Network, Wi-Fi and Remote Work

The box on the shelf in the back room is easy to forget. It was installed by the internet company years ago, its admin password may still be printed on the sticker, and nobody has looked at its settings since. Verizon's 2026 Data Breach Investigations Report says that exploiting software vulnerabilities, such as flaws in internet-facing equipment, has overtaken stolen passwords as the most common way into a breach, at 31%. Routers, firewalls and VPN boxes are internet-facing equipment. They need an owner.

What the pieces do

Terms first, because the people selling this equipment use them loosely.

• A modem turns the signal from the internet company into a network connection.
• A router passes traffic between your devices and the internet. At home it is usually one box that also does Wi-Fi.
• A firewall allows or blocks traffic by rule. Every router has a basic one. A business firewall adds better logging, updates and controls.
• An access point is the radio that gives Wi-Fi. Bigger offices use several.
• A switch is a box that connects wired devices.
• An endpoint is any device on the network: laptops, phones, printers, cameras, card readers, the smart thermostat.

Picture the office as a building. The router is the front door. The firewall is the guard who checks who may come in or go out. Wi-Fi is a second door at the side, which is why it needs its own lock. Segmentation, which we will get to, is walls inside the building so a visitor in the lobby cannot wander into the accounting office.

The router and firewall: the settings that matter

The FTC's small business guidance on wireless networks has four plain steps: change the default network name and password, turn off remote management, log out of the administrator account when you finish, and confirm the router supports WPA2 or WPA3 with encryption turned on. Add these to the list.

1. Change the administrator password on the router to a long, unique one stored in the business password manager (lesson 02). Factory passwords are published online.
2. Turn off remote management, the feature that lets someone change the router from the internet. Turn off other features nobody uses, such as port forwarding rules that nobody can explain.
3. Check for firmware updates and install them. Firmware is the router's own software. Many routers do not update themselves. Put a quarterly date on the calendar, or turn on automatic updates if the model offers them.
4. Find out if the router is still supported. If the maker no longer publishes updates, it is an open invitation. Replace it.
5. Write down the model, serial number, admin login holder and where the manual is. When the internet goes down on a Monday, you will want it.

Many internet companies supply a combined modem and router. You can usually keep it for a very small office, as long as you change the password, turn off remote management and keep it updated. As the office grows past ten or twelve people, or if you take card payments, handle customer records or need guest and device networks, a separate business-class firewall is worth a quote. Prices vary widely by brand, support plan and features, so ask your outside IT provider for two quotes rather than trusting a rule of thumb here. Expect a one-time hardware cost plus a yearly subscription for updates on many models.

Wi-Fi

The Wi-Fi Alliance, the industry group that certifies Wi-Fi equipment, says WPA3 is mandatory for Wi-Fi CERTIFIED devices. It describes WPA3-Personal as giving stronger protection against password-guessing attempts and WPA3-Enterprise as offering higher-grade security for networks that carry sensitive data. It also describes Wi-Fi Enhanced Open, which encrypts traffic on networks with no password, which can suit a public lobby network.

Use a long passphrase. A sentence of four or five random words is easier to type and harder to guess than eight characters of symbols. For larger offices, WPA3-Enterprise or its WPA2 counterpart gives each person their own Wi-Fi login, so you can remove one person without changing the password for everyone. Ask your IT provider whether the access points you own support it.

Change the Wi-Fi password when a staff member who knew it leaves, when a contractor with access finishes a job, or if a device was lost. That is another reason to keep the staff network and the guest network apart: guests get their own password that you can change monthly without disturbing the office.

Hiding the network name

Some people hide the network name to look safer. Free tools can still find hidden networks, and the setting can confuse some devices. Skip it. Use the encryption setting and the long passphrase instead.

Separate networks: staff, guests and devices

Network segmentation means splitting the network into zones. The smallest useful version has three.

• Staff network. Company computers, the file server or storage box, and anything that holds customer or financial data.
• Guest network. Visitors, customers waiting in the lobby, and anyone's personal phone. Internet only. It cannot see the staff network or the printers.
• Device network. Card terminals, cameras, the thermostat, the smart TV, and the printer if it is not needed by the staff machines. These devices are often hard to update and their makers cut corners. Keep them away from the books.

Most small business routers have a guest network switch in the settings. Use it first. Next best is a business router or firewall with separate zones. The advanced name for it is a VLAN, a virtual network that shares the same cables. Your IT provider can set it up. If you accept cards, the card reader should be on its own network. Lesson 09 covers the card rules. Whether segmentation is required for your particular setup depends on your card processor's rules, so ask the processor.

Printers, cameras and other gadgets

An office gadget is a small computer you cannot see into. Cameras and printers often ship with a default password that is published in the manual. They accept connections from anywhere unless told otherwise. Do this once for every device:

1. List the device, its location and its model on the equipment inventory (lesson 03).
2. Change the admin password to a unique one from the password manager.
3. Check for firmware updates. If the maker has stopped providing them, plan to replace the device.
4. Turn off features you do not use, including remote viewing from the internet, automatic sharing and any "cloud" option you did not choose.
5. Put the device on the device network.
6. If the camera has a cloud account, use a business email address, a long password and two-step sign-in on that account.

