Office network security in five rungs, each with a check that proves it

Not every business needs a security appliance in a cupboard. Some need nothing beyond what they already own, configured properly. Some need one subscription. Some are better off with no office network, in the sense that matters.

This is a ladder of small office network security by effort and commitment, from configuring the router you own to trusting no office network at all. Each rung shows what kind of measure it is, what it leaves open, and one practical check you can run yourself to tell whether it is enough.

The rungs describe kinds of measures, not products. The check at the end of each rung is the part to keep: it works whichever router, service or provider you end up with.

What to take away

Rung one: nothing to spend

You have a router the internet provider supplied or a consumer model bought some years ago.

What it can usually do: a guest network with isolation, a changed administrator password, remote management switched off, firmware updated, the inbound forwarding list emptied, and name filtering by pointing the router at a filtering resolver. That list is most of network security, and it costs an evening.

What it leaves open: no separate segment for printers and cameras, no per-user wireless, no useful logs, and a box that may already be out of support.

The check: can a phone on the guest network open the printer's page? If it can, the isolation is not on. And is the model still receiving updates? If not, the next rung is not optional.

Rung two: an afternoon and a modest piece of hardware

A business-grade router or a small managed switch that supports separate networks, bought once, with no subscription.

What it adds: a real device segment for the unattended equipment, rules between segments, per-user wireless where the access points allow it, configuration export, and enough logging to answer a simple question about last week.

What it leaves open: nothing updates the threat lists, nothing inspects traffic, and someone has to remember to check firmware.

The check: from a laptop on the device segment, can you open a work machine's file share? It should fail. And is there an exported configuration file somewhere off the network, dated?

Rung three: a small subscription, no box

A filtering resolver service with a console, and an identity-aware access service in place of a VPN. Both are subscriptions to somebody else's infrastructure, and neither needs equipment.

Adds name filtering, a readable log, and settable categories on every device, anywhere.

It also gives remote access to specific applications with a second factor, without opening the office to the internet.

What it leaves open: the office network itself is untouched. Segmentation still needs rung two.

The check: does the filtering apply to laptops at home as well as in the office? If the service works through the router only, it stops at the door. The relative merits of VPN and identity-aware access are compared in identity and access, since the choice is really an identity decision.

Rung four: a managed provider

Someone else owns the configuration, the monitoring, and the updates, for a monthly fee.

What it adds: hours you do not have, a person reading the logs, and a phone number when the internet stops.

What it leaves open: the drawing. Which groups may talk to which is a decision about how the business works, and a provider cannot make it for you. It also leaves open the question of what they do without calling you, which should be written into the agreement.

The check: ask them to show you the rule list for your own network and explain it in sentences. If they cannot, they are maintaining a configuration nobody understands.

Rung five: no trusted office network

This option sounds like less work but does more: treat the office wifi as a coffee shop. Every laptop stays protected on its own terms: encrypted disk, patched, a non-administrator daily account, and the controls in endpoint security.

Every application is reached through an identity check with a second factor, wherever the user is. The office network's only job is to carry traffic to the internet.

What it adds: nothing changes when a laptop leaves the building, because nothing depended on the building.

The printers and cameras still need a segment because they cannot protect themselves, so this rung includes rung one or two for those unattended devices.

The United Kingdom National Cyber Security Centre's zero trust architecture design principles set out the approach at a larger scale than most small businesses. The first few principles apply unchanged to a ten-person office.

The check: unplug the router. Can staff still work from a phone hotspot with nothing lost except speed? If yes, you are here.

The ladder at a glance

Free help that is real

Several national bodies publish free tools and services for small organizations. The United States Cybersecurity and Infrastructure Security Agency keeps a list of no-cost cybersecurity services and tools.

Read it before buying anything on rungs three or four. Some of what those rungs sell is available there without a subscription.

The five checks in one place

Run them in this order, and stop at the first one that fails: that is the rung to work on.

What is not an alternative

A consumer VPN subscription is not a network security measure; it hides traffic from the local network and does nothing for the devices on it. A stronger wifi passphrase is not segmentation. And an appliance bought and never configured is rung one with a larger invoice.

Common questions

Which rung is right for a business of ten people?

Usually rung two for the office plus rung three for the people, moving toward rung five as laptops become the whole fleet. Rung four is for businesses with nobody at all who can spend an evening on this.

Can we skip straight to no trusted network?

Only if the endpoint and identity work is genuinely done. Otherwise you have removed the network's protection without replacing it, and the sequence in security foundations is the order to do that work in.

Is a managed provider more secure than doing it ourselves?

More maintained, which is often the same thing. It is less secure only when the provider's own access to your network is weakly protected, so ask how their engineers sign in and with what second factor.

What if the internet provider's router cannot do rung one?

Then it is a modem, and rung two is the first rung. Put the provider's box into bridge mode if it offers one, and let the new router do the work.