Office network, Wi-Fi and firewall security: a practical checklist for SA small businesses and councils

Most South Australian small businesses, not-for-profits and council depots run on a network that was set up once, usually when the NBN arrived or the office moved, and hasn’t been looked at since. The router came from the internet provider, the Wi-Fi password is on a sticky note, the printer, cameras and staff phones all share one network, and nobody is quite sure who has the admin login. That network carries your email, files, phones and payments, and when it is weak it gives attackers an easy way in or simply stops the business working. This guide sets out a practical baseline for an office or site network. It is general guidance; check your equipment vendor’s current advice and the Australian Signals Directorate’s ACSC guidance at cyber.gov.au before you change settings.

Start with a simple network register

You can’t secure what you haven’t listed. Write down, for each site:

• The internet services: provider, connection type, account holder and support number.
• Network equipment: modem or router, firewall, switches and Wi-Fi access points, with make, model, firmware version and the date the vendor stops supporting it.
• Who holds the admin logins, where they are stored, and whether multi-factor authentication (MFA) is available on any cloud management portal.
• What connects: staff computers, phones, printers, EFTPOS terminals, cameras, door access, smart TVs and any building or plant systems.

Keep it with your other IT records. Our patch and vulnerability management guide explains how to track support end dates, and the domain, DNS and admin account ownership checklist covers making sure your organisation, not a past supplier, controls the logins.

Step 1: secure the router and firewall

• Change default admin passwords to long, unique ones kept in your password manager, and remove any shared or former-supplier accounts.
• Turn off remote administration from the internet unless your IT provider genuinely needs it, and if they do, restrict it and protect it with MFA through the vendor’s management portal.
• Update the firmware and turn on automatic updates where the device supports them. Replace equipment that no longer receives security updates; an unsupported router or firewall is one of the most common weak points on a small network.
• Block unsolicited inbound traffic by default. Review port forwarding rules and remove anything nobody can explain. Never expose Remote Desktop, file shares or camera recorders directly to the internet.
• Turn off features you don’t use, such as UPnP, which lets devices open ports on their own, and WPS push-button Wi-Fi setup.
• Keep logs long enough to help an investigation, and send alerts to someone who will read them.

Internet provider routers are often fine for a home but limited for a business. If you have more than a handful of staff, card payments or remote workers, a business-grade firewall with central management and security updates is usually worth considering.

Step 2: set up Wi-Fi properly

• Use WPA3, or WPA2 with AES where older devices can’t support WPA3. Retire anything that still needs WEP or TKIP.
• Use a long, unique passphrase for staff Wi-Fi and change it when staff leave, or move to individual sign-in (WPA2/WPA3-Enterprise) linked to staff accounts so access ends when an account is disabled. Our onboarding and offboarding checklist covers that step.
• Place access points for coverage, not convenience, so staff aren’t tempted to bring in their own extenders or hotspots.
• Look for unknown networks and devices during routine checks, such as a rogue access point plugged into a spare network socket.

Step 3: separate guests and devices from staff

One flat network means a visitor’s phone, a cheap camera or a compromised smart TV can reach the same systems as your finance laptop. Separate them:

• Guest Wi-Fi on its own network that can reach the internet but nothing internal, with client isolation turned on so guests can’t see each other.
• A devices network (often a separate VLAN) for printers, cameras, door access, TVs and building systems, allowing only the traffic they need.
• Payment terminals set up the way your payment provider requires; ask them, as card security rules apply.
• Servers and network management reachable only from the staff network or by the IT team.

Councils offering public Wi-Fi in libraries, community centres or parks should treat it as a separate service with its own terms of use, content filtering decisions and logging, entirely apart from the corporate network.

Step 4: make remote access safe

Remote access is where many small-business incidents begin. Avoid exposing Remote Desktop or file shares to the internet. Use cloud services such as Microsoft 365 with MFA, a VPN or zero trust access service that requires MFA and is kept patched, and remove access as soon as someone leaves. Our zero trust and conditional access guide and password manager and MFA rollout guide explain the options, and the Microsoft 365 security checklist covers the cloud side.

Step 5: add filtering and visibility

• DNS or web filtering to block known malicious and phishing sites for everyone on the network, including devices that can’t run security software.
• Firewall security services where your firewall offers them, such as intrusion prevention and threat feeds, kept up to date.
• A monthly look at new devices, blocked threats, firmware status and Wi-Fi health, summarised in a few lines for management.

Step 6: plan for outages

For many organisations a network outage costs more than most attacks. Consider a backup internet connection, such as a 4G or 5G service with automatic failover on the firewall, a small uninterruptible power supply (UPS) for the modem, firewall and main switch, a saved copy of the configuration, and a short printed contact sheet for your provider and IT support. Include the network in your backup and disaster recovery plan and your cyber incident response plan, including how to disconnect a device or site quickly.

Common mistakes

• One Wi-Fi password shared for years by staff, former staff, contractors and visitors.
• Old port forwards left open for a system or supplier that is long gone.
• Cameras and recorders reachable from the internet with default passwords.
• Equipment past end of support because it still works.
• No record of who has admin access, so nobody can change anything quickly in an incident.

These are also the questions many insurers ask about; our cyber insurance questionnaire guide shows how they map to common controls.

A 30-day plan

1. Week 1: build the network register, confirm who holds every admin login, and move them into your password manager.
2. Week 2: update firmware, change default passwords, turn off remote administration, UPnP and WPS, and remove unexplained port forwards.
3. Week 3: set up separate guest and device networks, move Wi-Fi to WPA3 or WPA2-AES with a new passphrase, and review remote access.
4. Week 4: add DNS filtering, decide on backup internet and a UPS, save the configuration, and diary a monthly check.

Questions to ask your IT provider

• Which of our network devices are past or near end of support, and when will they be replaced?
• Is anything on our network reachable from the internet, and why?
• Are guests, staff and devices on separate networks?
• How is your remote admin access to our network secured, and is it protected with MFA?
• What happens to our internet, phones and payments if the main connection fails?

Talk to an Adelaide team

EITSAA helps Adelaide small businesses, not-for-profits and councils review and secure office and site networks, plan replacements and backup internet, and keep everything patched and documented as part of managed IT. Get a quote for a network review, or call 0402 401 584, Monday to Friday, 9am to 5:30pm. Learn more about our managed IT, cloud and DevOps and training and consultations services.