stream to a cloud account belonging to an ex-employee. Then reconcile against the router's device list. Devices on the network that aren't in the office — remote, borrowed, forgotten, or someone else's — are the real finding.
2. Default credentials: the highest-yield 30 minutes in small-business security.
Log in to each device's admin panel once. If admin/admin or the sticker password works, change it — a long passphrase from the password manager, stored in a shared "devices" collection. Change the default username too where possible ("admin" is what every scanner tries first), and disable management-from-WAN and management-over-Wi-Fi checkboxes. Where a device can't take a real password, don't despair — segregate it instead.
3. Segregation beats patching.
You will never patch everything forever, but you control what a compromised device can reach. Put the fleet on a separate SSID/VLAN: laptops on the main network, printers/cameras/TVs on the device network with client isolation and only the outbound ports they need. A compromised TV can no longer browse the file server. No VLAN support? A $60 second router in front of the devices is an improvised DMZ — imperfect, strictly better than one flat network for humans and cameras alike.
4. The internet-exposure audit.
The rule someone port-forwarded "to check the cameras while traveling" in 2022 is still open. One router login, one list of every port-forward and UPnP rule, one decision per rule: needed or deleted. Then test from the outside — phone on cellular, try to reach your office IP. Whatever answers from the internet and isn't deliberate is a misconfiguration. And when you do expose something on purpose, it goes behind a real certificate and a hostname you control, not a raw IP with a certificate warning everyone clicks through.
5. Printers are computers pretending to be furniture.
Spool files hold copies of contracts and HR letters (factory-reset on decommission — the vendor offboarding data-deletion rules apply to the printer too). Scan-to-email holds a live mailbox password; scan-to-folder holds a file-server login. Check whose credentials those are — it's often a former employee, and occasionally someone's domain admin.
6. Cameras are a trust event, not just a breach.
Segment first, rebind cloud accounts to a role mailbox with 2FA, check where recordings live and how long they're kept ("forever" is a liability wearing a feature's name), and never port-forward an NVR. A camera breach means someone was watching your team — handle it like the incident it is.
Then close the loop: quarterly firmware pass and exposure re-audit on the calendar, one named owner for the fleet, exceptions documented ("DVR is unpatchable, VLAN 3, exposure checked quarterly" is a professional answer — an unexamined DVR on the flat LAN is a future postmortem).
Full checklist: IoT Device Security Checklist for Small Offices — part of the free ops-notes library from HIVE80lab (kits here, 30% off any paid kit with code HIVE-LAUNCH30).
Top comments (0)