Your office network includes more than laptops and phones. Smart TVs, printers, thermostats, cameras, badge readers, and other connected devices may have access to the same network as employee computers and business systems.
That creates risk when no one knows a device is there, who manages it, or whether it is still receiving security updates. A device does not need to be complicated to become an entry point. It just needs to be connected and overlooked.
A practical network security plan starts with finding the devices, deciding what each one needs to reach, and limiting access accordingly. That is a core part of effective network management services and cybersecurity consulting for small and mid-size businesses.
WHAT SHADOW IOT LOOKS LIKE
“Shadow IoT” means connected devices operating without clear ownership or oversight. They often arrive as part of a normal business purchase or building upgrade, not as a deliberate IT project.
Common examples include:
- Smart TVs and conference-room systems
- Printers and multifunction copiers
- Thermostats and building controls
- Security cameras and recording systems
- Badge readers and door controllers
- Voice assistants and smart speakers
- Wi-Fi access points installed by a vendor
A device may be connected to Wi-Fi but missing from your IT records. Or it may appear in an inventory with no assigned owner, business purpose, or firmware version. If nobody is responsible for maintaining it, nobody can confidently say it is secure.
START WITH NETWORK DISCOVERY AND AN ASSET INVENTORY
You cannot protect devices you do not know about. Network discovery helps identify what is connected and how it communicates. Depending on your setup, this can include reviewing Wi-Fi controller and switch data, DHCP records, firewall logs, and carefully scoped network scans.
Discovery results should be checked with the people who use or manage the devices. A camera might belong to your building-security provider. A printer might be managed by a copier vendor. An unfamiliar device might be an approved controller, or something that needs to be investigated.
For each device, record useful details such as:
- Device type, manufacturer, model, and network address
- Physical location and business purpose
- Business owner and technical support contact
- Operating system or firmware version
- Whether the device is supported and receiving updates
- Which other systems and services it needs to reach
CISA’s Cybersecurity Performance Goals include keeping an inventory of organizational assets. For an SMB, the right inventory can start as a well-maintained spreadsheet or a feature in your network-management platform. The key is to keep it current and investigate unknown devices rather than letting them become permanent mysteries.
WHY AN UNMANAGED DEVICE IS AN UNMANAGED RISK
Every connected device has some combination of software, accounts, and network access. If it is not maintained, you may not know whether it still uses a default password, has an exposed management interface, or is running firmware with known vulnerabilities.
Risk depends on what the device can reach. A smart TV isolated from business systems has a smaller potential impact than one that can communicate freely with employee computers, file servers, or network equipment.
The goal is not to treat every connected device as a crisis. It is to understand its role, limit its access, and assign responsibility for keeping it secure.
SEPARATE GUEST WIFI, IOT, AND BUSINESS NETWORKS
A guest Wi-Fi password does not guarantee that guest devices are isolated. On a flat network, devices may share the same network even when they connect through different Wi-Fi names. That can allow a visitor’s phone, an office printer, and an employee laptop to communicate more broadly than intended.
A safer design separates devices into zones. A simple SMB setup might include:
- Employee network: Managed workstations and phones
- Guest network: Visitor devices, with internet access only
- IoT network: Printers, TVs, thermostats, and similar equipment
- Management network: Network equipment administration, restricted to authorized administrators
VLANs, virtual local area networks, help separate these groups. But a VLAN alone is not a security boundary. Firewall rules or access control lists must control traffic between them. A guest network should not have a route to internal systems. IoT devices should only reach the systems and services they need.
For example, a printer may need to communicate with approved employee devices and a print server, but not with security cameras or network administration tools. A thermostat may need to reach its vendor’s cloud service, but not company file storage. Keep the rules as narrow as business operations allow.
NIST’s network segmentation guidance explains how grouping systems into separate zones can reduce risk. In plain English: separate devices with different purposes, then allow only the traffic that is necessary.
