Smart devices and IoT on the office network: keeping them safe

What counts as IoT in an office

IoT, the internet of things, covers any device that connects to the network but is not a computer, phone or tablet. In a typical office that includes meeting room screens and smart TVs, wireless presentation systems, IP cameras and their recorder, door access controllers, alarm panels, smart thermostats and air conditioning controls, smart lighting, network-connected printers, vending or coffee machines and sometimes devices staff bring in themselves, such as smart speakers.

Many of these arrive through other trades. The air conditioning contractor installs a controller, the security company adds cameras, a fit-out company installs smart lighting, and each one is plugged into the nearest network outlet without anyone in IT knowing it exists. Some of those devices are also managed remotely by the installer, which means an outside company has a path into your network that nobody on your side has reviewed. Finding out who has that access is part of the job.

Why they are a risk

Most IoT devices are designed to be cheap and easy, not secure. Firmware updates may be rare, manual or stop altogether after a year or two. Default usernames and passwords are often published online. Some open ports or services that let them be reached from the internet, and some quietly send data back to cloud services you know nothing about.

Attackers scan the internet constantly for vulnerable devices, and a compromised camera or controller can be used to attack other systems on the same network or joined to a botnet that attacks others. In a flat network where everything can see everything, that camera sits one step away from your file server and staff laptops.

Start with an inventory

List every non-computer device on the network: what it is, who installed it, who supports it, how it gets updates and what it needs to connect to. A scan of the network often reveals devices nobody remembered, such as an old printer, a forgotten media player behind a TV or a test camera from a past project.

For each device, find out whether it needs internet access at all. A door controller may only need to talk to its management server on site. A meeting room screen may need the internet for updates and casting but nothing else. Knowing that lets you set tight rules rather than leaving everything open.

Isolate them on their own network

Put IoT devices on a separate VLAN, or several if you have many different types, with firewall rules that allow only the connections each device genuinely needs. Cameras talk to their recorder. The recorder is reachable by the people who view footage. The building management controller reaches its vendor's cloud and nothing else on your network.

Make sure none of these devices can be reached directly from the internet through port forwarding, which is a common shortcut installers use for remote viewing. Use the vendor's secure cloud service or your own VPN or zero trust access instead, and check the firewall for old forwarding rules left behind by past contractors.

Passwords and updates

Change every default password at installation and store the new ones in your business password manager. Where devices have admin accounts that contractors use, make sure your business holds the master credentials, not just the installer. If a contractor relationship ends, you should still be able to manage the device.

Check for firmware updates at least a few times a year, or enable automatic updates where the device supports it safely. When a device reaches end of support and no longer gets updates, plan to replace it, and in the meantime keep it isolated even more tightly. New Zealand's NCSC publishes general guidance on securing connected devices that is worth reading.

Set a rule for new devices

Agree a simple policy: nothing gets plugged into the network or joined to the Wi-Fi without being added to the inventory and placed on the right network segment. Brief contractors and fit-out companies about it before they start, and include it in any building or office move project. Write it into contractor induction notes so it is not forgotten when a new trade arrives.

Staff-owned smart devices, such as speakers or personal streaming sticks, are best kept off the business network entirely or limited to the guest network. A short conversation about why is usually all it takes, and it removes a surprising amount of risk from a small office. Smart speakers in meeting rooms also raise confidentiality questions, which is another reason to keep them out.