Securing the Office Network and a Guest Network

Why this matters

The office network is the hallway every other system walks through. The computer with the accounting file, the box with the shared drive, the printer that scans invoices to email and the card terminal on the counter all sit on it, and in most small shops it was set up once by whoever installed the internet and never looked at again. That is how a shop ends up with a router still on its factory password, a Wi-Fi password every former employee and half the customers know, and a printer quietly holding a copy of the office manager's email password. None of this takes a specialist to fix. It takes one afternoon, a walk through the network in the order the traffic flows, and a few settings changed on each thing you pass.

The shape you are aiming for

Before touching anything, know the target. One internet connection, one router, and behind it at least two separate networks that cannot see each other: one for the business, one for guests. Shops with cameras, smart thermostats and similar gadgets add a third.

INTERNET
   |
[ISP modem]  (sometimes built into the router)
   |
[ROUTER]  admin login changed, remote admin off
   |
   +-- OFFICE network (WPA3 or WPA2-AES)
   |     office PCs, NAS/shared drive,
   |     printer, card terminal
   |
   +-- GUEST network (own password, isolated)
   |     customers, visiting reps, staff
   |     personal phones
   |
   +-- DEVICES network (optional, isolated)
         cameras, thermostat, TV, door
         chime, anything "smart"

The rule the picture carries: anything you do not fully trust gets a network of its own. A visitor's phone, an employee's personal tablet and a cheap camera with years-old software are all things you do not control, so none of them shares a network with the computer that holds payroll.

Walk 1: the router

Find the router's admin page. The address is usually on a sticker on the device or in the internet provider's documentation, and opens in a web browser on a computer plugged into the network. Then work through it.

Change the administrator password. This is the password for the router's own settings, not the Wi-Fi password, and it is the one that matters most. Older routers shipped with a shared default such as "admin" that is published online for every model. Newer ones print a unique password on a sticker, which is better but means anyone who has stood next to the router has it. Set a long unique one and store it in the password manager. What breaks if you skip it: anyone on your Wi-Fi, including a guest if the networks are not separated, can sign into the router and change where your traffic goes.

Turn off remote administration (sometimes called remote management or web access from the internet) unless someone specific needs it and knows they do. It lets the router's admin page be reached from anywhere in the world.

Turn off WPS (Wi-Fi Protected Setup), the push-button or PIN pairing feature. Its PIN method has a long history of being guessable.

Look at port forwarding and UPnP. Port forwarding opens a path from the internet to one device inside, and UPnP (Universal Plug and Play) lets devices open those paths on their own. Any forwarding rule you cannot explain should go, and UPnP should usually be off for a business network. An old forwarding rule for remote desktop is a classic entry point for ransomware. See related: Ransomware Locked the Office Computer.

Update the firmware, the router's own built-in software, and turn on automatic updates if offered. Then check whether the manufacturer still issues updates for that model. A router past its end of support gets no security fixes and should be replaced; a router more than about five years old is worth checking first. If your internet provider supplied the router, they may manage its firmware and some settings, so ask them what they control.

Walk 2: the office Wi-Fi

Encryption. In the wireless settings, choose WPA3 if every device in the office supports it, or WPA2 with AES (sometimes shown as "WPA2-Personal" or "CCMP"). Many routers offer a WPA2/WPA3 mixed mode that lets older devices connect, which is a reasonable choice. Avoid anything labeled WEP, WPA without the 2, or TKIP; those are broken and some newer devices will refuse them anyway. This is current as of 2026; the Wi-Fi Alliance's website lists the current security certifications if you want to re-check.

A long Wi-Fi password, known to the people who need it. A short phrase of four or five unrelated words is long enough and easy to type. The office Wi-Fi password goes to employees' work devices only, never to visitors and never onto a sign on the wall.

Change it when someone who knew it leaves. A shop default worth starting from: change the office Wi-Fi password whenever an employee with it leaves on bad terms, and at least once a year regardless. Changing it means reconnecting every office device, which is a good reason to keep personal phones off the office network in the first place.

