The Printer Is Watching: How Your Office Gear Is the Biggest Cyber Threat

2025-12-08

For our 30th episode, we're tackling the cybersecurity blind spot that almost no one discusses but everyone should worry about. You've secured your laptops. You've rolled out multi-factor authentication. Your firewall is properly configured. But what about that office printer quietly storing every contract and payslip you've printed this year on a hard drive nobody ever wipes, with a password an attacker can guess in three tries? This episode reveals the uncomfortable truth about Internet of Things (IoT) devices in your business. We're...

This episode reveals the uncomfortable truth about Internet of Things (IoT) devices in your business. We're talking about printers, CCTV systems, smart thermostats, networked door locks, and every other "smart" device you've stopped thinking about as a computer. These forgotten devices are giving attackers a free pass into networks that are otherwise properly secured.

We share a real case study from our recent emails about a marketing agency that spent £15,000 on security, passed their audit with flying colours, and still got breached through their office printer. This isn't theoretical paranoia. This is happening right now to businesses that think they've got security sorted.

What You'll Learn

Why your office printer is possibly the biggest security risk in your building
How default passwords on "forgotten" devices create easy access points for attackers
The real story of a £15,000 security investment defeated by a £300 printer
What network segmentation actually means and why it matters for small businesses
How to create and maintain an accurate device inventory
Practical steps to secure IoT devices without enterprise budgets
Why your CCTV system might be livestreaming to the internet right now
How smart thermostats become backdoors into your network

Key Topics Covered The Forgotten Device Problem

Modern offices are full of computers disguised as other things. Every printer, every CCTV camera, every smart thermostat, and every networked door lock is actually a computer connected to your network. Most businesses secure their obvious computers whilst completely forgetting about these devices, creating perfect entry points for attackers who aren't bothering with sophisticated social engineering when they can just log in with "admin/admin".

Real Case Study: The £15,000 Security Investment Defeated by a Printer

A 30-person marketing agency listened to our ransomware and authentication episodes, then invested £15,000 in proper security: new firewalls, endpoint protection, hardware authentication keys for every staff member, and a security audit that came back clean. Two months later, they discovered someone had been accessing their client files for weeks through their HP printer that still used factory default credentials. The printer had full network access and stored copies of everything printed. Nobody had changed the password. Nobody had checked it during the audit. Nobody even thought about it.

Default Credentials: The Epidemic Nobody Discusses

Attackers maintain databases of default passwords for thousands of devices. They don't need to crack complex passwords when they can try "admin/admin" or "admin/password" and gain access to printers, cameras, or thermostats within seconds. These devices often ship with administrative interfaces accessible from the network, and most businesses never change the defaults because they don't think of these devices as security concerns.

Network Segmentation Explained (Without Enterprise Complexity)

Network segmentation sounds enterprise-level complicated, but the basic concept is simple: not everything on your network should be able to access everything else. Your printer doesn't need access to your accounting server. Your CCTV system doesn't need to reach your customer database. Creating separate network zones for different device types means a compromised printer can't become a stepping stone to your sensitive data.

The Device Inventory Challenge

Most small businesses have no accurate list of what's actually connected to their network. They know about the laptops and servers but often forget about the smart coffee machine someone plugged in last year, the wireless access points in the meeting rooms, or the networked thermostat the facilities team installed. Without knowing what's connected, you can't secure it. We discuss practical methods for discovering and documenting every device on your network.

Practical IoT Security Steps

We break down actionable steps that don't require enterprise budgets or dedicated security teams. This includes conducting device audits, changing default passwords, implementing basic network segmentation, regular firmware updates, and creating ownership responsibility for every connected device. The goal is proportionate security that's actually achievable for small businesses.

Key Takeaways

Every connected device is a computer. If it has an IP address, it's a potential security risk that needs management and protection.
Default passwords are attackers' best friends. The first thing to do with any new device is change the administrative password. Never assume factory defaults are acceptable.
Network segmentation isn't optional anymore. IoT devices should be isolated from your main business network, even if that means starting with basic VLAN separation.
Device inventory is fundamental. You can't secure what you don't know exists. Conduct regular network scans to discover forgotten devices.
Ownership matters. Every device needs someone responsible for its security. Don't let devices become "nobody's problem" because that's when they become everyone's problem.
Security audits miss IoT devices. Standard security assessments often focus on servers and workstations whilst completely overlooking printers, cameras, and other IoT equipment.
Firmware updates apply to everything. IoT devices need security patches just like computers. Many businesses forget this entirely.
Your £15,000 security investment can be defeated by a £300 printer. Security is only as strong as your weakest link, and IoT devices are often the weakest links because they're forgotten.

Resources & References Mentioned in This Episode

Previous Episodes Referenced:
- Episode 17: Social Engineering - The Human Firewall Under Siege
- Ransomware episodes (multiple)
- Authentication episodes featuring Mark Bell
- Cyber Essentials episodes
- Electoral Commission accountability episode
Hardware Authentication: AuthenTrend hardware keys (mentioned as sponsor)
Case Studies: Marketing agency breach via printer (anonymized client)