The Internet is full of dangers, and one of the most important and commonly overlooked areas of cybersecurity is found within your router.
Small routers are often found in homes and small businesses but can also be used in more extensive corporate settings. Small routers are vulnerable to attacks, as well as being used by criminals to steal information from other devices connected to them.
Many dangers stem from leaving your router in “default” mode.
What is a small router
A router is a device that connects two or more networks. Typically, this device will ‘route’ your traffic to and from the internet, as needed/requested. For example, when you browse to a website, that request is sent through your router, to your internet provider, and to the site you want to access. The site details are returned to your browser the same way.
- Small routers are essentially SOHO (small office/home office) devices such as those provided by ISPs to residential customers. As their name implies, they’re small computers, often with limited capabilities and controls, unlike their larger-scale and more expensive enterprise-level counterparts.
- From a security standpoint, small routers share many of the same characteristics as other types of network-connected devices: They are often deployed with default settings, and no authentication enabled, they have little or no built-in security, and they’re susceptible to being hacked by bad actors looking to infiltrate a network.
- There are many examples of how vulnerable these devices are and how easily hackers can gain access to them, leaving you susceptible to everything from theft and fraud (when people use it as a proxy for their hacking activities) to identity theft (when hackers get hold of personal information and then sell it).
Routers, like other devices in your home, are not secure by default. However, they typically have some measure of built-in security that keeps unauthorized users from accessing it without a password or other credentials. This can include a simple login screen for those who know how to access it or a more complex one requiring additional credentials before granting access (such as an IP address). Regardless of the method, it is critical to change the default information immediately when it is set up.
It’s important to note that while this article focuses on small routers with limited processing power (typically found in homes), larger enterprises can also be impacted by cyberattacks, which we discuss in a separate article.
How to stay safe and protected
As we just mentioned, the first step is to secure your router from unauthorized use. The next best step is to keep your router’s firmware up to date. This can be done via your router’s management page or its app.
If your ISP provided your router, you may or may not be able to control some of those settings or upgrades. While those routing devices may provide some layer of protection and come at a low cost, you’re better off purchasing equipment you can control that offer better protection.
The best practice is to use your internet router only for your internet connection rather than directly handling all your internal traffic. Behind your internet router (or gateway), you should install a firewall. Behind that, you can install your own router. This gives you additional layers of protection beyond what your ISP can provide.
For those wanting to take further steps to limit exposure, many routers have options to limit access to specific devices of your choosing. Some also have logging and traffic management capabilities, although often only found on larger, business-class devices.
What are the risks
Since your router holds information about your network and the devices connected to it, it is critical to protect those details. Beyond containing your network credentials and identifiers, the router stores your administrative account information. While this should be unique to each device, far too many users reuse those credentials.
Once connected, all your network traffic flows through the router. For every site visited, file downloaded, or report printed, that data was processed through the router. Often there are logs of connections and usage.
Most routers today also have wireless capabilities and store all that information, as well. For these routers, you’ll want to make sure that they have the latest security and encryption features enabled.
As a critical component of your network, you’ll want to ensure that data is secured, both when in use and when replaced. If your router is no longer supported, is no longer receiving feature and security updates, or is not current on security features, it is time to replace the device with one that provides the necessary protections.
Conclusion
As you can see, the risk of having a potentially vulnerable router on your network is significant. There are many things you can do to protect yourself and your data, but it will require some work on your part. The first step would be to change the default settings and credentials.
Then ensure that any router has the latest firmware downloaded and security features enabled.
Finally, when it is time to replace your router, we recommend contacting an IT Asset Disposition (ITAD) specialist to ensure that the data stored on it is entirely inaccessible.
Small routers are an easy and inexpensive way to connect your devices to the internet, but don’t let that ease of deployment lull you into a false sense of security. As with all connected devices, care should be taken to ensure your router and all the devices behind it are protected. The steps outlined above will go a long way to keeping your network safe.
Visit sipicorp.com/itad to understand more of what an ITAD partner can offer to keep your company data secure.
