How to Secure Your Company Network in Three Steps
Three measures stop most attacks on a small office network: let nothing on the internet reach into the office, encrypt the Wi-Fi properly, and split the local network into segments.
1. Don't expose anything on a public IP
Your internet line will still have a public address, but nothing in the office should answer on it.
- Remove all port forwards. Never publish RDP, SSH, a NAS, cameras or admin pages to the internet.
- Turn off UPnP and remote (WAN) admin on the router. Change its default password and keep its firmware updated.
- For remote work, use an outbound-only tunnel or mesh VPN such as Tailscale or Cloudflare Tunnel, with MFA. Staff connect in without any open port on your side.
- Test it: run our port test from the office network. It should find no open ports.
Option: ask your ISP for a private address (CGNAT). The ISP puts your line behind its own NAT, so nobody on the internet can start a connection to you, even if a port forward is left open by mistake. Keep these limits in mind:
- It only covers IPv4. If you also get IPv6, your devices are reachable, so the router must still block all inbound IPv6 traffic.
- It doesn't stop phishing or malware, which start with a connection from inside the office going out.
- You share an IP with other customers, so their blocklisting can affect you, and you lose a fixed IP for supplier allowlists.
Use it if your ISP offers it and nothing you run needs inbound connections, and keep the router's inbound block on regardless.
2. Use strong Wi-Fi encryption
Use WPA3 everywhere your devices support it, and never WEP, WPA or TKIP.
- Best: WPA3-Enterprise (802.1X) with a personal login per employee, so access ends when someone leaves.
- Good enough for small offices: WPA3-Personal with a random passphrase of 20+ characters, changed whenever staff leave.
- Turn off WPS and keep access-point firmware updated.
- Let guests use a separate guest network (see step 3). Never give them the password to the staff Wi-Fi.
3. Segment the local network
Put each type of device in its own VLAN, so one infected phone or camera can't reach your company computers.
| Segment | Devices | Allowed to reach |
|---|---|---|
| Staff | Company laptops and PCs | Internet, servers, printers |
| Servers | File server, backups | Only what staff need; nothing else |
| Guest | Visitors, personal phones | Internet only |
| IoT | Cameras, printers, smart TVs | Their own controller only |
| Management | Router, switch and access-point admin | IT admins only |
- Give each segment that uses Wi-Fi its own network name (SSID).
- Set the firewall between segments to block everything except the traffic listed above.
- If your equipment can't do VLANs, at least put guests and IoT devices on a separate network from company computers.
Get in touch
Tell us about your project and we'll get back to you with a proposal. Email, call or send a WhatsApp message.