USE NETWORK ACCESS CONTROL WHERE IT FITS
Network access control (NAC) helps decide which devices can connect and what access they receive. On employee networks, businesses may use 802.1X authentication to verify a user or device before granting access. Depending on your equipment, NAC can also place devices into different network zones based on their identity or security status.
Some IoT devices cannot support modern authentication. They still need a controlled onboarding process, a known owner, and restrictive network rules. Using a device’s MAC address to recognize it can help, but it should not be treated as strong proof of identity because MAC addresses can be copied.
NAC is not a requirement for every small business. The right approach depends on your network equipment, device mix, and internal capacity. We would rather recommend a manageable control that fits your environment than add complexity you cannot sustain.
CHANGE DEFAULT CREDENTIALS AND PATCH FIRMWARE
Many devices arrive with default administrative credentials or simple setup passwords. Change them before putting the device into service. Use unique credentials for each device where possible, store them securely, and restrict administration to authorized users. Do not expose device-management pages directly to the internet.
Firmware matters too. It is the software built into a device that controls how it operates. When vendors release security updates, someone needs to determine whether the update applies, schedule it safely, and confirm that it was installed.
If a device is no longer supported, plan to replace it or reduce its exposure. If you cannot patch it right away, isolate it more tightly and document who owns the risk and when it will be addressed.
CISA’s Cybersecurity Performance Goals and its Cybersecurity Planning Guide offer practical guidance on asset management and security basics. The details of patching and access control vary by device and vendor, so confirm compatibility before making changes that could interrupt a business-critical system.
WHAT AN SMB NETWORK ASSESSMENT ACTUALLY LOOKS LIKE
A network assessment should give you a clear picture of your environment and a useful path forward, not just a list of technical findings.
A typical assessment may include:
- Reviewing network diagrams, equipment, Wi-Fi settings, and firewall policies
- Building or validating a device inventory
- Identifying unknown devices and confirming their business owners
- Checking how guest, employee, IoT, and management networks are separated
- Reviewing a sample of device credentials, firmware, and support status
- Identifying unnecessary access between network zones
- Providing prioritized recommendations with owners and next steps
The exact scope depends on the number of sites, network devices, and systems involved. As a planning estimate, a straightforward single-site SMB review may take one to three business days for discovery and assessment, with findings typically organized into a report or briefing afterward. Larger, multi-site, or highly customized environments may take longer. These are planning ranges, not a fixed commitment.
Before work starts, agree on which devices and systems are in scope, whether any active testing is permitted, and how business-critical equipment will be protected during the review. We also recommend identifying a point of contact who can help confirm what unfamiliar devices do.
We do not publish a one-price-fits-all fee for assessments. The cost depends on scope, site count, and the level of testing required. Before any work begins, you should receive a written scope and a clear project fee or bounded time estimate.
For broader context, Five 9’s infrastructure consulting and services overview describe how we approach network and technology work.
QUESTIONS TO ASK ABOUT YOUR NETWORK
- Can we identify every device currently connected to our network?
- Is guest Wi-Fi isolated from employee systems and internal resources?
- Which IoT devices can communicate with servers, workstations, or one another?
- Who owns updates, credentials, and support for each device?
- Are any devices unsupported or still using default credentials?
- When did we last verify that our network rules work as intended?
If you do not know the answer to every question, that is a reason to investigate, not a reason to panic. Start by building an inventory and confirming how the devices are connected. Then prioritize fixes based on what each device can access and how important it is to your business.
START WITH AN HONEST CONVERSATION
We can help you understand what is connected, where the main gaps are, and which improvements make practical sense for your team. We will be clear about what we can handle and honest if a requirement falls outside our expertise.
An initial conversation is a chance to explain your setup and ask questions, not a sales pitch. If you want to discuss your network, contact Five 9 for a no-pressure conversation. We will help you identify sensible next steps, support your internal team, and adapt the plan as your needs change.