Effective network security for your business rests on three pillars. A firewall and access control determine who and what is allowed on the network. Segmentation ensures that one infected device does not immediately affect everything, and managed access ensures that only the right people, using strong authentication, can reach the systems they need.
Your business network's firewall is the gatekeeper between the inside and the outside. The firewall determines which traffic is allowed in and out of the network. A next-generation firewall (NGFW) looks beyond ports and IP addresses. This type of firewall recognizes applications and can block them, but can also stop malware and other threats.
However, a firewall is only as good as its rules. The classic example is an "allow all" rule. We once had to assess a client's firewall where all network traffic was ultimately allowed to go anywhere because there was a rule in place that allowed everything.
Network Access Control (NAC) manages what happens inside. Walk through your own building and count the network ports in the wall: the meeting room, the reception, that empty desk by the window. Without NAC, every device you plug in gets access to the network. With NAC, every device is checked first, whether it connects via cable or Wi-Fi. A known company laptop with current updates is allowed on the business network. A visitor's laptop gets no further than the guest network, or nowhere at all.
In 2017, hackers broke into an American casino via an aquarium thermometer that was connected directly to the internet. From there, they reached the database containing the details of the biggest players. The thermometer was simply on the same network as everything else.
That is why the NCSC advises dividing your network into multiple (virtual) zones. If one device becomes infected, the damage remains limited to that zone. Think of separate segments for:
The IoT (Internet of Things) zone, in particular, is often forgotten. These devices rarely receive updates and often run on default settings for years. (That smart coffee machine in the canteen counts too.)
Someone in administration does not need administrator rights on the server. Yet, in many small organizations, we often see that everyone has too many permissions. This is because it was once convenient for installing a printer. The principle of least privilege is all about this: everyone is granted access only to the systems and data necessary for their work. Administrative rights should belong to a separate account used exclusively for management tasks, not the account you use for email and browsing the internet.
In addition, enable multi-factor authentication (MFA) on everything accessible from the outside: email, VPN, cloud environments, and the management interfaces of your network equipment. A leaked password will no longer be enough to get in.
But you might wonder, what does this have to do with network security? If your employees' accounts are well-protected, you are also directly protecting your network and the devices connected to it. The principles above ensure that not everyone can access everything. This prevents errors and potentially a hacking attempt as well.
Oh, and be sure to regularly check who has access. Former employees and ex-suppliers with active accounts are more common than you might think.
Zero-days make the news. In practice, an attacker is much more likely to get in through something that has been misconfigured for years and that no one notices anymore. Four mistakes keep recurring.
Network equipment lasts a long time. Sometimes too long. As soon as a manufacturer declares a device end-of-life, security updates stop, and known vulnerabilities remain open forever.
The FBI warned in May 2025 that criminals were hijacking outdated routers from brands like Linksys and Cisco on a large scale. These routers were resold as anonymous proxies, allowing other criminals to route their attacks through someone else's internet connection. Devices with remote management enabled were the primary targets.
Supported equipment is no guarantee either. The same Verizon report shows that only 54% of vulnerabilities in edge devices (devices directly connected to the internet) were fully patched, and that it took a median of 32 days to do so.
The studies above make two things very clear.
"admin/admin" on the switch. A Wi-Fi password that hasn't been changed since the move in 2019. A shared administrator password that five former employees still know.
The default passwords for network equipment are right there in the manual, and that manual is online. We recommend random passwords of at least 16 characters. This is easy to manage with a password manager, and MFA will catch anything that still goes wrong. Check out the blog if you want to learn more about managing passwords securely and how a password manager helps with that.
A flat network has no segmentation: everything is on the same network, and every device can reach every other device. That’s easy for the administrator. It’s also easy for a hacker.
Suppose an employee clicks the wrong link in a phishing email on a Monday morning and downloads malware. The attacker then has control of one laptop, and in a flat network, that’s enough. From there, the hacker can look around at their leisure, find the file server, and collect passwords from administrator accounts. This can take days or weeks because there are no boundaries to trigger an alarm. You wouldn't let your neighbors wander freely around your house, so you shouldn't want that for your corporate network either.
Factory settings are intended to reset a device and get it working again. Security is only considered when someone takes the time to adjust them, and in practice, that happens too rarely. Examples we see regularly:
Individually, these are small things. Together, they make it very easy for an attacker.
In the past, the corporate network ended at the office front door. Now, half your team works from home on Tuesdays, and your most important applications are in the cloud. The network you need to secure has grown beyond your own premises.
A VPN creates an encrypted tunnel between the employee's laptop and the corporate network. No one can intercept what is transmitted over a coffee shop's Wi-Fi or a home router.
Two caveats. The VPN server itself is an edge device and is exactly the kind of equipment attackers love to gain access to. Patch it quickly and always secure it with MFA. This applies even if your VPN server is your firewall. Also, a VPN that grants access to the entire network after logging in effectively undoes your segmentation. Therefore, only give remote workers access to the specific parts of the network they need for their work.
If you want to take it a step further, look into Zero Trust Network Access (ZTNA). With this approach, a user is granted access to one specific application instead of the entire network, and every connection is verified to ensure that users and devices are trustworthy.
A managed company laptop should ideally have an up-to-date virus scanner, encrypted storage, centrally managed updates, and endpoint detection and response (EDR) that forwards alerts. You know nothing about the personal laptop the kids use for gaming in the evening. That is why personal devices should not be connected directly to your company network.
If you do want to allow personal devices (Bring Your Own Device/BYOD), define what is and isn't permitted. For example, restrict personal devices to webmail and cloud applications within a secure environment. Use mobile device management (MDM) or a compliance check to ensure a device meets minimum requirements before it is granted access.
Most IT security for SMEs is focused on keeping intruders out. This is necessary, and everything mentioned above reduces the chance of an attacker getting in. But if they do succeed, you want to know about it—and as quickly as possible.
Friday night, 11:45 PM. Your finance employee's account starts copying files from the file server to an unknown address abroad. The firewall logs it perfectly. Monday morning at nine o'clock, someone sees the alert. Or maybe they don't.
Managed Detection and Response (MDR) fills exactly that gap. An external security team monitors your endpoints, cloud environment, and network 24/7, assesses every alert, and intervenes in the event of a real threat. In the example above, that team would have blocked the account and isolated the laptop that very same night.
Network Detection and Response (NDR) looks specifically at network traffic itself. This allows you to see what remains invisible on an endpoint: a printer suddenly trying to contact a server abroad, or a device without security software that starts scanning the network. The combination of MDR and NDR is therefore very powerful.
Network equipment ages, firewall rules pile up, and employees come and go. The IT security of your network only remains at a high level if you schedule regular maintenance:
That last point is the one most often skipped, even though it usually yields the most value. Someone from the outside sees exactly the things that no one internally notices anymore because they have "always been that way."
