Network hygiene for small business: exposed devices checklist

Key takeaways

• “Exposed” means a service on one of your devices answers a connection from the public internet. Most small business exposure comes from a router rule, not from the device itself.
• Work in a fixed order: your public IP, the router, remote access, file sharing, then cameras and IoT devices.
• AdminKit’s free port check tests nine common TCP ports on your own public IP. RDP (3389) and SMB (445) need a short manual check.
• Write each result down with a date. A checklist you repeat is worth more than one perfect scan.

What is network hygiene for a small business?

Network hygiene is the routine upkeep that keeps a network in a known, tidy state: knowing what is connected, what can be reached from outside, and removing what should not be there. For a small business without a full-time IT team, the most useful part is the outside view. Which of your devices can someone on the internet connect to right now?

This guide is part of AdminKit’s machine protocols cluster, which covers device and protocol exposure. The NIST Cybersecurity Framework 2.0 puts asset management (knowing what you have) under its Identify function for the same reason: you cannot protect a device you do not know is reachable.

What does “exposed” mean for each device class?

A port is a numbered door on a device, used by one network service. IANA’s port number registry records which service each well-known port is assigned to. A port is “exposed” when that door answers from the public internet. The table shows what that means in practice for the device classes most small offices have.

Device class	Common ports	What “exposed” means	How to check
Router or gateway	23, 80, 443, 8080, 7547	Its admin login, Telnet shell or ISP management service (TR-069) answers from outside	Port check
Windows PC or server with remote desktop	3389	Anyone can reach the Windows login screen and try passwords	Manual check, see is port 3389 (RDP) exposed?
File server, NAS or shared PC	445	Shared folders can be requested from the internet	Manual check, see is port 445 (SMB) exposed?
IP camera or video recorder	554, 80, 8080	The live video stream or the recorder’s web console is reachable	Port check, then is port 554 (RTSP) exposed?
IoT hub, sensor gateway or smart building device	1883, 8883, 502	A message broker or controller accepts connections from anyone	Port check, then is port 1883 (MQTT) open?

In which order should you check?

Order matters because each step narrows the next one. Work through these steps from top to bottom.

1. Confirm your public IP. Open what is my IP from each office or internet connection. That address is what the internet sees, and what every later check tests. If it is shared with other customers (CGNAT), note that; inbound exposure works differently there.
2. Run the port check. Run AdminKit’s open ports check from the same connection. It tests nine TCP ports often left open on routers, cameras and IoT devices, and reports each as open or closed/filtered.
3. Review the router. Log in to the router and list every port forwarding rule and every UPnP mapping. UPnP lets devices on the LAN open ports on the router by themselves, so a camera or game console can create exposure nobody asked for. Remove rules you cannot explain. While you are there, check the DNS server setting has not been changed: see is my router’s DNS hijacked? and the DNS resolver test.
4. Check remote access. Confirm port 3389 is closed from outside. If staff need remote desktop, put it behind a VPN instead of forwarding the port.
5. Check file sharing. Confirm port 445 is closed from outside. File sharing was designed for a trusted local network, not the internet.
6. Check cameras, recorders and IoT devices. Match any open port from step 2 to a device using the table above, then follow that port’s guide.
7. Record and repeat. Write down the date, the IP, the open ports and what you changed. Re-run after any network change.

How do you check ports the port check does not cover?

Ports 3389 and 445 are not on the port check’s list. To test them, run a TCP check from a machine outside your network (a phone hotspot works), against your own public IP:

nc -vz -w 3 203.0.113.5 3389
nc -vz -w 3 203.0.113.5 445

Replace 203.0.113.5 (a documentation address) with your own public IP. A succeeded or open line means the port answers from the internet. A timeout or refused means it is closed or filtered from that location. Running the command from inside your own office can give a misleading answer, because many routers handle traffic to their own public address differently.

Why do remote desktop and file sharing come before cameras?

Because attackers use them most for getting in. The joint CISA, FBI and partner advisory AA22-137A lists remote services such as RDP exposed to the internet among the weak controls routinely exploited for initial access. Cameras and IoT devices still matter, but a reachable Windows login or file share is usually the faster path into business data.

Device age matters too. CISA’s Known Exploited Vulnerabilities catalog lists flaws that have been used in real attacks, and it includes routers, cameras and storage devices. An exposed device running old firmware is the case to fix first.

What should you do when you find an exposed device?

• Close it if nobody needs it from outside. Delete the port-forward rule, turn off UPnP if no device needs it, and disable remote management on the router’s WAN side.
• Move it behind a VPN if someone does need it. Staff connect to the VPN first, then reach the device on the local network.
• Update the firmware and change any default password, even after the port is closed.
• Re-run the check from outside to confirm the change worked, and record the result.

Defensive use only

This checklist is for networks you own or are responsible for. AdminKit’s port check only tests the address your own request comes from. Do not run the manual commands above against addresses that are not yours.

Next step

Start with the AdminKit tools hub and run the free open ports check from each office connection. Then follow the order above. To turn repeated checks into a record per site, see using port check to inventory IoT device exposure.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.