Guest Wi-Fi, printers, cameras: which doors into your network is nobody watching?

The scenario in brief

Example, made up for illustration. A fictional SME of twenty-five people. A single Wi-Fi network, with the password displayed at reception for visitors. A leased multifunction copier, installed by the supplier, which emails scans. Four cameras put up by the electrician, with a recorder the manager checks from his phone.

Nobody has done anything wrong, and everything works. But a visitor sitting in the waiting room is on the same network as the accounts team. The copier still has its factory admin password. And the camera recorder can be reached from the internet, because it was ‘opened up’ for the phone app.

Why these devices are doors into your network

A Wi-Fi access point, a copier or a camera is a small computer. It runs internal software (‘firmware’) that has flaws, like any software. The difference from your PCs: nobody updates them, nobody checks who connects to them, and they stay on day and night.

The best-known danger is the factory password. It is often the same for every device of a given model and is printed in the manual. In 2016, the Mirai malware took control of routers, cameras and video recorders by trying a short list of 62 default usernames and passwords, according to the US cybersecurity agency (CISA). The hijacked devices were then used in an attack of more than 620 gigabits per second against a news website.

Printers are no exception. In May 2023, the US cybersecurity agency (CISA) and the FBI reported the exploitation of a critical flaw in PaperCut, print management software, and asked users to apply the patch ‘immediately’. A ransomware group (ransomware encrypts your files and demands a ransom) used it to get into the networks of educational institutions.

Visitor Wi-Fi: separate it, don’t just add a password

A Wi-Fi password stops the neighbour from connecting. It says nothing about what a person can see once connected. If the visitor Wi-Fi and the staff Wi-Fi are one and the same network, a supplier dropping by, the intern or the patient in the waiting room are ‘inside the office’, as far as IT is concerned.

The answer is an isolated guest network: a second Wi-Fi network that gives access to the internet and nothing else. Technically, it sits in a separate compartment of the network (a ‘VLAN’), and the firewall, the filter between networks, blocks any route to your PCs and devices.

Settings to check

• A separate guest network, with a strong password that differs from the staff one.
• Up-to-date encryption: WPA2 at a minimum, WPA3 if your devices support it.
• The admin password of the firewall and the Wi-Fi access point changed at installation, then regularly. Note: this is not the Wi-Fi password, it is the one that lets you change the settings.
• A neutral network name that contains neither the company’s name nor its address.
• A look at connected devices: an unknown device in the access point’s list is the signal to change the Wi-Fi password.

The test that never lies: connect your phone to the visitor Wi-Fi and try to print on the office copier, or open a shared folder. If it works, the guest network is not isolated.

The multifunction copier: a computer people forget

A modern copier has an admin site reachable from the network, often protected by a factory password. It uses an email account to send scans, and sometimes stores that account’s password. Many also have an internal hard drive, which can hold copies of scanned and printed documents.

• Change the copier’s admin password, and keep it in your password manager, not on a sticky note.
• Ask the supplier for firmware updates, and write them into the maintenance contract.
• Turn off features you don’t use: printing from the internet, folder sharing, old protocols.
• Plan for the drive to be wiped at the end of the lease. Belgium’s Data Protection Authority (in French) lists the end of a multifunction printer lease among the cases where storage media must be wiped or destroyed, and asks for the contract to provide for it when you don’t own the equipment.

The trap: letting the supplier take the old copier away without a document certifying it has been wiped. Payslips, contracts and letters scanned over the years can leave with it.

Cameras: a matter of security and of law

A poorly protected camera can end up filming for someone else. The basics: replace the factory password with a long password unique to each device, install updates, and never reuse the same password from one device to another.

The point most often overlooked is remote access. To see the footage on a phone, the installer sometimes ‘opens’ the recorder to the internet. It then becomes visible to anyone, and can be attacked day and night. Use the manufacturer’s official app, kept up to date, or a secure connection to the office (a VPN, an encrypted tunnel), and ask your IT provider to check that no device is directly exposed.

What Belgian law requires

The camera law of 21 March 2007 applies as soon as you film to monitor a place. According to BeSafe (in French), the website of the Federal Public Service Home Affairs, a business must follow these rules.

If the cameras also film your staff, collective labour agreement No. 68 (page in French) also applies in the private sector: only four purposes are allowed, and staff must be told the purpose of the monitoring.

Take stock: everything plugged in on your premises

You can’t protect what you don’t know about. The first step is a simple list, kept up to date, that you or your IT provider can fill in within an hour.

This table is an example: every ‘No’, ‘Unknown’, ‘Never’ or ‘mixed’ is a task. Think too about the devices you no longer notice: the meeting room screen, a smart thermostat, the time clock, the alarm, a video doorbell.

What the Cyber Resilience Act changes when you buy

The European Cyber Resilience Act requires manufacturers to design, update and maintain their connected products securely. According to the European Commission, it has been in force since 10 December 2024. Reporting obligations have applied since 11 September 2026, and the main obligations will apply from 11 December 2027.

Until then, one simple question to ask before every purchase: for how many years will the manufacturer provide security updates?

To do on Monday morning

1. List every device connected to the network, using the table above.
2. Change every factory password still in place: Wi-Fi access point, firewall, copier, camera recorder.
3. Set up or check the isolated guest network, then do the phone test: try to print from the guest Wi-Fi.
4. Check that no device is directly open to the internet, starting with the camera recorder.
5. Turn on automatic updates where they exist; otherwise, a monthly reminder.
6. Check your cameras’ declaration on declarationcamera.be, the pictogram and the register.
7. Reread the copier contract: updates included, drive wiped at the end of the lease.

None of these steps requires buying equipment. Above all, they require knowing what is plugged in, and deciding who looks after it.

Take stock of your devices→