Start with an inventory
List routers, access points, computers, servers, printers and cameras. Record an owner and update process for each. Review internet-facing services and remove obsolete port forwarding.
Separate devices and access
Visitors usually need internet access, not company files. Permit only justified traffic between network segments. A camera should not automatically reach the document server. VLANs need firewall rules to provide meaningful isolation.
Maintain Wi-Fi and edge devices
Use supported Wi-Fi encryption, prefer WPA3 where compatible and choose a secure WPA2-AES configuration when needed. Disable unnecessary WPS, replace default administrator credentials and keep firmware supported and updated.
Control remote access
Avoid exposing remote desktop directly to the internet. Use managed remote access with MFA, restricted permissions and updated gateways and endpoints. Give suppliers time-limited access and revoke it when their work ends.
See also: VLAN best practices.