October is Cybersecurity Awareness Month. Most of the advice you will see this month is about passwords, phishing and software updates, and all of it matters. This post is about something more physical: the network jacks on your walls, and who could plug into them.
A live jack is an open door
By default, a wired network jack does not ask who you are. If the cable behind it is connected to a switch that is turned on, a laptop plugged into that jack is on your network, possibly with the same access as the computers your staff use every day.
The National Security Agency's network infrastructure security guide, first published in 2022 and updated in 2023, puts it plainly: physical ports are often the primary means of restricting physical access to a network, and a switch port without port security could let someone with physical access connect an unauthorized system, get around existing security restrictions and probe deeper into the network.
A firewall at the edge of your network screens traffic coming in from the internet. A jack in your lobby is already behind it.
Where live jacks hide
Walk your building and look for wall plates in places where people you do not know can reach them:
- Lobbies and waiting rooms, often wired years ago for a kiosk, a printer or a reception desk that has since moved.
- Conference rooms, where visitors sit next to wall and floor jacks for an hour at a time.
- Empty offices and spare desks, with jacks that stayed live after the person left.
- Outside the building. A camera or wireless access point on an outside wall or in a parking lot is connected by a network cable. Unplug the device and that cable is a network connection outdoors.
- The network closet itself, if it is unlocked and its switches have open ports.
Step 1: know which jacks are live
A wall jack is only live if its cable is patched to a switch port, usually in a network closet. That makes the cabling the place to start. You need to know which jack goes to which patch panel port, and which of those are connected to a switch. If your jacks and patch panels are labeled, that is a quick check. If they are not, the runs have to be traced and labeled first. It is worth doing once, because every later fix depends on it.
Once you know which jacks are live, the simplest fix is to unpatch the ones nobody uses. A jack whose cable is not connected to anything cannot put anyone on your network.
Step 2: turn off switch ports that are not in use
The NSA guidance recommends disabling all unused ports on a switch and, where the switch supports it, assigning them to an unused network segment, so they still cannot reach anything if they are turned back on by mistake. It also warns to confirm a port is truly unused first, because a device that is switched off can make a port look unused.
Step 3: limit what can connect to the ports you do use
For the jacks that must stay live, the same guidance describes two options:
- 802.1X is the stronger one. It makes a device prove who it is, typically with a digital certificate, before the switch lets it on the network. The NSA calls it more robust than port security and easier to manage, though harder to set up.
- Port security is the fallback where 802.1X is not practical. It limits each switch port to a set number of devices, identified by their hardware (MAC) addresses. The NSA recommends exactly one per port, or two where VoIP phones are in use. (A common case is a computer plugged in through a desk phone.) It also notes the limits: port security can be hard to manage where devices change often, such as conference rooms, and someone who copies an allowed device's address can get around it.
Cameras deserve their own attention. Keeping them on a separate network from your office computers limits what someone could reach through a camera's cable. We covered that in Is Your Security Camera System a Back Door Into Your Network?
Who does what
Steps 2 and 3 are switch settings, which is work for whoever manages your network, usually your IT provider. Step 1 is cabling: tracing runs, labeling jacks and patch panels, unpatching what is not needed and recording what goes where. The two go together. It is much safer to turn off a port when you know what is at the other end of its cable, because a device that is switched off can make a port look unused.
A quick check for this month
- Walk your lobby, waiting room and conference rooms and note every network jack.
- Ask whether each one is needed. If nobody can say what it is for, it is a candidate to disconnect.
- Check that the network closet locks, and that it is actually locked.
- Look at the outside of the building for cameras and access points, and note where their cables run.
- Ask your IT provider whether unused switch ports are turned off.
If nobody can say what a jack is for or where it goes, that is the place to start. Our network cabling page explains the structured cabling work we do for businesses across Tampa Bay.