Defending a network

A firewall decides which network traffic is allowed, by rules on where it's from, where it's going and which port. Rules are checked top to bottom and the first match wins. Good firewalls end with "deny everything else", so only what you've chosen is open. That's default deny.

#  Action  From            To              Port
1  allow   any             198.51.100.20   443/tcp
2  allow   10.0.5.0/24     198.51.100.20   22/tcp
3  deny    any             any             any

In that example anyone can reach the web server on 443, only the admin network 10.0.5.0/24 (every address starting 10.0.5.) can reach it on SSH, port 22, and everything else is dropped. Each open port is a door, so only open what's needed, and never put database or remote desktop ports (like 3389 for Windows Remote Desktop) straight on the internet. Attackers scan the whole internet for them every day.

Segmentation splits a network into zones with firewalls between them: staff laptops, servers, guest Wi-Fi, payment systems, cameras and other smart devices. If a laptop is infected, it can't reach the payment systems directly. Without segmentation, one foothold reaches everything.

For working remotely, a VPN (virtual private network) builds an encrypted tunnel from your device to the company network. Put MFA on it and patch it fast: VPNs and other remote-access boxes face the internet, so their vulnerabilities are some of the most attacked of all. Newer zero trust access tools give people one app at a time instead of the whole network.

For Wi-Fi, use WPA3 (or WPA2 with a long passphrase if a device can't do WPA3), change the router's default admin password, keep its firmware updated, and give guests and smart devices their own network. On public Wi-Fi, HTTPS already encrypts what you send to websites; a VPN adds cover for everything else.