Security for the smart stuff on your business network

Why connected devices are the soft spot

Most small business networks grow one device at a time: a printer that scans to email, a smart TV in the break room, a thermostat the landlord added, a tablet at the register. Each one gets connected, works, and is forgotten. Usually it lands on the same flat network as the front desk computers and the file server.

Those devices tend to share four habits:

• Default or shared passwords that were never changed, or that a vendor reuses across customers.
• Old firmware. Many devices get updates rarely, and some stop getting them while they still work fine.
• Exposed remote access. A port forward or remote feature turned on years ago so someone could check in from home.
• A flat network. When everything can reach everything, one weak device becomes a path to email, accounting and backups.

None of this calls for panic. It is ordinary, and much of the risk can be contained from the network side without anyone touching the devices. Think of the marine layer over Lompoc: you cannot stop the fog from rolling in, but you can decide which rooms it reaches. CISA covers the same basics in its small business guidance at cisa.gov.

What Keith Systems reviews on the network side

Jacob holds the CISSP, CompTIA CySA+ and CompTIA SecurityX, and reports vulnerabilities through coordinated disclosure on HackerOne (@cratitoes) and through MSRC. On this engagement he works only on the network your devices share, on your own network gear, accounts and written policies:

• Inventory from the IT side. A list of what is actually on your network, built from your firewall's client list, DHCP leases and switch tables. Unknown entries get flagged for you to identify.
• Segmentation plan. Separate segments for staff, guests and devices, plus payment systems where relevant, built on the firewall, switches and Wi-Fi access points you already own. A device segment holds things like cameras, door controllers, printers, thermostats and other connected devices.
• Firewall rules between segments. Deny by default, then allow only what each group needs. Staff computers can send print jobs to the device segment, for example, but the device segment cannot start connections to staff computers.
• Guest, staff and device Wi-Fi. Separate networks with separate passwords, so a visitor's phone and a smart TV are never neighbors of your bookkeeping laptop.
• Remote-access exposure check. An external exposure review with written authorization from the owner, looking at what your internet connection shows the world: open ports, admin pages, forgotten port forwards.
• DNS filtering at the network level, blocking known malicious domains for every segment.
• Business accounts and MFA. Email, network admin and other business-owned accounts, checked for MFA coverage and shared logins.

Approved changes to your network gear happen in a window you choose, with configuration backups taken first. If you prefer, Jacob hands written steps to your IT provider instead.

Written requirements for whoever services your devices

Keith Systems documents how your network is segmented, for your own records and decisions. Keith Systems writes them down in plain, vendor-neutral language you can hand over:

• Outside connections into the network use an owner-approved method, with MFA where offered, and are disabled when no longer needed.
• Any request to open a port or add a firewall rule goes to the owner in writing first.

The document names no products or brands. It describes outcomes, so it works no matter who you hire.

Who this fits on the Central Coast

• Tasting rooms and wineries. Santa Barbara County Vintners report about 325 wineries and tasting rooms countywide (2024). From Lompoc's Wine Ghetto to Solvang, Buellton and Los Olivos, a typical room has POS tablets, guest Wi-Fi and a smart TV behind the bar. Keeping payment devices off guest Wi-Fi supports PCI DSS preparation. See the tasting room PCI guide.
• Medical and dental offices in Santa Barbara, Goleta, Santa Maria and Arroyo Grande, where networked imaging systems, printers and check-in tablets often share a network with the systems that hold patient records. Pair this with a HIPAA security risk analysis.
• Ag and food businesses around Santa Maria and Guadalupe, with cold room sensors, weather stations and irrigation controllers that were given remote access long ago. See wineries and agriculture.
• Small professional offices in Nipomo, Orcutt and Lompoc with conference room TVs, smart thermostats and a printer that scans to email.

Good to know

My work is on the network side. I'm not a licensed contractor and don't install, wire or sell cameras or other devices; for physical work, look up a California contractor at cslb.ca.gov (more here). Not sure if your setup fits? Ask anyway.

How an engagement works

1. Free consult. About 30 minutes by phone or video, no obligation.
2. Written scope. What gets reviewed, what may change, and the fee, stated in writing before any work begins.
3. Review. On site in Santa Barbara County and southern San Luis Obispo County, or remotely.
4. Readout. Findings, a segment diagram, a change log and your device requirements document.

Book a free security consult or call (805) 800-8163. For background, read the network segmentation guide.