Walk 3: the guest network

Most business and many home routers have a guest network setting. Turn it on and set:

• Its own name and its own password, different from the office one. A guest network that shares the office password is not a guest network.
• Client isolation (sometimes "AP isolation" or "allow guests to see each other: off"), so devices on the guest network cannot reach each other, and no access to the local network, so they cannot reach anything on the office side.
• A password you rotate, quarterly as a starting point, because it will be shared freely. Printing it on a card at the front desk is fine, which is the point of having it.

Staff personal phones go on the guest network. They need the internet, not the office computer, and a phone you do not manage is a device you do not trust, however much you trust its owner. See related: Personal Phones at Work: The BYOD Question.

Walk 4: the printer nobody thinks about

The office printer, especially a multifunction one that scans, copies and faxes, is a small computer with a network connection, a web admin page, often a hard drive, and frequently some of the most sensitive data in the office. Work through it the way you did the router:

• Change its admin password. Most office printers ship with a default printed in the manual, and their admin page lets anyone who can reach it read the address book, change settings and sometimes see recent jobs.
• Check what it has stored. The scan-to-email feature often stores an email account's username and password inside the printer. Scan-to-folder stores a network login. The address book holds customer and supplier emails. Where the printer supports an app password or a dedicated scanning mailbox, use that instead of someone's real email password.
• Update its firmware, and turn off features you do not use, such as fax-to-email, remote printing services or cloud printing.
• Know about the drive. Many multifunction printers keep copies of scanned and printed documents on an internal drive. When a printer is returned at the end of a lease or thrown away, have the drive wiped or removed first, which the lessor can usually do and document.
• Keep it on the office network, not the guest network. Putting the printer on guest Wi-Fi so visitors can print hands every guest access to its admin page.

A worked example

A six-person landscaping office ran the four walks in one afternoon. The findings, in the order found:

1. Router admin password was still the factory default for that model. Changed and stored.
2. Remote administration was on. Turned off.
3. One port forwarding rule pointed at the office computer, for remote desktop, set up by a former bookkeeper. Nobody needed it. Removed.
4. Firmware was about three years behind, with automatic updates off. Updated and auto-update turned on.
5. Encryption was WPA2 with TKIP. Changed to WPA2/WPA3 mixed mode with AES. One old office laptop needed its connection re-entered; nothing else noticed.
6. There was no guest network. Customers in the waiting area and every employee's phone had the office password, which had not changed in four years and was known to at least nine former seasonal staff. A guest network was created, the office password changed, and only the three office computers, the shared drive and the printer were reconnected to it.
7. The printer's admin page was open with no password, and its scan-to-email setting held the office manager's own email login, readable by anyone on the network for four years. Admin password set, and scan-to-email moved to a separate scanning mailbox. Her email password was then changed, because it had to be treated as exposed.

Seven findings, three of them each serious enough to be an entry point on their own: the open port, the shared office password and the printer's stored login. The whole job took a little under four hours of one person's time, most of it reconnecting devices and finding the printer's manual.

What would change the answer. If the router is supplied and locked down by the internet provider, some of walk 1 is theirs to do; call them, and if they cannot turn off remote administration or provide a guest network, put your own router behind theirs and run the office from that. If the shop processes card payments on terminals that connect over the network, ask your processor whether the terminal must sit on its own network segment; some setups expect it, and the processor's guidance governs. See related: PCI Compliance Explained for a Small Shop.

How to verify it worked

From a phone on the guest network, try to open the router's admin page and the printer's admin page by their addresses. Both should fail to load. From the office network, both should ask for a password you set. Then add the four walks to the shop's yearly security review, so the next afternoon of it is a check rather than a cleanup. See related: The Annual Security Review SOP.

References

• CISA guidance on securing home and small office wireless networks and routers
• Wi-Fi Alliance, current Wi-Fi security certifications (WPA3 and WPA2)
• Your router's and printer's manufacturer documentation on administration, firmware and data wiping
• See related: Ransomware Locked the Office Computer
• See related: The Annual Security Review SOP