Remote access

Remote access means reaching office computers or files from somewhere else. It is useful and dangerous, and the danger is the tool left open to the internet. The CISA and FBI #StopRansomware Guide says not to expose remote services like RDP (Remote Desktop Protocol) to the internet, to disable unused ports and protocols, and to require multi-factor authentication on VPNs. In plain words: no office computer should be reachable by anyone who happens to find it.

VPN: when it helps

A VPN (virtual private network) is an encrypted tunnel. There are two different uses and people mix them up.

• A business VPN connects a laptop to the office network from outside, so staff can reach a local file server. It helps when you still have files that live on a machine in the back room. It needs a second factor and regular updates, because the VPN device is itself exposed to the internet.
• A consumer VPN app sends your traffic to the app company's servers. It helps hide your activity from the people running a hotel or airport network. It does not protect against a fake login page, a malicious attachment or an infected laptop, and it moves your trust to the VPN company. Use only if the business approves.

Most small offices that use cloud email and cloud files do not need a business VPN at all. Moving files to a cloud service (lesson 04) and turning on two-step sign-in is often simpler and safer than keeping a door open to the back room.

Home workers

When a bookkeeper works from the kitchen table, the kitchen becomes part of your office. You cannot inspect it, but you can give a short set of rules and some help. Module 71 covers home computer security in more depth: /journal_tools/issues/71-home-computer-security/.

Public Wi-Fi

Hotel, airport and coffee shop Wi-Fi is shared with strangers. Modern websites and apps encrypt their traffic, so reading a webmail inbox on one is usually fine if the address starts with https and the device is current. The risks are fake networks with a look-alike name, and fake sign-in pages. For banking, payroll and the admin console, use a phone hotspot or wait. Turn off automatic joining of open networks on work devices.

Physical security

The best firewall does nothing if a stranger can walk to the back office, sit at a computer left signed in and plug in a drive. Physical security for a small office is a handful of cheap habits.

Tailgating is when someone follows a staff member through a locked door. Most people are too polite to challenge a stranger. Give staff a script: "Hi, can I help you find someone?" Then walk the visitor to the front desk. You are not accusing anyone.

The lost thing problem

Laptops, USB sticks and paper files leave the office in bags and cars. Laptops should have full disk encryption turned on (lesson 03), so a stolen one does not hand over its data. Cars are not a locker. Do not leave devices in an unattended vehicle.

Do this this week

Who does what

Questions and answers

Do I need a business firewall, or is the router from my internet company enough?

For two or three people with cloud tools and nothing sensitive on the local network, the supplied router can be enough if you change its passwords, turn off remote management and keep it updated. When you add card payments, guest Wi-Fi, cameras, a file server or more than about ten staff, ask your IT provider for quotes on a business firewall.

What is the quickest improvement to Wi-Fi?

Turn on the guest network, move visitors and smart gadgets to it, and change the staff password to a long passphrase. That takes about half an hour.

Should staff use their own phones on the office Wi-Fi?

On the guest network, yes. Personal phones carry games, shopping apps and who-knows-what. They do not belong on the network with the books. See lesson 07 for phone rules.

How do I know if remote desktop is open to the internet?

Ask the IT provider to check the router for port forwarding rules, and to scan your public address for open ports. Free scanners exist, but make sure you only scan your own address. If you find one, close it.

Is a consumer VPN a good idea for traveling staff?

It can help against nosy hotel networks, but the better steps are an updated laptop, two-step sign-in and cloud apps. If you allow a VPN app, choose and pay for it centrally rather than letting staff pick random free ones, which may sell their data.

Our building is shared with other tenants. What should we lock down?

Treat shared hallways and the shared internet as untrusted. Use your own router or firewall, not the building's shared network. Keep equipment in a locked cabinet, and never plug business devices into a wall jack of unknown origin.

Do smart speakers and TVs matter?

Yes, a little. They are computers that listen and connect. Keep them off the staff network and, in meeting rooms, think about whether they should be there.

What about the card terminal?

Put it on its own network and use the processor's rules. Lesson 09 covers it.

Hard questions

"Segmentation and firewalls sound expensive. We are six people."

The first steps are free: the guest network switch on the router you already have, and moving gadgets over. The expensive step is a business firewall, and you can decide on that after you see what the free steps cover and what quotes look like.

"My staff will not follow a clean-desk rule."

Make it small and visible. Papers with customer or payroll data in the locked drawer at day's end, screens locked when away. Owners following the rule themselves matters more than the memo. A two-minute end-of-day check at closing time is realistic.

"We need remote desktop. Our software only runs on the office PC."

Then put it behind a VPN or a managed access service with two-step sign-in, kept up to date, and never forward the port directly. CISA and the FBI list this as a baseline ransomware precaution. Also ask the software vendor whether there is a cloud version.

"Our IT person set up the router years ago and said it was fine."

It may well be. Ask three questions to find out: when was the firmware last updated, is remote management off, and are there any port forwarding rules? If the answers are "I do not know," schedule a review. Equipment that faces the internet needs routine care.

"Visitor sign-in is too formal for a friendly shop."

A clipboard by the door is friendly enough. You do not need a badge printer. The goal is to know who was there, and to make the back room feel like it has a front desk.