Office network basics: rooms, doors, and the router nobody owns

A small office network is a floor plan: guests and work devices live in different rooms, the router has an owner, and every device on it was invited.

Every office has an owner on the lease and nobody on the network. The router still carries the password printed on its box, the printer sits on the same network as the accounting folder, and the guest Wi-Fi shares the floor with the file server holding every client document the company has. This is not an attack story; it is a setup story. Most small offices were networked in one afternoon by whoever arrived first with a box from the electronics shop, and the arrangement was never decided since, because the internet kept working and working things do not get meetings.

The honest mechanism is that a network is rooms and doors, exactly like the premises it runs through. The work machines live in one room; the guests sit in another; the devices nobody bought on purpose, the streaming box in the meeting room, the camera somebody plugged in, the intern's laptop, wander where the walls allow. Physical offices grew walls and locks over centuries because property needed boundaries. Digital rooms need the same decision made explicitly, because a network, unlike a corridor, does not slow anyone down.

The practice starts with the inventory: write down what actually sits on the work network. The computers, the printers, the phones, the shared drive, the router itself, and then the awkward half of the list: the devices nobody bought on purpose, the personal phones, the old laptop in the drawer that still connects, the smart television in reception. The list is where the surprise lives, because every device on it is either invited or trespassing, and until the list exists the company cannot tell which is which.

Then comes the separation, and the reasoning matters more than the settings: guests and work devices belong on distinct networks, because a visitor's laptop is an honest machine carrying somebody else's infections. The guest did nothing wrong; their laptop met a cafe network last week. Separation means what the guest does on the internet stops at their room and never reaches the accounting folder. The same logic puts the printer, the television, and everything else with an internet connection but no business being near client data, in their own rooms too.

Then the network needs what every other part of the company has: a named person. Who can log in to the router, who may change what, who gets called at night when the internet dies, and who is allowed to plug in a new device. The router is a machine with an owner like any other machine; the absence of a name is how it keeps its factory password for years. The name does not need to be a specialist; it needs to exist, and to know where the documentation lives.

None of this is paranoia, and it is worth saying what it is instead: hygiene on the order of locking the front door and issuing keys. A company that inventories, separates, and names keeps its honest mistakes small. A printer that stops working is a nuisance; a printer nobody knew about becomes the path through which a folder walks out of the company. Structure is what makes the difference between an incident and an afternoon of inconvenience.

We keep this at the structure level on purpose: which hardware, which settings, which channels belong to provider documentation and to whoever administers the network, not to an essay. Where we sit is the floor plan and the discipline: helping an office see its own network as rooms and doors and decide them deliberately. Guidance, not guarantees: no floor plan removes risk entirely; decided rooms are what turn a trespass into a contained one.