The Telly in Meeting Room 2 Knows Your Wi-Fi Password

There is a scene that plays out in small offices up and down the country. Someone has a spare smart TV going begging, so it goes on the wall in Meeting Room 2. Or the landlord fits a doorbell camera by the fire exit. Or the thermostat in the back office arrives because the old one was "a bit temperamental". Somebody finds the Wi-Fi password written on the whiteboard, taps it in, and five minutes later the thing is online.

And then nobody thinks about it again. Which is the problem.

It's Only a Telly, Right?

That phrase has cost more small businesses more time than almost any other. Because the telly in the meeting room is not really a telly any more. It's a small computer with a browser, an app store, a microphone, a camera on some models, and a manufacturer's update schedule that may have quietly expired two years ago.

Put it on the same flat network as your file server and your Microsoft 365 sessions and it becomes a very comfortable place for an attacker to sit. Not because anyone is targeting your smart TV specifically, but because these devices are the low-hanging fruit of the office: rarely patched, rarely monitored, and almost never included in anyone's asset list.

You don't need to be a bank to be worth a go. A compromised device on your network is a foothold, and a foothold is all someone needs to start poking around.

The Flat Network Problem, in Plain English

Most small UK offices run on a single network. One router, one password, everything on it: laptops, phones, the printer, the NAS drive with the accounts on it, the CCTV recorder, and now the doorbell camera and the meeting room display.

That means every device can, in principle, talk to every other device. The television does not need to see your accounts folder. It has no reason to know the printer exists. But on a flat network, it can.

Separating devices into different zones used to be enterprise territory. These days it's a couple of tick boxes on a business-grade router, or one conversation with whoever manages your IT. The idea is simple: devices that only need the internet get only the internet. Nothing else.

Step One: A Guest Network That Means It

Nearly every router shipped in the last decade can broadcast a second Wi-Fi name for guests. Most businesses switch it on, set a password, and then immediately undermine it by letting staff laptops and the office printer join it.

Don't. The guest network is for visitors, phones on lunch, and — yes — the meeting room telly. If your kit supports client isolation (the setting that stops two devices on the same guest network from seeing each other), turn that on too. It costs nothing and it means a compromised guest device can't chatter to its neighbour.

If your router can do VLANs rather than just a basic guest SSID, even better. That's the proper version of the same idea: a tagged segment that can't route into the business network at all. Worth asking your IT support about if you're due a router refresh anyway.

One honest caveat: the little combined box your broadband provider sends you is a router, a modem and a Wi-Fi access point in a plastic shell, and it is not a firewall. It'll do a guest network. It won't do proper segmentation. Know which one you've got.

Step Two: Turn Off What You'll Never Use

Every connected device ships with features nobody asked for. Screen mirroring protocols that accept connections from anyone on the same network. A cloud account sign-in that ties the device to a personal email address. Remote support ports. A web admin page still sitting on the default password.

Spend twenty minutes per device going through the settings menu. If you can't see a reason to keep a feature on, switch it off. If the device offers a cloud account, decide whether you actually want it — and if you do, register it to a shared business address that more than one person can access, not to Dave's personal Gmail from 2014.

While you're in there, change the admin password. The default ones are published on the internet in lists that fit on a single page.

Step Three: Firmware Is Not a Dirty Word

Firmware is just the software the device runs on, and like any software it needs updating. Some devices do it automatically. Plenty don't, and plenty more stopped getting updates without telling anybody.

Keep a simple list: what the device is, the make and model, roughly when you bought it, and whether it's still supported. When something falls off the support list, it moves to the "replace soon" column rather than sitting quietly on the network for another five years.

This is one area where UK regulation has actually helped. Since April 2024, connectable products sold here have had to meet baseline security requirements under the Product Security and Telecommunications Infrastructure regime — no universal default passwords, a published vulnerability disclosure contact, and a stated minimum support period. It's not a guarantee of quality, but it does mean the box now tells you how long it intends to be looked after. Read it before you buy.

Step Four: Ask Before You Plug In

Whether it's the landlord's doorbell camera, a facilities contractor's thermostat, or a display supplied by a signage company, someone should be asking questions before the cable goes in. Five will do:

• Who owns and manages this device, and who holds the admin login?
• Does it need to reach the internet, and does it need to reach anything on our network?
• How does it get security updates, and for how long?
• What data does it collect, where does it go, and who can see it?
• What happens when we leave this building or end the contract?

If the answers are vague, that's useful information. Put the device on the guest network, keep it away from anything that matters, and get the answers in writing.

What Good Looks Like

You're not aiming for a data centre. You're aiming for a small business where the doorbell camera can't see the payroll folder and the meeting room display can't be a back door into your email.

Practically, that's three things: a separate network for the gadgets, updates that actually happen, and a short written record of what's connected and who owns it. Half a day's work, once, and a five-minute review whenever something new appears on the wall.

And take the Wi-Fi password off the whiteboard. That one's free.