By Cyber Defense Technologies October 29, 2026 4 min read
Ask most organizations how many laptops they have and they can answer. Ask how many printers, IP cameras, conference room systems, smart TVs, badge readers and environmental sensors are on the network, and the answer is often a guess.
These devices run full operating systems, store data, connect to the corporate network and seldom run endpoint protection. Attackers have used them as entry points, as quiet places to persist and, in the case of cameras and microphones, as surveillance tools.
Why these devices are attractive to attackers
- Weak defaults, such as factory passwords and administrative web interfaces enabled out of the box.
- Infrequent updates, because firmware updates are manual or nobody owns the device.
- Little monitoring, since most devices cannot run EDR and their logs are rarely collected.
- Useful data and access: multifunction printers store scanned documents and often hold credentials for email and file shares, and cameras see what happens in sensitive spaces.
- Flat networks that let a compromised device reach servers and workstations directly.
Find them first
Use network discovery, DHCP records, switch port data and wireless controller logs to identify every connected device, and add them to the asset inventory with an owner, location, model, firmware version and support status. Facilities and physical security teams often buy cameras, access control and building systems separately from IT, so include them in the conversation. Check wireless and guest networks too, and note any device that connects out to a vendor cloud service.
Change default credentials
Default usernames and passwords for common devices are published in manuals and widely shared online. Set unique, strong administrative passwords for every device, store them in an approved password manager, and remove or disable default and guest accounts. Where devices support central authentication, use it and restrict who can administer them.
Keep firmware current
- Track vendor security advisories for each model in use.
- Apply firmware updates on a schedule and promptly for serious flaws, using central management tools where vendors provide them.
- Record each device's end-of-support date, and plan replacement before updates stop.
- Verify the firmware version after updating, since some devices fail silently.
Turn off what you do not use
Many devices ship with services enabled that most organizations never need, such as older file sharing and printing protocols, Telnet, FTP, UPnP and remote cloud management features. Disable unused services, require encrypted management interfaces, and turn off features such as storing scanned documents on the device or sending scans to unsecured destinations. Configure printers to wipe or encrypt stored data, and make sure storage is sanitized before devices are returned, resold or disposed of.
Segment and restrict
Place office IoT on dedicated network segments, separated from user workstations and servers. Allow only the traffic each device needs: print servers to printers, the video management system to cameras, and nothing outbound to the internet unless the vendor service is genuinely required. Restrict management interfaces to administrative networks. If a device is compromised, segmentation limits how far the attacker can go, and unusual traffic from a segment that should be quiet is easier to spot.
Network access control can help by placing known devices in the right segment automatically and keeping unknown devices off the network. Where devices can send logs, forward them to central monitoring so failed logins and configuration changes are visible.
Buy better devices
The easiest time to secure a device is before it is bought. Include security in procurement requirements:
- A published vendor support period with security updates.
- No hard-coded credentials, and the ability to change every default password.
- Support for encrypted management, central authentication and logging.
- A way to report vulnerabilities to the vendor and a record of fixing them.
Federal agencies and contractors should also check supply chain restrictions. Section 889 of the Fiscal Year 2019 National Defense Authorization Act restricts federal agencies and their contractors from using certain covered telecommunications and video surveillance equipment and services. Contracts staff and facilities teams should confirm that cameras and recorders, including those installed by subcontractors, comply.
How CDT can help
CDT helps organizations bring overlooked devices under control. Our penetration testing team shows whether office devices offer a path into your network, and our embedded security engineers assess device firmware and hardware.
