Connected devices and ransomware: reduce exposure before an incident

The direct answer

Connected cameras, printers and other devices belong in your security inventory. Their reputation impact may come through service interruption or exposed information, so assign responsibility before a problem occurs.

Know which devices the business relies on

Record device purpose, owner, location, administrator and update source. Include equipment installed by vendors, not only laptops. Identify what would stop working if a device became unavailable and whether it stores sensitive information. Avoid guessing that an unfamiliar device is malicious; verify it with the responsible technical team.

Apply basic controls with authorized support

CISA’s connected-device guidance recommends keeping software updated, while its ransomware guidance emphasizes reducing exposure and maintaining defenses. Have qualified staff review unnecessary internet access, credentials and supported software. Test important changes rather than making ad hoc adjustments to equipment used for safety or critical operations.

Identify unsupported devices and a replacement owner.
Review who can administer each device.
Keep recovery instructions and business contacts available offline.

Prepare the response handoff

Suppose a network printer stops working and displays an unusual demand. Record what was observed and contact the designated technical responder. Do not promise customers that no information was affected before investigation. Keep the operational response separate from public messaging, with a shared record of confirmed impact, actions underway and the next update.

Frequently asked questions

Is every device outage ransomware?

No. Hardware failure, configuration errors and service interruptions are also possible. Report observations and let qualified responders determine the cause.

Will an online reputation service secure the devices?

Do not assume that. Technical security assessment and recovery require an explicit scope and competent specialists; communication support is a separate task.

Continue with your next step

Connected-device incidents and public communication Doxxing response: reduce exposure and preserve evidence Cyber resilience and customer trust after an incident More on this topic All guides

Sources and policies

Check the current policy before submitting a request.

You do not have to figure out the next step alone.

Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.

Request a confidential review Or call (307) 429-2531

Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.