Network security basics every small office should have

Start at the edge

The firewall is the boundary between your office and the internet. It should be a supported model receiving security updates, with its admin page reachable only from inside the network or through a secure management service. Review every rule that allows traffic in from the internet. Old port forwards for remote desktop, cameras or a server that no longer exists are common and dangerous.

Remote desktop exposed directly to the internet deserves special mention. It is one of the most frequently attacked services, and exposed remote desktop has been a common entry point for ransomware. If staff need remote access, use a VPN with multi-factor sign-in or a zero trust access service instead. Check your firewall for it today if you are not sure.

No default passwords anywhere

Every network device ships with a default admin login, and those defaults are published online. Change them on the firewall, switches, access points, printers, cameras, UPS management cards and anything else with a login. Use a unique, long password for each device, stored in a business password manager. Also disable admin access from the guest network and the internet side of the firewall.

Where devices support it, use named admin accounts rather than one shared login, and enable multi-factor sign-in on cloud management dashboards. Those dashboards can reconfigure every device you own, so they deserve the same protection as your email admin account. Named accounts also leave a clear record of who changed what and when, which helps when tracking down a misconfiguration after the fact.

Keep everything updated

Firmware updates fix security flaws that attackers actively exploit. Set a regular schedule, monthly or quarterly, to check and apply updates for the firewall, switches and access points, with urgent patches applied sooner when a serious flaw is announced. Cloud-managed systems can often schedule updates automatically outside business hours. Take a configuration backup before each update in case you need to roll back.

Track end-of-support dates. A device that no longer receives updates will never be fixed again, and should be replaced, especially if it faces the internet. Your network documentation is the natural place to keep those dates alongside model and serial numbers. Add those dates to the business calendar so the replacement is budgeted before the deadline arrives, rather than discovered afterwards.

Wi-Fi and network separation

Use WPA2 or WPA3 encryption with a strong passphrase, or enterprise authentication where staff sign in with their own accounts, which means a departing staff member's access ends when their account is closed. Avoid sharing the staff Wi-Fi password widely and change it when people leave if you use a shared passphrase.

Separate guests, phones and smart devices from staff computers with VLANs and firewall rules. That one design choice limits the damage any single compromised device can do, and it is one of the most effective steps a small office can take. Test the separation now and then from the guest network to confirm it still holds after changes.

Control what plugs in

Unused network outlets in meeting rooms and reception areas can be switched off at the switch, so a visitor cannot plug a laptop into your internal network. Managed switches can also restrict ports to known devices. At minimum, keep the comms cupboard locked and know what is connected to every port.

DNS filtering is a simple, inexpensive layer that blocks connections to known malicious and phishing sites for every device on the network. It can be provided by the firewall or a cloud service, and it protects devices that cannot run security software, such as printers and smart TVs. It also gives useful reporting on blocked threats.

Logs and response

Logs from the firewall and other devices are only useful if someone looks at them, or if they feed a monitoring system that raises alerts. Keep them long enough to investigate an incident that is discovered weeks later. Decide in advance who will act if something suspicious appears and what the first steps are.

Network security is one part of a wider picture that includes multi-factor sign-in, device security, backups and staff awareness. The NCSC publishes practical guidance for small businesses that covers those areas too. A periodic review of the network against this list, by someone independent of the person who set it up, catches the gaps that familiarity hides.