CyberCQR Top 10 · Network security
Connected devices in the office: ten actions for boards
Ten actions a UK board can require so that CCTV, door access, heating and cooling, alarms, lighting and other connected devices cannot become a way into the firm's data or a means of shutting down its offices. Three find the kit. Four control the network and who can reach it. Three keep it that way, and get the firm back on its feet if something goes wrong.
Summary
The point for boards. Facilities or a contractor bought most of the connected devices in a workplace for convenience, then left them alone. Many share a network with staff laptops and client data, keep the installer's password and can be reached by the supplier from anywhere. Most of the actions below are decisions, settings and contract terms, not purchases. An office manager, the IT provider or an outside adviser can do the work, but the accountability stays with the firm's directors or partners.
What do the rules and guidance say?
- The NCSC. The National Cyber Security Centre warns that enterprise connected devices are often reachable from the internet and are likely to be used as a pivot point into corporate networks. It names default passwords, missing updates and misconfiguration as common weaknesses [2]. Its connectivity principles for operational technology (OT) set out how to limit and control remote access [5].
- Cyber Essentials. Devices that accept connections from the internet are in scope. Default passwords must be changed, and unsupported software removed or placed in an isolated segment with no online traffic. A sub-set kept apart by a firewall or virtual LAN (VLAN) can be excluded, with justification [6].
- Consumer law. Since 29 April 2024, connectable products sold to UK households must not have universal default passwords, and must state their security update period [4]. Business equipment is not covered. The government's response this spring on enterprise connected devices is still weighing codes of practice and regulation [7].
The ten actions
1. Name one director or partner who owns connected devices
Why it matters. These devices sit between facilities, IT, security contractors and the landlord, so they often belong to nobody. When one is misused, the cost lands on the firm.
What to do.
- Name one senior person who owns the risk and reports on actions 2 to 10 at least twice a year.
- Put it on the risk register in plain words: "a building, security or office device used to reach our data or disrupt our offices".
- Make clear that suppliers do the work, but the accountability stays with the owner and the board.
2. Find every connected device, in the building and on the network
Why it matters. You cannot protect what you have not found. Asking suppliers is not enough: devices get added during repairs, refits and moves.
What to do.
- Walk the building with facilities and the IT provider: comms room, reception, plant area, ceilings, car park.
- Ask the IT provider for a list of everything on the network that is not a managed laptop, phone or server. Switches, firewalls and many security tools can produce this.
- Record each device in a register with its supplier, who maintains it, how it connects and when support ends. Our Good Practice Guide has a template.
3. Check what the internet can see
Why it matters. Attackers scan the internet for exposed cameras, recorders and controllers. That is how researchers found and listed tens of thousands of vulnerable CCTV units [8].
What to do.
- Ask for a check of the firm's internet addresses, including mobile data routers that contractors may have fitted.
- Repeat it every quarter and after any building work.
- Treat anything found that is not in the register as a board finding.
4. Put connected devices on their own network
Why it matters. If a camera recorder or boiler controller shares a network with staff laptops and file servers, compromising it can open a route to the firm's data. That is how a login stolen from Target's heating contractor led to its payment systems [3].
What to do.
- Create separate networks for building and security kit, for office equipment such as printers and screens, and for guests. Keep each apart from staff computers and servers with a firewall.
- Allow only the connections each device needs, for example a camera recorder to its viewing app, and block everything else by default.
- Ask your IT provider whether this also simplifies your Cyber Essentials scope [6].
5. Take every management screen off the internet
Why it matters. Anyone can try a management screen that is reachable from anywhere, at any hour. CISA, the United States Cybersecurity and Infrastructure Security Agency, advises keeping control systems off the internet and behind firewalls [9].
What to do.
- Require that no device's management screen is reachable directly from the internet.
- Where remote viewing is needed, such as CCTV on a phone, use the supplier's secured app with named accounts, not an open port on the firewall.
- Do not accept "we've limited it to certain addresses" as the end state. France's emergency response team called that a temporary first step after the freezer attacks [10].
6. Own the accounts: no default passwords, MFA on every portal
Why it matters. Experts linked the freezer attacks to "easily guessable" passwords [11], and lists of default CCTV credentials circulate openly [8]. Cloud portals move control to the supplier's platform: in 2021, one leaked admin login at Verkada exposed 150,000 customer cameras [12].
What to do.
- Change every default password on installation. Cyber Essentials requires it [6].
- Use named accounts, not shared ones, with multi-factor authentication (MFA) on every cloud service for cameras, door entry and building systems. Where the portal supports Microsoft sign-in, use it, so leavers are locked out when their main login is removed.
- Make sure the firm, not just the installer, holds an administrator account on each system.
7. Bring supplier remote access under the firm's control
Why it matters. Installers need remote access, and it is a common way in. Watch the watcher: if the engineer sets up the connection, holds the accounts and is the only party who would notice a strange login, the firm has no independent view.
What to do.
- Route supplier access through one gateway the firm controls, with a named account per engineer and MFA.
- Switch it on when work is booked and off when it ends. Remove installer accounts at handover.
- Review who has access every quarter.
8. Keep devices updated, and plan for the end of support
Why it matters. A critical camera flaw fixed in September 2021 was still open on about 80,000 internet-facing devices a year later, and was being exploited [8]. One refrigeration controller hit in 2026 had been phased out in 2016 [10].
