Topic 4: Networks, Routers & Office Wi-Fi

Your business network is the front door to every connected computer, server and connected device the company uses. Securing Wi-Fi connections, router configurations, and remote access keeps automated scanning bots and intruders out.
Having a network suggests that you also have employees. That raises the idea of having policies and procedures, user training,...and things just got more complicated.

Items Ranked by Priority

The items below address critical router threats first, progressing to network segmentation and redundancy.

1. Factory Default Router Passwords

Why It’s a Threat: Leaving the factory password (like "admin") on your router lets automated internet bots log in, hijack your connection, and alter security settings.

Real-World Example: In April 2026, the NSA and the FBI released a joint warning that Russia has been attacking and compromising home and small business routers.

Solution: Change default router admin credentials immediately upon installation and record the new login details in a secure location.

2. Outdated Router Firmware

Why It’s a Threat: Routers require regular security updates; outdated firmware leaves known backdoors open to automated internet scans.

Real-World Example: An office router running four-year-old factory firmware is quietly hijacked by a script using an unpatched system flaw.

Solution: Enable automatic firmware updates inside your router settings or manually check for updates twice per year.

3. Sharing One Wi-Fi Network Between Staff & Visitors

Why It’s a Threat: Handing visitors your main Wi-Fi password places personal phones and laptops on the same network layer as work PCs and billing files.

Real-World Example: A client connects to main office Wi-Fi; an infected laptop app probes local connections and finds an open shared folder on a desk PC.

Solution: Enable an isolated "Guest Network" on your router so visitors access the internet without seeing business hardware.

4. Working Over Unencrypted Public Wi-Fi

Why It’s a Threat: Modern HTTPS/TLS encrypts web traffic even on open Wi-Fi. The real danger on public Wi-Fi is connecting to fake networks ("Evil Twin" hotspots) or unencrypted legacy apps.

Real-World Example: An employee visits a coffee shop that provides free Wi-Fi under the SSID (network name) CoffeeShop_Guest. An attacker, also in the coffee shop, deploys a rogue access point broadcasting with the same name, CoffeeShop_Guest, but at a significantly higher signal strength. The employee's device connects to the strongest signal - the attacker's network - instead of the coffee shop's router. Many things can happen now - none of them good.

Solution: Use your mobile phone's hotspot. Visit only HTTPS/TLS sites. Connect to office and clients through an encrypted Virtual Private Network (VPN).

5. Exposing Remote Desktop (RDP) Directly to the Internet

Why It’s a Threat: Opening a remote desktop port on your router lets strangers on the internet find your office computer and repeatedly try to guess its password. If they get in, they could view your files, install harmful software, or lock your files and demand money..

Real-World Example: An owner opens a port so they can work from home on weekends. Automated attackers find the computer and try stolen or commonly used passwords. If the password is weak or reused (another issue), they may get in and install ransomware.

Solution: Do not open a remote desktop port directly to the internet. Instead, use a trusted remote-access service or a secure connection that requires multi-factor authentication - for example, a password plus a code from your phone. Keep the computer updated and maintain backups that are not connected to it.

6. Unsecured Smart Devices (IoT)

Why It’s a Threat: Connected cameras, smart TVs, and thermostats rarely receive patches and can be breached to pivot into internal business networks.

Real-World Example: Hackers compromise an office smart camera using default passwords and use it to scan local file servers.

Solution: Connect smart gadgets and cameras strictly to your isolated Guest Wi-Fi network.

7. Leaving UPnP (Automatic Port Opening) Enabled

Why It’s a Threat: Universal Plug and Play (UPnP) allows local applications to open inbound router ports automatically, without administrator approval.

Real-World Example: Malware on an office computer uses UPnP to quietly open a router port and expose a vulnerable service. Attackers then use that opening to try to enter the computer or reach other devices on the network.

Solution: If you do not need UPnP, turn it off in your router’s advanced settings. If you need it for a game or smart device, keep the router and connected devices updated, review the router’s port-forwarding list, and consider placing less-trusted devices on a separate guest network.

8. Unfiltered Web Traffic (DNS Settings)

Why It’s a Threat: Standard internet DNS settings do not block malicious web pages, exposing staff to accidental phishing or malware sites.

Real-World Example: An employee mistypes a web domain and lands on a site looks similar to the intended site but automatically attempts malicious downloads.

Solution: Standard DNS settings act like an address book for the internet. Protective DNS filters block dangerous or fake web pages before your computer opens them.

9. Single "Flat" Business Network

Why It’s a Threat: Placing payment terminals, office PCs, and guest phones on one single, shared network (a 'flat' network) means if one phone gets infected, the virus can see every machine.

Real-World Example: A compromised laptop on the main network spreads malware directly to an attached point-of-sale terminal.

Solution: Isolate payment terminals and office PCs into separate, isolated network zones.

10. Open Physical Network Jacks in Public Areas

Why It’s a Threat: Active Ethernet wall jacks in waiting rooms allow anyone to plug in a laptop and join your internal network directly.

Real-World Example: A lobby visitor plugs an Ethernet cable into an active port and browses internal shared folders without needing Wi-Fi credentials.

Solution: Deactivate physical wall ports in public areas at the central network switch or configure them for guest access only.

11. Unmonitored Outbound Network Traffic

Why It’s a Threat: Compromised hardware or smart devices often transmit stolen records to external servers during off-hours without detection.

Real-World Example: Smart office hardware secretly uploads internal network data to external servers at 3:00 AM while the office is empty.

Solution: Keep router logging active and set alerts for unusual middle-of-the-night outbound data transfers.

12. Relying on a Single Internet Connection

Why It’s a Threat: Utility damage or line cuts bring credit card processing and cloud systems to a complete halt without backup connectivity.

Real-World Example: Construction cuts an underground fiber line, leaving a business unable to process card payments during peak business hours.

Solution: Keep a cellular hotspot or secondary backup connection configured for emergency internet failover.