Firewalls: what does a small business really need to protect?

Many small businesses have a firewall without knowing it. It sits inside the router supplied by their internet provider, in the operating system of their computers or in the equipment installed by their IT provider. The question is rarely whether or not there is a firewall. It is knowing what it protects, how it is configured and who looks after it.

What a firewall does, in simple terms

A firewall analyses network connections and decides which ones may pass. It follows rules: allowing internal computers to access websites, for example, and blocking connection attempts started by unknown parties on the internet.

For an SME, the most important role of the firewall is to reduce the attack surface, that is, the set of the business's services that are visible and reachable from outside. Anything that does not need to be exposed should stay closed. Every port opened without need is one more point an attacker can probe.

Boundary firewalls and device firewalls

There are two types usually found in a small business:

Boundary firewall

It sits between the office network and the internet. It may be the router itself or a dedicated device. It protects all the devices connected to that network at the same time.

Software firewall

It is built into the operating system of desktop computers and laptops. This is what protects the device when it is outside the office, at home, in a hotel or on a public network. With remote and hybrid working, it has become even more important, because the laptop often never goes through the business's network at all.

The UK Cyber Essentials scheme takes both types into account and requires every in-scope device to be protected by a correctly configured firewall, whether the boundary firewall or the one on the device itself.

What really needs to be configured

A poorly configured firewall can give a false sense of protection. The essential points are few and verifiable:

• A strong, unique administrator password. The device's default password must be changed. Factory passwords are easy to find on the internet.
• Incoming connections blocked by default. Nothing coming from the internet should be accepted unless there is a specific, justified rule.
• Documented rules. Every rule that allows traffic needs a recorded reason and a named owner. Old rules, created for a system that no longer exists, must be removed.
• A protected administration interface. The management interface should not be reachable from the internet. If this is genuinely necessary, it must be protected by multi-factor authentication or restricted to specific addresses.
• Up-to-date firmware. The device itself receives security fixes, and they need to be applied, like on any other system. See why keeping systems up to date is a security measure.

Common situations that deserve attention

Some scenarios come up often in small businesses and tend to go unnoticed:

• Remote access open directly to the internet. Opening up a server's remote desktop so that staff can connect from home is convenient, but it exposes the service to constant break-in attempts. Solutions using a VPN or access brokered by a secure service, with multi-factor authentication, greatly reduce this risk.
• Cameras and recorders reachable from outside. CCTV systems often open ports on the router so that footage can be viewed on a mobile phone, frequently with default passwords.
• Temporary rules that stayed. A rule opened for a one-off support session and never reversed.
• Guest network mixed with the internal network. Separating the guest Wi-Fi network from the network where the computers and servers sit is a simple and effective measure.

The limits of a firewall

A firewall is an important layer, but it does not solve everything. It does not stop an employee from opening a malicious attachment, does not fix a weak password and does not protect a cloud service accessed directly over the internet. That is why it is part of a set, alongside secure configuration, security updates, user access control and malware protection, as described in the five basic cyber security controls.

For an SME, the goal is for the firewall to be enabled, configured with care and reviewed periodically. That alone significantly reduces the business's exposure.

Quick checklist

• The default password on the router or firewall has been changed.
• Incoming connections from the internet are blocked by default.
• There is a list of the rules that allow traffic, with a reason and an owner for each.
• The administration interface is not exposed to the internet without additional protection.
• The software firewall is enabled on all laptops and computers.
• The device firmware is up to date.