The Forgotten Devices on Your Network
Ask most staff what is connected to the Housing Authority network and they will name the obvious things: desktop computers, the server, maybe the Wi-Fi router. The harder question is what is connected that nobody thinks about anymore.
Most offices have a few of these. There may be an old desktop in a back room that no one has used in years but is still plugged in and still running Windows 10. There may be a printer installed long ago, or a smart thermostat, camera, or other smart device added by a contractor or a well-meaning staff member. These devices keep working quietly, so no one gives them a second thought. That is exactly the problem.
Why unused doesn't mean harmless
A device that is no longer in use is usually no longer being watched or updated. Software updates fix known security flaws, and when a device misses them, those flaws stay open. Bad actors know this and look for exactly these kinds of devices. An unmonitored computer or camera may seem unimportant, but once someone gains control of it, they can use it as a doorway to look for more valuable targets, such as resident files, financial records, and personnel information.
Many smart devices add to the risk. They were built to do one job, and security was often an afterthought. Some never receive updates at all. Many ship with a default password that anyone can find online, and if no one changes it after installation, it stays that way for years.
For an organization that holds sensitive information about the residents and applicants it serves, one forgotten device can undermine an otherwise careful security effort.
Where to start
The good news is that the first steps are simple and don't require replacing everything.
- Look at what is on the network. You can't protect what you don't know exists. Make a list of every device that connects, and ask different departments to check it against their own records. Maintenance staff may know about devices that the main office does not.
- Ask whether each device is up to date, and whether it can be. A current computer can usually be updated with little trouble. Some older equipment can no longer receive updates, and that matters just as much to know.
- Update what you can. Install available updates on computers, printers, routers, and smart devices.
- Remove what you no longer need. If a device is out of date, unused, or can't be updated, unplug it and take it off the network. The safest device is one that isn't connected.
- Change every default password. Do this for all devices, not just computers. Use strong, unique passwords, and keep a record in a secure place.
Keep it going
This isn't a one-time cleanup. Networks change constantly: new equipment arrives, projects end, and temporary setups quietly become permanent. Set a regular schedule, perhaps twice a year, to review what is connected, and make it part of the process whenever a new device is added or an old one is retired.
A device nobody remembers connecting is easy to ignore, but it only takes one to cause a serious problem. A little time spent finding and securing these devices is a small price for protecting your residents' information and your organization's reputation.
