Next-generation firewall

Traditional firewalls allowed or blocked traffic by port and address. Next-generation firewalls inspect traffic more deeply. They can identify applications regardless of port, apply policies by user or group, block known malicious sites, detect exploit attempts with intrusion prevention and, with appropriate configuration, inspect encrypted traffic.

For Canadian SMBs, the firewall often doubles as the VPN gateway, which makes it one of the most targeted devices on the network. Several major vendors' firewall and VPN products have had critical vulnerabilities exploited at scale in recent years, and the Canadian Centre for Cyber Security has issued repeated alerts about them.

That makes firewall hygiene essential. Patch firmware promptly, never expose the management interface to the internet, enforce MFA on VPN access, disable unused features and review rules regularly to remove old exceptions. Send firewall logs to your monitoring provider so suspicious connections are noticed. A well-managed firewall is valuable; a forgotten one is an entry point.