Most small office networks were never designed. They accumulated. The ISP router arrived first, then a switch someone bought on a Friday, a mesh Wi-Fi kit, a NAS holding four years of client work, and two printers still using the password on the sticker. None of that makes you reckless. It just means your security has to come from a short, repeatable checklist rather than an IT department. These ten checks are ordered by return on effort: the first few take minutes and close the easiest ways in.
Start at the edge
Every packet on the network passes through the router, so it is the device worth getting right before anything else.
Check 1: Replace every default credential
Factory logins are still the simplest way into a small network. Router, access points, switches, the NAS, printers, cameras, the smart TV in the meeting room — each shipped with an admin account that is documented online. Change each password to something long and unique, and keep them in a password manager rather than a spreadsheet on the front desk. While you are in there, confirm the Wi-Fi passphrase is not the company name plus a year.
Check 2: Close the doors you do not use
- Remote administration from the internet. Off, unless you genuinely need it — and then behind a VPN rather than a public login page.
- UPnP. It lets devices open inbound ports by themselves, which is how a camera or a console quietly becomes a doorway.
- WPS. Push-button pairing saves a minute and hands an attacker a shortcut.
- Port forwarding rules. Read the table line by line and delete anything you cannot explain.
Then check that the wireless encryption is WPA2 or WPA3, not the older WEP or TKIP. Write down the forwarding rules you kept and the reason for each one.
Patch, and keep patching
Check 3: Update everything with an IP address
Firmware lives on the router, the access points, the switch, the NAS, and the printers. Turn on automatic updates where the vendor offers them, and put a recurring reminder in the calendar for the ones that do not — printers and NAS boxes are usually the last to get attention and the first to sit unpatched for three years. On the desktop side, enable automatic updates for the operating system, browsers, and the office suite, and let them actually restart. The VPN client and your accounting software count too. If nobody owns this task, it will not happen; give it to one person by name.
Split the network
Check 4: Give visitors their own Wi-Fi
A guest network is not just politeness. It keeps a client's laptop, a contractor's phone, and a delivery driver's tablet away from the file server. Set up a second SSID with a different password, enable client isolation so guests cannot see each other, and make sure the guest network cannot reach the NAS, the printers, or the router's admin page. If your equipment supports VLANs, put the guest traffic on its own segment. Change the guest password after larger events; it circulates fast.
Check 5: Move the odd devices out too
Smart speakers, thermostats, doorbell cameras, and that one networked label printer get infrequent updates and rarely have strong logins. Treat them like guests, not staff. Same for personal phones and tablets that only need internet access, not access to shared folders.
Control access by person
Check 6: Individual accounts with multi-factor authentication
Shared logins feel efficient and make every problem harder to trace. Give each person their own account for email, cloud storage, and anything administrative. Turn on multi-factor authentication for email first, since it is the reset path for everything else, then for cloud drives, the password manager, and any remote access. A small team can usually manage credentials in a shared vault instead of a sticky note.
Check 7: Least privilege, and clean exits
Admin rights on the router, the server, and the finance software should belong only to the people who actually do that work. Set file permissions by group rather than handing out full control to everyone. Then write a short offboarding routine: disable accounts the same day someone leaves, revoke VPN access, remove them from the shared vault, and collect keys and badges. Onboarding matters just as much — new starters should get the access they need for their role, not a copy of someone else's.
Backups and the forgotten hardware
Check 8: Three copies, one of them offline
Keep the working data on the server or NAS, a second copy on a separate device, and a third copy somewhere that ransomware running on your network cannot reach — an external drive that is disconnected after each backup, or a cloud target with version history. Cloud sync alone is not a backup: deletions and encrypted files replicate just as faithfully as everything else. Export the router and firewall configuration once and store it with the rest. Most importantly, restore a real file every quarter so you find out now, not during an incident.
Check 9: Lock the closet and tame the printers
Anyone who can unplug a cable and plug in a laptop has network access, so keep the switch and patch panel in a locked cabinet. Label the ports and disable the ones that are not in use if your switch allows it. Printers deserve their own pass: change the admin password, switch off protocols nobody uses, and never forward a raw printing port from the internet. If a device has a web interface with a login, treat it like any other server.
Check 10: Thirty minutes a month
None of this stays true on its own. Put one recurring appointment in the calendar and work through a short list:
- Skim update notices for the router, access points, NAS, and printers, and install what is pending.
- Open the port forwarding table and delete anything new or unexplained.
- Review accounts on email, cloud storage, and the router; disable anything stale.
- Read the backup logs and restore one file to prove they work.
- Scan the DHCP client list for devices you do not recognize.
- Confirm anyone new has multi-factor authentication switched on.
If that feels heavy, do Checks 1 through 3 this week. They take an afternoon and remove the easiest paths in. Keep a short log of what you changed and when, so the next person who touches the network knows where things stand. If you handle client data, payment details, or records covered by a contract or insurer, check what those agreements actually require, and consider paying for a one-off review by a local security professional. A small network does not need to be fortress-grade. It needs to be boring, documented, and looked at once a month.
Photo: panumas nikhomkhai / Pexels
