Most of this site’s security pages are about accounts and devices: MFA on the logins, EDR on the machines, backups behind everything. This one is about the layer underneath: the network those devices sit on, which in a typical small office was assembled rather than designed, still runs on whatever the broadband installer left behind, and quietly undoes controls that look fine everywhere else. Attackers automate their search for exactly these assembled networks, because the gaps repeat: the same default passwords, the same exposed remote access, the same flat everything-sees-everything layout.
Here are the fundamentals, in the order that closes the most common ways in.
The router: change what the installer left
The perimeter of most small business networks is an ISP router running exactly as unboxed, and unboxed means three standing invitations:
- Default admin credentials. The router’s management password (printed on the sticker, catalogued on the internet for every model) is the first thing automated scanning tries. Change it; store it in the password manager.
- Remote management switched on. Many routers ship with their admin page reachable from the internet. Almost no small business needs that; turning it off removes an entire attack surface in one setting.
- Firmware nobody has ever updated. Router vulnerabilities get patched like any software, but only if updates run. Business-grade kit does this on a managed schedule; the installer’s box does it never, which is one of several reasons a proper business firewall (£300 to £900 for SME-grade hardware, plus subscription for its security services) earns its place at the perimeter once a business has anything worth protecting: actual traffic inspection, intrusion detection, and updates as routine rather than archaeology.
Exposure: what can the internet see?
The single most damaging small-network mistake of the last decade has been exposed remote access: a port opened so someone could reach a PC or server from home, usually via Remote Desktop, usually “temporarily”, years ago. Internet-wide scanners find exposed RDP within hours, credential-stuffing follows, and a large share of SME ransomware cases start exactly there rather than with anything sophisticated.
The rule is absolute: nothing answers from the internet unless it must, and remote access travels through a VPN or modern equivalent, never a raw open port. A VPN (built into every business firewall) means staff connect encrypted-and-authenticated first, then reach internal systems; add MFA to the VPN login and home working stops being the hole in the fence. Cloud-first businesses have a structural advantage here: with files in SharePoint and apps in the browser, there may be nothing internal to expose at all, which is the cheapest network security there is.
A once-a-year discipline worth adopting: check what your network answers to from outside (an external port scan, standard in any decent IT health check), and be able to name why each open door exists.
Segmentation: stop the flat network
The default office network is flat: every laptop, printer, camera, door controller and visitor phone on one segment, all able to reach each other. Flat is fine until any one device is compromised, at which point flat means the attacker’s next hop is everywhere.
Segmentation is the fix, and at SME scale it is not an enterprise project; it is three or four zones on kit you likely already have (the office WiFi guide covers the wireless half of the same split):
- Staff devices on the main network.
- Guests isolated to internet-only. Non-negotiable, and free on modern access points.
- The gadget shelf (screens, cameras, sensors, door systems, anything “smart”) on its own zone. These devices run old software forever and are the classic beachhead; internet access, no company access.
- Anything genuinely sensitive (a server, a finance PC) in a zone with deliberate, minimal reachability.
The test of good segmentation is a sentence per zone: what lives here, and what can it reach? If nobody can produce those sentences, the network is flat regardless of what the diagram claims.
Watching: security is a verb on the network too
Every control above is a configuration that rots without attention: firmware ages, a port gets opened for a project and never closed, a new gadget lands on the wrong network. The operational layer is what keeps the posture true: managed firewall updates, alerting on anomalies (a device suddenly talking to the internet at 3am, a login from nowhere), and periodic external scans to catch drift. This is standard content of a managed support arrangement’s security tier, and it is the difference between a network that was secured once and one that is secure now.
For calibration on why this matters locally: the Scottish incident data shows SMEs are targets of automation, not of interest, and automation only ever finds what is exposed. The fundamentals above are precisely what it checks for.
Frequently asked questions
What network security does a small business actually need?
The core set: a business-grade firewall with maintained firmware, no raw exposure to the internet (VPN for remote access), guest and gadget networks separated from staff, and someone operationally watching the configuration. That set closes the entry points that automated attacks actually use.
Is the ISP router’s firewall good enough?
It blocks unsolicited inbound traffic, which is a real baseline, but it inspects nothing, alerts on nothing, and updates unreliably. The upgrade to a business firewall becomes justified once the business has remote access needs, compliance questionnaires, or anything on-premise worth protecting.
Do we need a VPN if everything is in the cloud?
For reaching internal systems: only if internal systems exist. Cloud-first businesses may genuinely need no VPN, which removes a whole risk class; what remains essential is MFA on the cloud accounts and the WiFi separation, since the local network still carries the traffic.
What is network segmentation in plain terms?
Splitting one network into zones that cannot freely reach each other: staff, guests, gadgets, sensitive systems. A compromised smart TV on a flat network can attempt your file server; on a segmented network it can attempt YouTube. Same TV, different blast radius.
How do we know if something is exposed to the internet?
An external port scan against your public address answers it in minutes, and the answer should be boring: nothing, or a short list you can justify item by item. Any decent provider runs this as part of an audit; exposed remote desktop is the finding that should trigger same-day action.
Does Cyber Essentials cover network security?
Its firewall and configuration controls cover the fundamentals here: perimeter firewall present, defaults changed, no unjustified open services. The checklist makes the requirements concrete, and a network that passes this page’s tests passes that section’s.
Find out what your network answers to
The free IT health check includes the network layer: the external exposure scan, the router and firewall configuration review, the segmentation check, and the short list of changes ranked by what they close. Most assembled networks need days of work, not months, to reach designed. Get in touch before the automation finds the gap first.
