When did you last update your switches?
Routers, switches, access points and NAS boxes run software too, and attackers target them because nobody patches them.
Ask an IT team when they last updated Windows and they’ll know. Ask about the core switch, the Wi-Fi access points, the office router or the NAS, and there’s often a pause.
These devices run full operating systems, often with web admin pages, and many sit on the network for eight or ten years. Attackers use them to hide, to move between networks, and as relays for other attacks.
- List every network device with its model, firmware version and end-of-support date.
- Check the vendor’s security advisories for each model. Most have an RSS feed or mailing list.
- Update in a maintenance window, starting with anything reachable from the internet.
- Turn off remote admin from the internet, and change default admin passwords.
- Replace devices the vendor no longer supports. No updates means every future bug stays open.