Practical Network Security Steps for Growing Businesses

Segmenting the network, controlling who plugs into it and keeping firmware current will do more for most businesses than any single product purchase.

Security spending tends to follow whatever was in the news. For most growing businesses, a handful of unglamorous fundamentals will prevent more incidents than any single product purchase.

Know what is on the network

You cannot protect equipment you do not know about. A current inventory of devices — including printers, cameras, recorders, access controllers and anything else with an address — is the foundation. These devices are frequently installed once and never revisited, which is precisely why they are worth listing.

Segment it

A flat network means anything that reaches one device can reach all of them. Separating guest access, staff devices, servers and building systems such as surveillance and access control into their own segments limits how far a problem can travel. It also makes traffic easier to reason about when something looks wrong.

Fundamentals worth doing first

• Change default credentials on every device, including the ones nobody logs into.
• Keep firmware current on switches, access points, firewalls and cameras — not only on servers and desktops.
• Control physical ports. An unused, live network socket in a public area is an open door.
• Separate administrative accounts from everyday accounts, and remove leavers promptly.
• Back up, and test restoring. A backup that has never been restored is an assumption.
• Turn on logging and make sure somebody would notice an alert.

Most incidents exploit something ordinary that was left as it was installed.

Remote access deserves deliberate design

Remote working and remote support are both normal now, and both are frequently arranged in a hurry. Decide how people connect, require a second factor, and review who still has access every few months. Temporary arrangements made during an urgent situation have a way of becoming permanent.

Write down what happens next

A short, plain document covering who is called, what is isolated first and where the backups are is worth more during an incident than any amount of technology. It takes an afternoon to write and is only ever needed on the worst day.