Article · Networking
Network security for small offices that keeps up with how you work
Your office network connects staff laptops, printers, phones, cameras, guests and remote workers. Without some structure, any one of them can become a path to everything else. These are the practical controls that matter most for a small or mid-sized business.
- Published
- 7 min read
On this page
Key takeaways
- Keep firewall and network device firmware current, and replace hardware once the vendor stops issuing security updates.
- Segment the network so guests, IoT devices, phones and staff computers cannot freely reach each other.
- Isolate guest Wi-Fi completely from business systems and use strong, modern Wi-Fi security for staff.
- Secure remote access with MFA, patch VPN appliances promptly, and consider zero trust network access for application-level access.
- Never expose remote desktop or device management interfaces directly to the internet.
- Inventory every connected device, because you cannot protect what you do not know is there.
The firewall: still essential, often neglected
In many small offices the firewall is whatever device the internet provider installed, or a business firewall that was configured once and never revisited. Firewalls and other edge devices are frequent targets because they are internet-facing by design and a vulnerability can give an attacker direct access to the internal network.
Treat firmware updates on edge devices as urgent, particularly when the vendor flags a vulnerability as actively exploited. Subscribe to your vendor’s security advisories. Check that the device is still supported; once a model reaches end of life it stops receiving fixes and should be replaced. Make sure the management interface is not reachable from the internet, that administrator accounts are individual and protected with MFA where supported, and that the configuration is backed up after every change.
Review the rule set at least annually. Remove port forwards and rules nobody can explain, restrict outbound traffic where practical, and enable features you are already licensed for, such as intrusion prevention, web filtering and threat intelligence subscriptions, after testing their impact.
Segment the network
A flat network, where every device can talk to every other device, lets one compromised printer or laptop reach the file server. VLANs and firewall rules between them limit that spread.
Staff devices
Managed company laptops and desktops, with access to the business applications and servers they need.
Servers and infrastructure
File servers, backup appliances and network management, reachable only from the systems and administrators that require it. Backup systems in particular should be tightly restricted.
Voice and printers
VoIP phones and printers on their own segments, allowed to reach only the services they need, such as the phone system provider or print server.
IoT and building systems
Cameras, door access, smart TVs, thermostats and other devices that rarely receive updates, isolated so they cannot reach business data.
Guests
Internet access only, with no route to any internal segment.
Wi-Fi for staff and guests
Wireless networks extend beyond your walls. Configure them as if someone in the parking lot is trying to connect, because sometimes they are.
- Use WPA3 where all devices support it, or WPA2/WPA3 transitional mode; retire WEP and WPA-TKIP entirely.
- For larger offices, consider WPA2- or WPA3-Enterprise with 802.1X so each user or device authenticates individually, often tied to Microsoft Entra ID or certificates issued through Intune.
- If you use a pre-shared key for staff, make it long and random, change it when staff with knowledge of it leave, and do not share it with guests.
- Run a separate guest network on its own VLAN with client isolation, bandwidth limits and no access to internal resources, and rotate its password regularly or use a captive portal.
- Disable WPS, change default administrator credentials on access points and keep their firmware current.
- Place access points to cover your space without unnecessarily broadcasting into neighbouring units or the street.
Remote access: VPN and zero trust network access
Remote work means the network perimeter now includes kitchen tables and coffee shops. Traditional VPNs create an encrypted tunnel into the office network and remain a reasonable choice when configured well: require MFA for every connection, give remote users access only to the segments they need, keep the VPN software and appliance patched quickly, and log connections. VPN appliances have been a recurring target for attackers, so leaving one unpatched is a serious risk.
Zero trust network access (ZTNA) takes a different approach. Instead of placing a remote device on the network, it brokers access to specific applications after checking identity and device health, often through a cloud service. Users never see the wider network, which limits what an attacker can reach with stolen credentials. For organizations whose applications are mostly in Microsoft 365 and other SaaS platforms, the need for any VPN may be small, and ZTNA or application publishing can replace it for the few internal systems that remain.
Whatever approach you choose, never expose Remote Desktop Protocol (RDP), SMB file sharing or device management pages directly to the internet. Exposed RDP is one of the most commonly abused entry points for ransomware.
IoT and the devices nobody thinks of as computers
Security cameras, video recorders, conference room displays, smart TVs, printers, badge readers and HVAC controllers are all networked computers. Many ship with default passwords, rarely receive updates and are installed by contractors rather than IT. Some also make outbound connections to cloud services you did not choose.
Inventory them, change default credentials, update firmware when available, disable features you do not use such as UPnP and remote cloud access, and place them on an isolated segment with only the access they need. When buying new devices, ask the vendor how long security updates will be provided.
Visibility and maintenance
Network security is not a one-time project. A light, regular routine keeps it from decaying.
Maintain an inventory
Record every network device, its model, firmware version, support status, location and owner. Include ISP equipment and anything a contractor installed.
Use DNS filtering
Filtering DNS requests blocks known malicious and phishing domains for every device on the network, and can extend to roaming laptops through an agent.
Log and monitor
Send firewall and Wi-Fi logs to a location where they are retained and reviewed, and alert on configuration changes and repeated failed logins.
Review regularly
Check firmware and support status monthly, review firewall rules and VPN accounts quarterly, and test segmentation after changes by confirming a guest device really cannot reach internal systems.
Secure the physical layer
Lock the network closet, disable unused wall ports or assign them to a restricted VLAN, and know who has physical access to network equipment.
Start with three checks
Confirm your firewall is supported and running current firmware, confirm nothing like RDP is exposed to the internet, and confirm guest Wi-Fi cannot reach any internal device. Those three checks close some of the most common gaps in small office networks.
Frequently asked questions
Is the router from our internet provider good enough?
For a very small office it may provide basic protection, but ISP routers often lack segmentation, logging and timely firmware updates. Most businesses benefit from a dedicated business firewall with the ISP device in bridge or pass-through mode.
Do we still need a VPN if everything is in Microsoft 365?
Possibly not. If all business applications are cloud-based and protected with Conditional Access, a VPN may only be needed for a few internal systems, or not at all. ZTNA can provide access to those systems without full network access.
What is network segmentation and why does it matter?
Segmentation divides the network into zones with rules between them, so a compromised device in one zone, such as a camera or guest laptop, cannot freely reach servers and staff computers in another.
How often should firewall firmware be updated?
Apply security updates promptly when released, with urgent updates for vulnerabilities the vendor reports as exploited. Check for updates at least monthly and before the device reaches end of support.
Related services
Products and packages
Get a clear picture of your office network
A network health assessment reviews your firewall, Wi-Fi, segmentation, remote access and device inventory, and gives you a prioritized plan for improvement.