Someone walks into your office, plugs a personal laptop into an Ethernet jack, and immediately joins the network. Convenient? Yes. Automatically safe? No.
In a small office, connecting a device may be as simple as finding an open cable. A visitor needs internet access. An employee brings a home laptop. A contractor connects equipment for a demonstration. Work gets done, but the business may have no record of what connected, whether it was approved, or what it could reach.
A useful starting question is: do we know what is connected—and do we control what it can access?
Being plugged into the office does not establish trust
A wired connection is a method of connecting, not a security approval. Without appropriate controls, an unknown device may join the same network as business computers, printers, servers, or management interfaces.
This does not automatically give it permission to open every file or administer every system. Authentication, host firewalls, application permissions, and segmentation still matter. However, placing an unmanaged device on a trusted network creates opportunities that a properly restricted guest connection should avoid.
The issue also applies to conference-room jacks, spare switch ports, docking stations, and the computer port on an office phone. A guest Wi-Fi policy does little good if an Ethernet cable provides a route into the production LAN.
Why BYOD can become a problem
Bring Your Own Device (BYOD) can be useful when it is approved and managed through a defined process. Problems arise when personal ownership becomes an exception to basic security expectations.
- Unknown security condition: IT may not know whether the operating system is supported, patched, encrypted, or protected.
- Unclear data handling: business files may be downloaded, synchronized, or backed up to personal locations.
- Shared use: a personal computer may also be used by family members or for unrelated activities.
- Limited response options: the business may lack permission or technical ability to inspect, isolate, or remove company data.
- Incomplete offboarding: disabling an account does not necessarily remove files already stored on the device.
- Unexpected network equipment: an unapproved router, access point, or small switch can change connectivity and complicate visibility.
Not every personal device is unsafe, and company ownership alone does not make a device secure. The important questions are approval, configuration, access, monitoring, and responsibility.
Publish a BYOD policy employees can understand: permitted devices and activities, enrollment or app-protection requirements, support boundaries, privacy expectations, incident procedures, and how access ends.
Asset inventory and asset management are related, but different
Inventory tells you what exists. Asset management adds ownership, approval, purpose, maintenance, and lifecycle decisions. Discovery helps find what is actually present. Network access control helps decide what may connect and where it may go.
Your purchasing spreadsheet may list 25 laptops while the network shows additional personal computers, an old NAS, printers, cameras, and a vendor appliance. Neither list alone explains which assets are approved and protected.
CIS Control 1 emphasizes actively managing enterprise assets and identifying unauthorized or unmanaged equipment. The inventory should support action, rather than simply count purchases.
What belongs in the inventory?
Include laptops, desktops, servers, virtual machines, switches, firewalls, wireless access points, printers, phones, cameras, NVRs, access-control equipment, storage devices, and relevant cloud resources. Record approved BYOD and vendor equipment according to its role and access.
A practical asset record includes:
- Asset identifier, device name, manufacturer, model, and serial number where applicable.
- Business owner, assigned user, location, and business purpose.
- Company-owned, personal, leased, or vendor-owned status.
- Approval status and lifecycle state: in service, spare, under repair, retired, or disposed.
- Network identifiers and location, such as IP address, MAC address, VLAN, and switch port when available.
- Operating system or firmware, support status, and security-management coverage.
- Relevant data access, criticality, and links to maintenance or disposal records.
- First seen, last seen, and last verified dates.
Keep passwords and recovery secrets in an appropriate secured system, rather than adding them to a general inventory. IP addresses can change, and MAC addresses can be randomized or spoofed. Use multiple identifiers and records when establishing device identity.
Tools that discover new devices and notify you
Yes—tools can detect newly observed devices and send notifications. Coverage and speed depend on network visibility, discovery methods, scan schedules, integrations, and alert settings. A newly discovered device is not necessarily a newly connected device.
| Tool | Useful role | New-device notification considerations |
|---|---|---|
| Domotz | Network discovery and operational monitoring. | Documents New Device Discovery events and configurable email, push, and shared notification channels. Confirm the event is enabled for each monitored network. |
| runZero | Discover and investigate assets and exposed services, including unmanaged equipment. | Supports alerts for new query matches using rules, alert templates, and notification channels. Establish a baseline and define the changes that matter. |
| Lansweeper | Asset discovery, inventory, and reporting. | Offers newly discovered asset reports. Configurable report alerts depend on when assets are scanned and when notifications run; they are not automatic pre-connection blocking. |
| Microsoft Defender for Endpoint device discovery | Discover unmanaged devices using supported onboarded endpoints. | The documentation applies to Plan 2. Evaluate coverage and configure the required review or alerting workflow; do not assume every new device produces an immediate notification. |
| Snipe-IT | Track asset assignments, ownership, status, and lifecycle records. | Use as an asset register, with discovery information supplied through an appropriate integration or workflow. Do not treat it as the tool enforcing LAN admission. |
| Microsoft Intune | Inventory and manage enrolled devices. | Useful for management and compliance status. Its managed-device inventory is not a complete detector for arbitrary equipment plugged into the LAN. |
Also review your existing managed switches and network controller, such as UniFi. Their client and port information can help locate devices. Verify the specific version’s notification and enforcement features before relying on them.
