Free course · Module 2 · Lesson 3 of 4
What's plugged in
What you'll decide
Every device that touches your business, whether a stranger on the internet can reach each one, and whether each one still gets updates.
Lesson 2 was about software that runs on somebody else's computers. This one is about the computers in your building: the ones you own, the ones staff bring in, and the ones a vendor installed and never mentioned again.
Plain-English terms
Device. Anything with a network connection: computers, phones, printers, the router, cameras, card terminals, smart TVs, the server in the closet.
Router. The box your internet comes through. Everything in the building sits behind it. It's also the one device that is, by design, reachable from the internet.
An opened door. A router setting that lets the internet reach one specific device inside, usually so someone can connect from home or view cameras from a phone. Your IT provider may call it port forwarding or remote access. Every opened door is a Module 1 Question 2 "yes".
End of support. The maker has stopped releasing security updates for it. Windows 10 reached that point in October 2025, unless you pay for extended updates. Old cameras, routers and card terminals get there quietly.
Personal device. A phone or laptop the business doesn't own but that has work email or apps on it.
More is plugged in than you think
Computers and laptops
The ones your IT provider knows about, plus the old one under the counter that runs one program.
Phones and tablets
Including personal phones with work email on them. You can't inventory the phone, but you can list who has work email on a personal device.
Printers and scanners
They have a settings page, a hard drive full of scanned documents, and they almost never get updated.
The router and Wi-Fi
The one device meant to face the internet. Its settings page should not be reachable from outside, and it should not still have the factory password.
Cameras, alarms, door systems
Installed by a vendor, viewed from a phone, and often reachable from the internet through an opened door. A favorite target.
Card terminals and point of sale
Usually connected through your card processor. Ask whether it's reachable from outside and whether it's still supported.
The box in the closet
A server, a backup drive, or an old PC running the one program the business can't do without. Often out of support, often forgotten.
Two questions per device
You already know the first one from Module 1. Can a stranger on the internet reach it? For most devices behind the router the honest answer is no, unless someone opened a door for it. The devices that most often have a door: the camera system, anything staff connect to from home, and the router's own settings page.
Your router keeps a list of every device connected to it, and it knows which doors are open. You don't need to read it yourself. Ask your IT provider one question and write down the answer: Which of our devices can be reached from outside the building, and why? If they can't answer, that is itself an answer.
The second question is new. Does it still get updates, and are they automatic? A device the maker has stopped supporting can't be fixed, only replaced or walled off. Module 1 covered what to do with those: a written exception with an end date.
Personal phones
Half your staff read work email on their own phones. You can't list the phone, and you shouldn't try to manage it. List the fact instead: a row that says who has work email on a personal device. Then the rule is short: a screen lock, find-my-device turned on, and the ability to remove work email from the phone if it's lost or the person leaves. Microsoft 365 and Google Workspace can both do that last part without touching anything personal on the phone.
Scenario
Can a stranger on the internet reach it?
For each device, pick the most likely answer, then check the reasoning.
1The camera system you check from your phone when you're away.
Show the answer
Yes. If you can reach it from outside, so can anyone who guesses or finds the password. Either the vendor opened a door on your router for it, or it connects out to the vendor's service. Ask which. If it's a door, make sure the camera login isn't the factory one, and ask whether the vendor's app can work without the door.
2The office printer.
Show the answer
No, not directly. It sits behind the router with no reason for a door. It still needs to be on the list: it has a settings page with a default password and a drive full of scans, and it's a Box 4 or Box 3 item that gets updated on the normal schedule.
3The router itself.
Show the answer
Ask. The router is reachable from the internet by design, but its settings page shouldn't be. Some routers ship with remote management switched on. Ask your IT provider to confirm it's off and the factory password is changed. This is a Module 1 Box 1 item if either is wrong.
4The old server that lets two staff connect to their desktops from home.
Show the answer
Yes. That's exactly what an opened door is for. It's also the kind of thing on the CISA KEV list most often. It needs to be current, have two-step login, and be on your top systems list. If nobody has used it in months, close the door.
5The card terminal.
Show the answer
Ask. Most terminals connect out to the card processor and aren't reachable from outside, but not all, and older ones vary. Your card processor can tell you, and they can also tell you whether it's still supported. An unsupported terminal is a Module 1 exception waiting to be written.
6The smart TV in the meeting room.
Show the answer
No, not directly. But it's on your Wi-Fi, it runs software that rarely gets updated, and it can see everything else on the same network. Put it on the list, and ask your IT provider whether it and the cameras can go on a separate guest network. That one change limits what any of them can reach.
0 of 6 sorted
Remember
- Everything with a network connection goes on the list, including the box in the closet and the fact that staff read work email on personal phones.
- Two questions per device: can a stranger reach it, and does it still get updates. Your IT provider can answer both from the router.
- Cameras, remote access and the router's own settings page are where opened doors usually are.
Build your file
Tab 3: Devices
Open the Devices tab. Add one row per device, using the seven kinds above as a checklist so you don't miss the odd ones. For each: type, who uses it, whether a stranger can reach it (yes, no, or don't know), whether updates are automatic, whether it's still supported, and what protection it has. Leave the Level column for Lesson 4.
Write "Don't know" honestly where you don't know. Then send your IT provider the list and the one question: which of these can be reached from outside, and why? Their answer fills the column.
The Read me tab counts devices reachable from the internet and devices out of support. Those two numbers are your first conversation with your IT provider.
Where this goes next
Steps 3, 8, 10 and 12 of the Security Starter are the device basics this tab checks: automatic updates, protection on every computer, the Wi-Fi locked down, find-my-device on. In the VM Program Kit, the same inventory feeds the exposure factor in the Prioritization Model.