Is our office network secure? One person can check part of it in an afternoon.

Hour one: count what is on it

CISA’s Cyber Essentials tells leaders to learn what is on the network and to keep hardware and software inventories. For an office, that starts as a list on paper.

Write the date next to each count. A list with no date can’t be compared with the next one.

1. Walk the office and write down every device that connects: computers, phones, printers, the phone system, cameras, a card reader, a TV, a thermostat.
2. Open the router’s list of connected devices and count the lines.
3. Put the two counts side by side. A small gap is usually devices you forgot. One line nobody can place is where to look next.

Hour two: the router and the Wi-Fi

Sign in to the router’s admin page and write down what each of these says. CISA’s router guidance is the reference.

• The admin password. CISA says factory logins may be on the internet or printed on the device. Was it changed, and who knows the new one?
• Firmware. Is it the version the maker lists as newest? CISA says updates patch flaws.
• Remote management. CISA recommends turning it off, since it lets someone change settings over the internet.
• WPS and UPnP. CISA recommends turning off WPS, and turning off UPnP unless something needs it.
• The Wi-Fi security type. CISA calls WPA3 the strongest encryption. An open network with no password is a finding in an office.
• A guest network. CISA recommends giving visitors a separate channel and password, so they never get the main one.

Hour three: shared folders

A shared folder is a folder someone chose to make visible to other computers. CISA says to turn off file sharing when it isn’t needed.

On the computer that holds your files, open PowerShell and type Get-SmbShare. Microsoft documents this command as listing the shares on the computer. Expect three default entries, ADMIN$, C$, and IPC$, which Windows creates. Every other line is a folder someone shared. Write down its name and path, and who set it up.

The list doesn’t show who is allowed to open each folder. That is read from the folder’s properties, one at a time.

Hour four: what reaches in, and what backups can reach

CISA’s ransomware guide says attackers often enter through remote services that are exposed and weakly guarded. It advises limiting remote desktop, closing ports that aren’t needed, requiring multifactor sign-in, and logging login attempts. Ask three things and write the answers down: which computers have remote desktop turned on, which remote support programs are installed, and who uses a VPN.

The same guide says many ransomware strains look for backups they can reach and delete or encrypt them, and advises offline, encrypted backups that are tested for restore. Look at where your backup drive or folder appears. If it shows up as a drive on a computer anyone signs in to, that computer can reach it.

What takes a trained look

• Whether the router’s rules do what the settings page implies, read from outside the building as well as inside.
• Whether one computer can reach another. CISA says dividing a network into segments limits how far an intrusion spreads, and asks for an up-to-date network diagram. Many small offices have never drawn one.
• Devices that don’t show a version number, such as cameras, printers, and the phone system.
• Who can open each shared folder, and whether those permissions match who works here now.

What a finished checklist covers

If every line above has an answer and a date, you know how the network is set up on that day. You don’t know that it holds up, because nobody has tried it.

We look at it with you and tell you what we found and what we didn’t, with dates. A person reads the result.

A checklist tells you what you set. A trained look tells you what it does.

Related

• An Unknown Device on Your Network: How to Check It
• Router Hacked? What the Admin Page Shows and What to Check
• Can Your Backups Actually Be Restored? A Test You Can Run
• A Remote-Access Program You Did Not Install

Sources

• CISA: Cyber Essentials
• CISA: Securing Wireless Networks
• CISA: Home Network Security (router recommendations)
• CISA: #StopRansomware Guide
• Microsoft Learn: Get-SmbShare