What to do.
- Make updates part of the maintenance contract, with an agreed time to apply security fixes.
- Mark each device in the register as supported, ending within two years, or unsupported.
- Replace unsupported devices, or isolate them with no internet traffic at all, as Cyber Essentials allows [6].
9. Buy secure, and write it into the contract
Why it matters. The consumer default password ban does not cover business devices [4]. The protection has to come from what the firm asks for when it buys, and what it writes into the contract.
What to do.
- Before buying, ask: how long will security updates be provided, does the portal support MFA, can it run on a separate network, and does it need to be on the internet at all?
- Add contract terms on accounts, remote access, updates, end-of-life notice and telling the firm about a suspected compromise within hours.
- Ask the landlord which shared building systems serve your space, and how they are separated from your network.
10. Notice changes, and rehearse recovery
Why it matters. The freezer attackers used normal features, such as forced defrost and alarm delays [10]. Antivirus will not see that. Someone has to notice, and the firm needs to know what to do next.
What to do.
- Alert a named person at the firm when a new device appears on the network, an unusual remote login occurs, or key settings change.
- Agree who disconnects, who calls the supplier, who tells the insurer, and who reports to the NCSC [13] and the police [14].
- Run a 30-minute tabletop exercise once a year: "our CCTV recorder is talking to an unknown address overseas".
Questions for your next board meeting
- What is connected to our network that is not a managed laptop, phone or server?
- Are those devices kept apart from staff computers and client data?
- Can the internet see any of their management screens?
- Which suppliers can reach them, with whose accounts, and can we switch that off?
- Which are past their support date, and what is the plan?
- Would anyone at the firm notice if one of them changed tonight?
Glossary
| Term | Meaning |
|---|---|
| End of life | The date after which a maker stops fixing faults or security flaws in a product. |
| Firewall | A control that decides which network traffic is allowed between two networks. |
| Gateway | A single, controlled entry point through which remote users must pass to reach internal systems. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Network segmentation | Dividing a network into separate parts, so a problem in one part cannot easily spread to the others. |
| Operational technology (OT) | Equipment and software that control physical processes, such as cooling, doors, lifts and power. |
| Register | A maintained list of devices with their owner, supplier, connection and support details. |
| Virtual LAN (VLAN) | A way of dividing one physical network into separate logical networks. |
Table 1. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Do you know what is connected to your network?
- Securing connected devices in the office: a good practice guide
- Identity and Access Management: Top 10 Must-Do Actions
- Document library: every paper and tool
External
References
- [1]Newsweek, Cyberattacks target French blood banks after supermarkets hit, November 2026.
https://www.newsweek.com/cyberattacks-target-french-blood-banks-refrigeration-supermarkets-12661343 - [2]National Cyber Security Centre, Organisational use of enterprise connected devices, 10 May 2022.
https://www.ncsc.gov.uk/report/organisational-use-of-enterprise-connected-devices - [3]Computerworld, Target breach happened because of a basic network segmentation error, February 2014.
https://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-because-of-a-basic-network-segmentation-error.html - [4]GOV.UK, Regulations: consumer connectable product security, updated 17 March 2025.
https://www.gov.uk/guidance/regulations-consumer-connectable-product-security - [5]National Cyber Security Centre, Secure connectivity principles for operational technology (OT), viewed 4 November 2026.
https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity - [6]National Cyber Security Centre, Cyber Essentials: requirements for IT infrastructure, v3.3, April 2026.
https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf - [7]GOV.UK, Government response to the call for views on enterprise connected device security, 8 April 2026.
https://www.gov.uk/government/calls-for-evidence/call-for-views-on-enterprise-connected-device-security/outcome/government-response-to-the-call-for-views-on-enterprise-connected-device-security - [8]BleepingComputer, Over 80,000 exploitable Hikvision cameras exposed online, 22 August 2022.
https://www.bleepingcomputer.com/news/security/over-80-000-exploitable-hikvision-cameras-exposed-online/ - [9]Cybersecurity and Infrastructure Security Agency, ICS advisory ICSA-25-140-03: Danfoss AK-SM 8xxA series, 20 May 2025.
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03 - [10]Nozomi Networks, French supermarket fridge cyberattacks and the risks of internet-connected OT, viewed 4 November 2026 (summarises CERT-FR alert CERTFR-2026-ALE-012).
https://www.nozominetworks.com/blog/french-supermarket-fridge-cyberattacks-and-the-risks-of-internet-connected-ot - [11]Al Jazeera, with Reuters, Very cold war: who's attacking Europe's supermarket freezers?, 3 November 2026.
https://www.aljazeera.com/news/2026/11/3/very-cold-war-whos-attacking-europes-supermarket-freezers - [12]CBS News, Hack of video security company Verkada exposes footage from 150,000 connected cameras, 10 March 2021.
https://www.cbsnews.com/news/verkada-hack-tesla-nissan-equinox-cloudflare/ - [13]National Cyber Security Centre, Report a cyber incident, viewed 4 November 2026.
https://report.ncsc.gov.uk/ - [14]Report Fraud, Report Fraud service goes live, 4 December 2025.
https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards find what is connected to their network, separate it from their data and hold suppliers to account for their access, without vendor commissions or product resale.