Business firewall: what is it really for?

The firewall controls what comes into your network and what goes out. It is a basic building block of security, but how well it works depends entirely on its configuration and follow-up.

What a firewall does

• It filters incoming and outgoing traffic according to defined rules.
• It separates internal networks from each other: workstations, servers, guests, connected devices.
• It provides VPN connections for remote work and between sites.
• It can detect and block known intrusion attempts and filter certain websites.
• It keeps logs that are useful in the event of an incident.

ISP-supplied router or business firewall

The ISP-supplied router provides basic protection, without fine-grained rules, without serious segmentation and with few logs. A business firewall lets you separate networks, manage VPNs with multi-factor authentication and follow what is happening. The router is then often put in bridge mode, behind the firewall, which takes over.

What it does not protect

• Phishing and theft of Microsoft 365 credentials: sign-in happens in the cloud, outside your network.
• Laptops used outside the office without a VPN.
• A computer already compromised inside the network.
• Hence the need to complement it with multi-factor authentication and endpoint protection (EDR).

Settings to check

• No port open without a documented reason, especially Remote Desktop (RDP) exposed to the Internet.
• The administration interface not reachable from the Internet.
• Up-to-date firmware: VPN vulnerabilities are actively exploited.
• Rules that are documented and reviewed regularly.
• VPN access protected by multi-factor authentication.
• A backup of the configuration.

Questions to ask your IT provider

• Who installs the updates, and how often?
• Who receives the alerts, and what happens next?
• Are the firewall's security subscriptions active?
• Where is the configuration documented?