The printer had been on the network for four years.

It worked fine. It printed things. Nobody touched it except to replace the toner cartridge every few months. The admin panel was accessible from any device on the network — it still had the factory default credentials: admin/admin.

Nobody had thought about it as a security device. It was a printer.

Printers are computers. They have CPUs, memory, storage, firmware, and network interfaces. Modern multifunction printers scan documents to network folders or email, maintain print job history, and often run embedded web servers for their admin panels. An unsecured printer on a flat network is a pivot point — a device with network access that nobody watches, that runs old software, and that can be accessed with default credentials anyone can look up online.

The IoT problem in small business networks

IoT (Internet of Things) in a business context means any network-connected device that isn't a traditional computer: printers, copiers, smart TVs, security cameras, badge readers, thermostats, VoIP phones, smart locks, point-of-sale terminals, and even newer devices like smart coffee machines.

These devices share a set of common security characteristics that make them risky:

  • They're often deployed once and forgotten — firmware updates are rare because the device "just works"
  • Manufacturers frequently ship them with default credentials that are publicly documented
  • They run on the same network as workstations and servers without any segmentation
  • They're rarely monitored — unusual network behaviour goes undetected
  • Vendor support often ends long before the device is retired

What segmentation solves

Network segmentation puts IoT devices on their own VLAN — a separate logical network that can only communicate with other devices through explicit firewall rules.

In a segmented network:

  • The printer is on the IoT VLAN. Staff workstations are on the staff VLAN. The server is on the server VLAN.
  • Workstations can send print jobs to the printer (explicit rule). The printer cannot initiate connections to workstations or the server.
  • If the printer is compromised, the attacker is contained to the IoT VLAN. They can't reach payroll files, CRM data, or the domain controller from there.

This doesn't require expensive hardware — most business-grade switches and firewalls support VLANs. What it requires is someone to set it up and maintain the rules.

The IoT device checklist

For every network-connected device that isn't a workstation or server:

  1. Change default credentials. Log into the admin panel and set a unique, strong password. Store it in the company password manager.
  2. Check firmware version. Compare against the manufacturer's current release. Update if behind. Set a calendar reminder to check quarterly.
  3. Put it on an IoT VLAN. It should not be on the same network segment as your workstations unless there's a specific, documented reason it needs to be.
  4. Disable unused services. A printer with a Telnet interface it doesn't need should have Telnet disabled. A camera with a cloud reporting feature you don't use should have it turned off.
  5. Document it. Every network-connected device should be in your network inventory: device type, IP address, firmware version, location, responsible department.

Start with a scan

Most businesses have no accurate count of what's on their network. A network scan (tools like Nmap or built-in firewall discovery features) often reveals surprises: devices people forgot were network-connected, old devices that were "replaced" but never disconnected, personal devices employees connected without authorization.

If you don't know what's on the network, you can't secure it.