Doesn’t the provider’s router update itself automatically?

Often it does, but not always. Check the management page or ask your provider how updates are handled. If you have your own firewall, access points or a NAS behind it, you are responsible for those devices yourself.

How often should network equipment be updated?

Turn on automatic updates where possible. For the rest, a fixed monthly moment works well, with faster action on critical security updates the manufacturer announces.

Is a NAS safe enough as a backup?

A NAS is useful, but not enough as your only backup. Ransomware or a hardware fault can hit the NAS itself. Make sure you have at least one extra copy that is offline or immutable.

What if nobody knows the admin password any more?

Then a factory reset is often the only option, followed by reconfiguring the device. Plan that outside working hours with your IT partner, and store the new credentials securely straight away.

Router, firewall and NAS: how an SME should keep network equipment updated

Most SMEs now keep their laptops neatly updated. The router, firewall, wifi access points and the NAS in the comms cupboard often fall outside that. They were installed once by a supplier or a handy colleague, they work fine, and then they are forgotten. Yet these are the devices connected directly to the internet, and attackers actively look for network equipment with known vulnerabilities, default passwords or a management page that can be reached from outside.

Why the comms cupboard is a weak spot

A router or firewall is the front door of your network. A NAS often holds exactly the files you cannot afford to lose. Yet these devices rarely get the same attention as laptops. They are not in Intune, they send no alerts and nobody logs in to them every week. Manufacturers regularly release firmware updates to close vulnerabilities, but those only reach the device if someone installs them or has automatic updates turned on. Attackers continuously scan the internet for devices with known weaknesses. A forgotten router or NAS is an easy way in for them, even at small businesses that think they are “not interesting”.

Step 1: know what you have

Start with a simple list. For each device, record:

Type and model: the provider’s router or modem, firewall, switches, wifi access points, NAS, and any separate VPN server.
Firmware version and last update: visible on the device’s management page.
Who manages it: your provider, a former supplier, a colleague or your IT partner, and where the admin credentials are kept.
Support status: does the manufacturer still release updates for this model, or is it already end of life?

This inventory often reveals that nobody remembers the admin password, or that it sits with a supplier who has since left. It is the same problem as who holds the keys to your domain name: sort it out now, not during an outage.

Step 2: update firmware on a fixed rhythm

Many modern routers, firewalls and NAS systems can update themselves. Turn that on, preferably with an update window outside working hours. Where automatic updates are not possible or not wise, for example on a firewall the whole office depends on, schedule a fixed moment, such as monthly. Install critical security updates sooner. Export the configuration before an update so you can fall back if something goes wrong. That way network equipment simply becomes part of patch management, alongside Windows and your apps.

Step 3: get passwords and admin access in order

Replace default passwords with long, unique passwords stored in a shared vault in a password manager.
Use MFA on the firewall or NAS cloud portal if the manufacturer supports it.
Close off management over the internet: the management page should only be reachable from the internal network or through a secure VPN.
Turn off unused services, such as UPnP, old VPN protocols or internet folder sharing on the NAS.

Also keep guests and personal devices off the business network, as described in separating guest wifi from the business network. And make sure the NAS is not your only copy: a NAS that gets encrypted takes the files with it. Read more in backups and ransomware.

Step 4: replace old equipment in time

A device the manufacturer no longer updates stays vulnerable, however well it otherwise works. Check the manufacturer’s support page to see until when your model receives updates and put that date in your planning. Replace such a device well in advance, just as you would replace a laptop that no longer gets Windows updates. Insurers increasingly ask about this too; see the cyber insurance questionnaire.

How Floor ICT handles this

Floor ICT maps all your network equipment, stores admin credentials securely and checks which devices are still supported. We turn on automatic updates where sensible, schedule updates for firewalls and other critical devices, close off management over the internet and replace default passwords. Devices approaching the end of their support go into the replacement plan, so the comms cupboard does not stay a blind spot next to your laptops and Microsoft 365.

View MSP packages Request an intake Microsoft 365