Key points
- Persistent connectivity fundamentally expands the attack surface by providing threat actors with extended windows to exploit vulnerabilities and move laterally across the network.
- Effective governance requires a transition from static device inventory to active interaction management, focusing on how devices communicate and which network services they access.
- Comprehensive visibility is essential, meaning all endpoints, including unmanaged IoT and smart devices, must be cataloged and monitored for anomalous behavior to prevent blind spots.
- Organizations should establish clear ownership and accountability by assigning specific personnel to oversee different device classes, locations, or operational functions.
- Implementing network segregation or physically disconnecting non-essential connectivity for legacy systems are effective methods for protecting mission-critical assets that lack modern security support.
- Unified, cloud-based management platforms are necessary to automate patching and maintain consistent security oversight across diverse and geographically dispersed IT environments.
Always-connected devices are ubiquitous in modern business IT environments: from always-on workstations crunching workloads, and standard hardware like network printers, to persistently-connected EPOS devices and the continued pervasiveness of IoT (internet of things) – offices and worksites are hyperconnected environments. Mobile devices, too, are always on, presenting moving governance and security risks.
This guide explains how devices that are always on and always connected to your network introduce operational risks that require changes to how you plan and enact IT governance in your organization.
Why persistent network and internet connectivity change the nature of risk
Persistent connectivity is not a new element in IT ops: always-on devices have always existed in office environments, such as printers, servers, and network equipment. However, these devices were largely static endpoints with predictable use-cases. Smart devices, IoT, and the changing way workloads run on devices such as phones, tablets, and workstations mean that the traditional assumptions made about device ownership, boundaries, and control are no longer pertinent.
When a device is constantly connected to your network and/or the internet, it is exposed to threats beyond simple physical access. Malware that allows remote access and vulnerabilities caused by misconfiguration can be more easily exploited, allowing attackers extended time windows to access, control, and exploit devices unnoticed. Always-connected smart devices can act as proxies to further intrusion into your IT infrastructure, or be used as part of DDoS attacks on other parties. The longer a device is online, the more time there is for flaws to be found, data to be transferred, or your data to be encrypted for ransom.
These concerns are amplified across connected sites, turning per-device or localized issues into systemic threats.
There are more always-connected devices in your organization than you think
Devices that maintain a constant network or internet connection often now outnumber traditional devices that are sporadically online (i.e., workstations that are shut down at the end of the day, or laptops that are closed and disconnected when tucked in your bag):
- Phones and tablets: Phones and tablets are always connected, to either office Wi-Fi when it’s in range, or to the internet via cellular connections.
- Laptops and workstations: Increasingly, closed laptops maintain network connections while in low power modes to receive notifications and updates. Desktop workstations are also increasingly left powered on for tasks like transcoding media, uploading files, or running AI workloads.
- Smart devices and IoT: Smart TVs, smart fridges, and other appliances that are large enough to house an extra touch screen all maintain persistent connections. IoT devices like temperature sensors and health devices are also usually always-online.
- CCTV, EPOS, healthcare, and industrial: CCTV is always online, and also presents privacy risks if compromised. Point-of-Sales devices (including payment terminals and receipt printers), healthcare devices, and industrial equipment and digital control systems may also remain connected as the devices they run are part of long-lived processes.
- Printers, servers, and other traditional office IT equipment: Always-connected devices are not a new thing, and they add to the plethora of printers, servers, and other standard office hardware.
From device management to interaction management
Maintaining an up-to-date catalog of all connected devices is the first step to effectively governing them. IT asset management and documentation platforms serve this purpose.
The nature of these devices can then be documented: How they connect, what network services they use, and the external servers they connect to, and their expected usage patterns. Their patch status can also be tracked, ensuring they all have critical security updates installed to reduce the risk of them becoming an attack vector.
Firewalls and network segregation can then be introduced to mitigate the risk that different classes of devices present, while network monitoring tools can be used to assess how these devices interact – and automatically alert technicians on anomalous or suspicious activity.
The visibility challenges of hyperconnected environments
Cataloging devices does not solve the governance concerns of hyperconnected environments and is only a step on the path to effective oversight of growing IT ecosystems.
Not all connected devices support central management, but this does not mean that they become blind spots by default: network monitoring tools can be used to ensure they remain visible and that they are interacting with other infrastructure and otherwise behaving as expected. Unmanaged devices that are not documented and monitored silently accumulate risk.
Governance implications of persistent connectivity
Ownership is also key to the successful governance of modern IT environments. Engineers should be assigned responsibility for locations, classes of devices, or devices for specific purposes. This responsibility should also be recorded in documentation so that the escalations reach the right person as quickly as possible.
Policies should also reflect the nature of devices and how they are connected: always-connected devices can fall into any number of different device categories, and policies must reflect not just how they are connected, but how they are used.
Always-on connectivity and operational resilience
Modern business, healthcare, and industrial operations benefit greatly from the diverse array of devices available to them. Many of these devices become the linchpin of operations, often without being noticed. These devices need to be proactively identified, and network coverage and reliability for these workhorses must be maintained so that business operations are not disrupted. The proliferation of connected devices can also place additional strain on networks that should be detected early to ensure capacity always meets demand.
These factors are especially important for managed service providers (MSPs), who may not be on-site regularly to identify the importance of devices to certain workflows. Regular consultation and reviews with clients help avoid these oversights.
Common failure patterns to evaluate for always-connected devices
Treating devices as isolated assets ignores the primary threat to their operation and security: network connectivity and your overall security posture. Network monitoring, failover measures, and regularly checking network capacity actively work to prevent this, rather than assuming devices are connected and functioning.
Lack of ownership and oversight leads to devices silently accumulating risk from cybersecurity vulnerabilities, configuration drift, or mismanagement. Visibility must be established over all network-connected devices, not just traditional static endpoints.
Relying on outdated security models is also a common failure pattern that should be avoided. The modern IT landscape can change rapidly, with devices performing changing tasks and connecting to an ever-changing set of cloud services. Interactions should be monitored and secured in addition to the devices themselves.
The often-overlooked fix for outdated always-on devices: Unplug them
It’s also worth noting that not all always-connected devices need to be: many mission-critical devices that no longer receive vendor support remain in use for decades, often without ever being powered down. They are simply unplugged from the network and remain in local use (for example, the control computer for a laser cutting machine), or if remote services are required (like needing to access images from an MRI scanner from another PC), limited to talking to only specific devices over specific ports/protocols, with additional monitoring.
This is an effective method if implemented properly and, importantly, documented. Documenting and periodically reviewing prevent always-offline devices and devices with special exceptions ensures they don’t fall out of governance oversight.
NinjaOne provides a comprehensive toolchain for maintaining visibility over your entire IT infrastructure
Every device in your organization needs governance, management, and protection. Whether an end-user device is connected for moments or months, it can pose a risk if it is not patched, monitored, and responsibly used.
Always-connected devices and IoT amplify IT risks and require additional governance measures to ensure they are properly maintained and secured. Your IT infrastructure itself can also be a vector for cybersecurity breaches. IT management tools must be resilient, ideally through a managed service that is insulated from issues and can maintain continual oversight over endpoints across geographic locations.
NinjaOne provides combined mobile device management (MDM), remote monitoring and management (RMM), and endpoint protection, all through a single web interface. Monitor always-connected devices in a single office, across global worksites, or for multiple MSP clients – leveraging automation to detect anomalies and automatically mitigate, alert, and escalate. NinjaOne is compliant and runs in the cloud, so your technicians can maintain visibility over devices, and help users, wherever they are connected.
