Network security for small business: separation, router settings, and quarterly checks

For twenty years the small business network was the security boundary: inside was trusted, outside was not, and the firewall was the wall. That model is gone. The data lives in other people's data centers, half the staff work from home, and the office network is now a room full of devices that mostly talk to the internet.

That does not make network security irrelevant. It changes what it is for.

The office network's job today is to stop one compromised thing from reaching everything else. Keep devices that cannot defend themselves away from the ones that hold value. Do not hand out a way in from outside. You can do this with equipment you probably already own.

What to take away

Planning: decide what is being separated from what

Before touching a configuration screen, sketch what is actually on the network. Most small offices, once listed, have four groups that should not be able to reach each other freely.

Work devices: the laptops and desktops staff use, which need broad internet access and access to a small number of internal resources.

Devices that cannot defend themselves: cameras, door controllers, printers, smart plugs, televisions, building systems. These run software that is often updated rarely or never, frequently ship with default credentials, and are the classic route from "someone got into the network" to "someone stayed in the network for months". They almost never need to reach a work laptop.

Payment and point-of-sale equipment, where separation is usually a contractual expectation as well as a good idea. What your card processor requires of you specifically is a question to put to them in writing.

Guests: visitors, customers, and personal phones, which need internet and nothing else.

The plan is simply a decision about which of those groups may initiate a connection to which others. Write it as a short list of sentences before you write it as firewall rules; the sentences will survive a change of hardware.

Execution: the things that are worth doing

Treat the router as a computer, because it is one. It runs an operating system with vulnerabilities and it needs updates like anything else. Find out how it receives firmware updates, whether that is automatic, and whether the model is still supported by its manufacturer. A router past end of support is a permanent open weakness at the exact point where all your traffic passes, and replacing it is cheap relative to what it protects. Change the default administrator password, and note that on many devices the wifi password and the admin password are separate things.

Do not expose the management interface to the internet. Remote administration, remote access to the web console, and cloud management features are convenience settings that turn your router into an internet-facing login. Disable remote management. If you need remote administration, reach it through a VPN into the network rather than exposing it directly.

Audit the port-forwarding table. Open a browser, look at the forwarding or virtual-server list on your router, and account for every entry. In practice these accumulate: a rule added for a camera system in 2019, one for a supplier who needed to reach a machine once, one for remote desktop that somebody set up during a lockdown and never removed. Any entry nobody can explain should be removed. Exposed remote desktop is a particularly bad idea and should be replaced with a VPN or an identity-aware access service.

Separate the groups you listed. Most business-grade routers and many consumer ones support multiple networks: a guest network at minimum, VLANs on better equipment. Put the guest network on genuine client isolation so that guest devices cannot see each other or anything else. Put cameras, printers, and building equipment on their own network with no path to work devices. This one change converts a compromised camera from a foothold into a nuisance.

Get the wireless basics right. Use WPA3 where every device supports it and WPA2 where they do not, with a long random passphrase. Turn off WPS. The awkward truth about a shared wifi password is that it cannot be revoked for one person: when someone leaves, everybody who ever had it still has it, including the contractor from two years ago sitting in the car park. Either change it on departures and accept the disruption, or move staff wifi to per-user authentication, which is the version that actually scales.

Choose one way in from outside and close the others. A single VPN or identity-aware access path, with multi-factor authentication on it, beats an assortment of forwarded ports and remote desktop tools. Whatever you choose becomes a critical login, so protect it the way the guide to identity and access describes.

Filter DNS. Pointing your network at a filtering resolver blocks a category of known-bad destinations before a connection is made, works for every device on the network including the ones you cannot install software on, and takes minutes to configure. It is not a strong control on its own, but it is one of the highest-value fifteen minutes available.

Do not confuse a VPN service with network security. A consumer VPN subscription hides traffic from the local network operator. It does not protect a device, does not authenticate anyone, and does not segment anything. The VPN that matters here is the one that provides authenticated access into your own network.

Measurement: what to check, and how often

The reason network configuration decays is that nothing prompts anyone to look at it. A short recurring check fixes that.

Two of these deserve a note. To test guest isolation, connect a phone to the guest network and try to open the printer's page. An untested isolation setting is a claim, not a control.

"Nothing nobody can identify" is a useful discipline. An unexplained device is either a security problem or an inventory gap, and both are worth closing.

Logging you will actually read

Firewalls and access points can generate enormous volumes of logs that nobody looks at, which is a cost with no benefit. Be realistic: capture what would help after an incident, and set alerts only on things you would act on.

Worth keeping if you can: connection logs from the internet-facing device, VPN or remote access authentication events, and administrative changes to network equipment. Worth alerting on: a successful login to the router's admin interface, a change to firewall rules, and remote access from an unexpected country if your service can express that.

Check how long your equipment retains logs by default. It is often shorter than the time it typically takes to notice a problem, which means the record is gone before anyone goes looking. If the retention is measured in hours, forwarding logs somewhere with more space is worth arranging before you need them.

Where network work fits against everything else

If your budget and attention are limited, this is not the first place to spend them. Multi-factor authentication on email, a working backup with an offline copy, and patched laptops prevent more damage per hour than network segmentation. That is because most incidents now arrive through an account rather than the wire.

The first hour of a bad day is covered in incident response.

Network security limits how far a problem spreads when other controls fail. It also stops the unpatchable machine, the camera system, and the old point-of-sale terminal from becoming everybody's problem.

Plan it once, execute it in an afternoon, and measure it quarterly.

The United States Federal Trade Commission publishes general data security guidance for businesses that is free to read. Requirements specific to your industry, your card processor, or your jurisdiction should come from those parties directly rather than from a general article.

Common questions

Do we need business-grade equipment, or will the provider's router do?

Do everything the existing box can do first: guest isolation, an empty inbound list, remote management off, current firmware, filtered name resolution. Where it cannot give printers and cameras their own network, that is the specific gap worth spending on, and it is usually the only one.

Is a guest network on its own enough separation?

It handles visitors and personal phones. It does nothing about the printer, the camera and the building system sitting alongside your laptops, which is the separation that changes what a bad day can reach.

Most of our people work from home. Does the office network still matter?

Less than it did, and it still holds the devices that cannot defend themselves. The work shifts toward the laptops themselves, which is the ground covered in endpoint security, and toward protecting the accounts rather than the building.

How often should the forwarding list be checked?

Quarterly, and after anyone leaves or any supplier connection ends. Entries accumulate because each one solved a real problem years ago, and the person who could explain it has usually gone.

Would better network equipment have stopped the message that started our last bad week?

Almost certainly not. Most of what reaches a small business arrives through the mail and through a valid login, which is the ground covered in phishing defense. The network's job is to limit where an intruder can go afterwards.

What single change is worth the most?

Put the unattended devices on their own network, with no route to work machines. It takes an evening, costs nothing on capable equipment, and turns a compromised camera from a foothold into a nuisance.

The United Kingdom National Cyber Security Centre's guidance on preventing lateral movement explains why that change matters more than the rest. The ordering against everything else is in security foundations.