For Lansweeper, see the vendor’s explanation of report alerts and discovery timing. For every product, validate current licensing and the proposed deployment with a pilot.
What would BCS start with?
Our recommendation is to choose tools around the missing job:
- “Tell us when something unfamiliar appears.” Evaluate a network-monitoring tool such as Domotz, or discovery-focused tools such as runZero and Lansweeper.
- “Tell us who owns each laptop and whether it was returned.” Establish an asset register, such as Snipe-IT or an appropriate existing IT service-management system.
- “Keep approved computers configured and managed.” Review endpoint-management coverage, including Intune where appropriate.
- “Prevent unapproved devices from reaching business resources.” Plan network access control and segmentation with compatible infrastructure.
A small business may begin with a maintained register, managed-switch visibility, discovery alerts, and a properly restricted guest network. Reconcile those records with endpoint-security and management consoles. An inventory entry is not proof that a security agent is installed and reporting.
Detection does not equal prevention: consider NAC and 802.1X
Network Access Control (NAC) combines policies and enforcement to restrict network access. Wired 802.1X can require authentication through a compatible switch and authentication service before granting the intended access.
Where suitable, certificate-based device authentication can support access for approved managed devices. This requires a complete design: compatible switches, authentication services, device configuration, certificate issuance and revocation, exception handling, and a tested failure policy.
Microsoft documents deploying wired 802.1X profiles through Intune. That profile is one component; Intune enrollment by itself does not lock down an Ethernet switch port. PacketFence is one NAC option to evaluate against your equipment and support needs.
Printers, phones, cameras, and other devices may require specific exceptions. Keep those exceptions narrow and documented. MAC-based admission and switch port-security limits can be useful supporting controls, but a MAC address is not strong proof of identity or device health.
Make guest and BYOD access a real boundary
Give visitors an intentionally restricted network. If visitors need wired internet access, configure appropriate guest ports as well as guest Wi-Fi.
A separate VLAN helps define a boundary, but firewall and access rules must enforce it. Review permitted traffic between networks, management-interface access, IPv4 and IPv6 paths, and whether guests should be able to communicate with one another. Test the actual access rather than relying on a VLAN name.
Disable unused switch ports where practical, secure network closets, and review accessible jacks in public areas. Staff should know how to request temporary access instead of quietly bypassing the process.
BYOD access to business applications also needs an application and data-access plan. Cloud Conditional Access policies can help govern supported services, but they are not a substitute for wired network admission controls.
Design the alert so someone can act on it
A useful new-device alert should identify when the device was first observed, available identifiers, network or VLAN, and switch port or access point where the platform can determine it. Link it to the asset record and a ticket.
Assign someone to review it. Confirm whether the device is approved, locate its owner, assess its access, and isolate or restrict it when appropriate under your procedures. Document the decision so the same device does not remain an unexplained exception.
Account for randomized addresses, replaced network adapters, and legitimate visitors so notifications remain useful. Also monitor discovery-tool failures: a silent collector is not proof that no devices joined.
Scheduled scans can miss a device that connects briefly between scans. Passive monitoring and network events can improve visibility, but require suitable placement and configuration. Do not promise universal instant detection across every VLAN, remote site, or cloud environment.
Compliance can prompt better controls—but you can start earlier
A customer requirement, compliance project, or security incident can reveal how little a business knows about its devices. Those are strong reasons to improve, but basic asset control is useful before any of them occurs.
For SOC 2 or CMMC readiness, connect inventories and access rules to the applicable system scope, information flows, and responsibilities. Device ownership alone does not decide whether it is relevant to an assessment. Buying an inventory product or creating a VLAN does not establish compliance.
Related resources: CMMC asset categories, mobile devices and CMMC scope, and Microsoft Intune and BYOD support.
A practical starting plan
- Discover and reconcile: compare observed devices with purchasing records, cloud inventories, and endpoint-management tools.
- Assign ownership and approval: identify who is responsible and which access is permitted.
- Separate access: restrict guests, BYOD, vendors, and specialized devices according to business need.
- Configure alerts: route meaningful discoveries and changes to a named responder or ticket queue.
- Test enforcement: connect an authorized test device and verify discovery, notification, and permitted access.
- Maintain the lifecycle: update records when equipment is purchased, reassigned, repaired, retired, or disposed.
Asset and network security support in Austin and Houston
Business Communication Solutions helps businesses connect physical networking to practical security controls: switch configuration, VLANs, network documentation, discovery, endpoint management, and cybersecurity readiness. We can work with internal IT teams and existing providers to define responsibilities and close coverage gaps.
Explore our cybersecurity services and guide to cybersecurity monitoring tools.
Austin: 512-257-1433 Houston: 281-815-8784
Contact BCS to discuss asset visibility and network access.
What do you think?
If someone plugged an unfamiliar laptop into your office network today, would you know—and what could it reach? Does your business need better discovery, clearer device ownership, stronger access control, or all three?