Office network security features grouped by the question each one answers

A datasheet lists what a box can do. You need a list of what the office needs the box to do. The gap between the two is what you pay for.

The features below are grouped by the question each answers: one line on what it does, one on what it does not, one on when it matters. Read the datasheet against this list, not the other way around.

What to take away

Who may talk to whom

Separate networks (VLANs, or multiple SSIDs mapped to them). Lets you keep work machines, unattended devices, and guests apart. Does not by itself stop traffic between them; that needs a rule. Matters as soon as you own a printer or a camera.

Client isolation. Stops devices on the same wireless network from seeing each other. Free on almost every box, and the single cheapest item in the whole of network security. Does not isolate wired devices. Matters on every guest network and on most staff ones.

Rules between segments. The firewall's actual job: allow the print port from work to the device segment, deny everything else. Does not help if the rule list is unreadable. Matters when you have segments, which you should.

Per-user wireless authentication. Each person signs in with their own credentials rather than a shared passphrase. Does not work on devices with no user, such as printers, which stay on a passphrase segment. Matters the first time someone leaves and you realize the passphrase cannot be revoked for one person.

What leaves the network

Name filtering. Names of known-bad destinations fail to resolve. Does not inspect anything, and a device using its own resolver bypasses it. Matters everywhere, because it covers devices you cannot install software on.

Category filtering. Blocks classes of site by policy. Does not distinguish a harmful site from an unpopular one, so expect requests to unblock. Matters where you have a written acceptable use policy; without one it is a source of arguments.

Outbound rules. Only certain segments may reach the internet at all, or only on certain ports. Does not help against traffic that looks normal. Matters most for the device segment, which rarely needs to reach anything except its own manufacturer.

Intrusion prevention. Inspects traffic for known patterns. Does not see inside encrypted connections without a separate and demanding setup. Matters if someone reads what it reports; otherwise it is a subscription that slows the box.

Who gets in from outside

VPN. Encrypted tunnel into the office, with a second factor. Does not restrict what a connected device can reach unless you add rules. The United States National Institute of Standards and Technology's guide to IPsec VPNs sets out how the common type works, which is useful when a datasheet uses the term loosely. Matters when staff need the office from home.

Identity-aware access. Each application published individually behind a login, so a user reaches one thing rather than the whole network. Does not cover applications that are not web-based without extra work. Matters as the number of remote users grows, and it is the approach compared against VPN in identity and access.

Second factor on the way in. A code, a key, or an application prompt in addition to a password. Does not help if the older sign-in path is left open beside it. Matters absolutely; a remote access path with only a password is an inbound door.

What happened

Logging with retention you can state in days. The record after the fact. Does not help if the retention is shorter than the time it takes to notice a problem, which it often is. Deciding what to keep and for how long is a question in its own right, and the United States National Institute of Standards and Technology's guide to computer security log management is a fair way to settle it. Matters on the day you need it, and that day arrives without notice.

Log export to somewhere else. Sends logs to storage that survives the box. Does not do anything if the destination fills up unread. Matters if on-box retention is measured in hours.

Alerts on a short list. Administrator login, rule change, remote access from an unexpected place. Does not help if the list is long enough to be ignored. Matters more than any detection feature, because it is the one that reaches a person.

Will it look after itself

Scheduled firmware updates. Installs updates at a time you choose. Does not tell you when the model leaves support; ask separately. Matters because the router is a computer that is never rebooted otherwise.

Configuration export and import. The way back after a bad change, and the way forward after a hardware failure. Does not include the license, usually. Matters on the evening described in network security setup and on the day the box dies.

Cloud management. Configure from anywhere, see all sites in one place. Does not work when the console is unreachable, and the console login becomes a critical credential. Matters for more than one office; for one office it is a convenience with a risk attached.

A second unit. Two boxes so that one failing does not stop the business. Does not protect against a bad configuration, which it faithfully copies. Matters when an hour without internet costs more than a second box.

The features against the everyday problems

Common questions

Which single feature is worth the most?

Segmentation with client isolation, because it changes what a compromised device can do. Name filtering is second, because it protects the devices nothing else can.

Is intrusion prevention worth the subscription?

Only if a named person will read its output and act. If the honest answer is no, the money is better spent on the backup arrangement in backup and recovery, which pays off whether or not anyone is watching.

We have all of these features and none are configured. Where do we start?

Guest isolation, then the device segment, then the inbound list. In that order, one evening each if needed.

Does a feature we have not enabled count for a customer's questionnaire?

No. A questionnaire asks what you do, not what the box could do. Answer honestly and use the gap as the plan.