Small business networks often grow one device at a time: a router from the broadband provider, a few switches, some Wi-Fi access points, a printer, a CCTV recorder. Each addition is reasonable on its own, but nobody steps back to check the whole picture. Attackers look for exactly the gaps this creates. Here are ten signs to look for.
Key points
- Default passwords, out-of-date firmware and remote access exposed to the internet are among the most common ways into small business networks.
- Separating guests and smart devices from your business systems limits the damage one compromised device can do.
- If nobody reviews firewall rules or watches the logs, an attack can go unnoticed for a long time.
- Most fixes are inexpensive; the hard part is checking regularly.
1. Your router or firewall still uses its default password
Default administrator passwords are often printed on the device or published online. If they have never been changed, anyone who can reach the admin page can change your settings.
Fix: set a strong, unique administrator password on every router, firewall, switch and access point, store it in a password manager, and turn on multi-factor authentication where the device supports it.
2. Firmware has not been updated, or the device is no longer supported
Network equipment has software (firmware) too, and vulnerabilities in it are regularly found and fixed. Devices that are past their end-of-support date get no fixes at all.
Fix: check for firmware updates at least monthly and apply critical and high-risk fixes promptly. Cyber Essentials requires these within 14 days of release. Replace equipment that is no longer supported.
3. Remote access is open to the internet
Remote Desktop (RDP) or other remote access tools exposed directly to the internet are constantly scanned for and attacked with stolen or guessed passwords. A VPN without multi-factor authentication carries a similar risk.
Fix: never publish Remote Desktop directly to the internet. Use a secure remote access solution with multi-factor authentication, restrict it to the people who need it, and keep it updated.
4. Guests, staff and smart devices share one network
If visitors' phones, CCTV systems, smart TVs and office laptops are all on the same network, one compromised device can reach everything else.
Fix: give guests a separate Wi-Fi network that can reach only the internet, and separate devices such as cameras and building systems from the computers and servers that hold business data.
5. Your Wi-Fi password has not changed in years
A Wi-Fi password shared with years of staff, visitors and contractors is not really a secret. Older security settings such as WEP or the original WPA are weak, and features such as WPS can make a network easier to break into.
Fix: use WPA2 or, where your devices support it, WPA3. Use a long passphrase, change it when people leave, turn off WPS, and for larger teams consider Wi-Fi that uses individual logins instead of one shared password.
6. You do not know every device on your network
You cannot protect devices you do not know about. Old laptops, forgotten servers and personal devices can all sit on a network unpatched and unmonitored.
Fix: keep an up-to-date inventory of every device, who is responsible for it and whether it is still supported. Remove anything that is no longer needed.
7. Nobody reviews your firewall rules
Over time, firewalls collect rules for systems that no longer exist, ports opened "temporarily" for a supplier, and broad rules that allow far more than intended.
Fix: block unauthenticated inbound connections by default, document the business reason for every inbound rule and remove rules that are no longer needed. Review the whole rule set regularly. Configuring and managing firewall rules is part of our managed firewall service.
8. Everyone has administrator rights
When staff use accounts with administrator rights for everyday work, a single malicious link or attachment can install software or change security settings across the device, and sometimes the network.
Fix: give people standard accounts for daily work and use separate administrator accounts only when needed, protected by multi-factor authentication. Avoid shared admin accounts so every change can be traced.
9. You would not know if someone was already inside
Many small businesses have no logging, or logs that nobody looks at. An attacker can then explore the network for weeks before doing damage.
Fix: keep logs from firewalls, servers, devices and Microsoft 365, and have them monitored so suspicious activity is flagged. Our guide to SIEM, SOAR and managed security monitoring explains how this works.
10. Your backups are on the same network, and have never been tested
Ransomware often targets backups first. If your only backup is a drive or server on the same network, it can be encrypted along with everything else. An untested backup may not restore when you need it.
Fix: keep at least one backup copy separated from your main network, protect access to it, and test restores regularly so you know how long recovery takes.
What to do next
If several of these signs sound familiar, you are not alone, and most can be fixed quickly. Start with the quick wins: default passwords, firmware updates and remote access. Many of the same fixes are required for Cyber Essentials, so working through this list also prepares you for certification.
A free security review will show you where your network stands and what to prioritise. If you would rather hand the work over, our cybersecurity, network segmentation and managed firewall services cover it.
Not sure how secure your network is?
Book a free security review and get a clear, prioritised view of the gaps.