A jobsite network starts as a temporary convenience. A router goes in the trailer, a few laptops join, and soon cameras, tablets, time clocks, and subcontractors' devices are all connected. By mid-project it is a real network with real risk, yet it often has default passwords and no one responsible for it. A few deliberate steps at setup prevent most problems.
This checklist works for a trailer office or a larger multi-building project.
Before you deploy
Assign an owner
Decide who is responsible for the network at each site. This could be the project engineer, with support from IT. An unowned network is an unmanaged network.
Standardize the equipment
Use a preconfigured, tested kit rather than improvising each time. Standard kits are faster to deploy and easier to secure and support.
Router and firewall settings
- Change default administrator credentials. Use a unique, strong password stored in your password manager.
- Disable remote management from the internet. If remote administration is needed, use a secure access method with multi-factor authentication.
- Update firmware before deployment and on a schedule.
- Turn off unneeded services, such as universal plug and play and unused ports.
- Enable the firewall and block inbound connections by default.
- Enable logging and, where possible, alerts for outages.
Segment the network
A flat network where every device sees every other device is the weakest design. Create separate networks, sometimes called VLANs or separate SSIDs.
- Company network: managed laptops and tablets that access company systems.
- Guest and subcontractor network: internet access only, isolated from company devices.
- Cameras and IoT: security cameras, sensors, and time clocks, isolated from laptops.
- Equipment or control network: any machinery or telemetry, isolated and tightly restricted.
Block communication between these networks unless a specific need exists.
Wi-Fi settings
- Use modern encryption, such as WPA3 or WPA2 with a strong passphrase, and avoid open networks.
- Use different passphrases for each network, and change them when staff or subcontractors turn over.
- Name networks clearly so people connect to the right one.
- Place access points to cover work areas without broadcasting widely beyond the site fence where practical.
- Consider whether subcontractors need Wi-Fi at all, or whether a separate guest option meets their needs.
Protect the devices
Laptops and tablets on the network should be encrypted, patched, and protected by endpoint security. Require a second sign-in step for company accounts. Do not allow unknown devices on the company network. For cameras and other connected gear, change default passwords, update firmware, and avoid exposing them to the internet directly. Exposed cameras and devices are frequently found and abused.
Connect back securely
Use a VPN or a secure access service for staff reaching company servers or project systems. Avoid opening ports on the router to reach internal devices. If a site needs remote camera viewing, use the vendor's secure cloud service with strong authentication.
Plan for outages
Provide a backup link such as a second cellular carrier or satellite, and protect the equipment with a small battery backup. Document what staff should do when the connection drops, including offline access to critical plans.
Monitor during the project
- Review the list of connected devices monthly.
- Check for unusual traffic or new devices.
- Rotate passphrases after major personnel changes.
- Confirm firmware remains current.
Closeout and cleanup
When the project ends, the network is easy to forget.
- Collect all equipment and record what came back.
- Reset devices to factory settings and remove saved credentials, VPN keys, and Wi-Fi passphrases.
- Remove the site from the monitoring and management systems.
- Cancel unused service plans and SIM cards.
- Wipe and reassign laptops and tablets according to your process.
- Document lessons for the next project.
A short summary for the superintendent
Change the default passwords, keep guests and cameras off the company network, keep firmware current, use a VPN back to the office, and wipe everything at the end. Five habits cover most of the risk.
Help from Ironfield Cyber
Ironfield Cyber builds standard jobsite network kits and supports them remotely, so each project starts secure and ends clean. If you would like a checklist customized to your sites, we are glad to help.