The UK bans default passwords. Check your office
A new UK law bans default passwords on smart devices. The devices already in your office still have them.
Since 29 April, the UK bans smart devices sold with universal default passwords like admin/admin. Makers must also say how long they’ll ship security updates and give a way to report bugs. Good law. It does nothing for the devices already on your network.
Walk around the office and count: cameras, the DVR, door access, printers, smart TVs in meeting rooms, the UPS with a network card, the router, the Wi-Fi access points. Many still use the password from the manual, which is published online.
What to do:
- Change every default password and store the new ones in your password manager.
- Update the firmware, and note which devices no longer get updates. Plan to replace them.
- Put these devices on their own network, away from laptops and servers.
- Never expose them to the internet with port forwarding. Use a VPN to view the cameras.
- Turn off what you don’t use, such as UPnP and cloud features.
A camera from 2016 can be the easiest way into a 2024 network.