Network and firewall security
Close The DoorsAttackers Walk Through.
Exposed VPNs, open RDP and stale firewall rules are among the most common ways attackers get in. We find them, close them and can run your firewalls day to day.
- Firewall platforms managed
- 5
- Edge monitoring
- 24/7
- Critical alert response
- 15 min
CONSOLEDemo tenantSOC online00:00:00 ET3MTExposure / External
Internet-facing assets
What the internet can see
prairiesteel.ca · 6 exposed services on 2 IP ranges
1
Critical
2
High
1
Medium
2
Expected
Certified partner of
Why this cannot wait
- Vulnerability exploitation targeting edge devices and VPNs
- 22%
- Verizon, Data Breach Investigations Report, 2025
- Median time to fully patch edge device vulnerabilities
- 32 days
- Verizon, Data Breach Investigations Report, 2025
- Breaches that started with vulnerability exploitation
- 31%
- Verizon, Data Breach Investigations Report, 2026
- Critical (CISA KEV) vulnerabilities fully remediated in 2025
- 26%
- Verizon, Data Breach Investigations Report, 2026
Overview
What Enters, What Leaves and What Moves Inside Your Business
Network and firewall security is the set of controls that decide what traffic can enter your business, what can leave it and what can move between systems inside it. The firewall is the obvious piece. Remote access, Wi-Fi, segmentation, DNS filtering and monitoring matter just as much.
The idea of a strong perimeter with a trusted inside is gone. People work from home, cloud apps live outside the office and attackers often arrive with a valid username and password. A modern design assumes something inside will eventually be compromised and limits the damage.
Three Reasons Firewalls and VPNs Get Breached
At the edge01
Unpatched Edge Devices
Firewalls and VPN appliances from major vendors have had serious flaws exploited at scale. Attackers scan the whole internet soon after a flaw is published, and a firewall patched quarterly can be weeks behind.
Firewall review and patch oversightAt the door02
Weak Remote Access
VPN accounts without MFA, old accounts that were never disabled and remote desktop exposed directly to the internet. These are standard entry points for ransomware operators.
Secure remote accessInside03
Flat Networks
Once inside an unsegmented network, an attacker can reach every server, backup system and workstation. That is how one compromised laptop becomes a whole-company outage.
Segmentation
Who This Is For
Offices, plants, clinics and job sites with equipment on a local network. If any of these sound like you, the network is likely your biggest open door.
- Agricultural equipment dealerReginaFive branches connected by site-to-site VPN, all managed by one person who also runs the parts desk.
- ManufacturerHamiltonProduction equipment on the same network as office laptops.
- Medical clinicVictoriaGuest Wi-Fi password printed on the waiting room wall, and a reception PC that can reach the patient records server.
- Professional services firmStaff reach a file server over a VPN with no multi-factor authentication.
Fully cloud-based, nothing on premises? Your priorities are elsewhere. Start with endpoint security and Microsoft 365 and email security.
Firewall review and management
Every Rule Reviewed, and a Written Reason for Each One That Stays
Rule bases grow for years without anyone removing anything. We go through your firewalls rule by rule, clean up what is stale or too broad and document the rest.
What we findWhat happens
- Rules for systems that no longer existRemoved
- “Any to any” for a vendor who needed access once in 2019Removed or narrowed
- Management interfaces reachable from the internetClosed to the internet
- Every rule that remainsDocumented with its reason
Patch Oversight for Your Exact Models
We track vendor advisories for your specific firewall and VPN products, including Canadian Centre for Cyber Security alerts on actively exploited flaws, and push for critical updates to be applied quickly.
External Attack Surface Checks
Regular scans of what your business exposes to the internet, from the attacker’s point of view, so new exposures do not sit unnoticed.
CONSOLEDemo tenantSOC online00:00:00 ET3MTNetwork / Firewall rules
Rule review
FortiGate 100F · HQ Calgary
142 rules reviewed, 59 changed
% complete
Changes applied in the Sunday 22:00 window with config backup and rollback plan.
Sample data. Each change is logged with the rule, the finding and the outcome, and applied in a planned maintenance window.
Secure remote access
Remote Access That Does Not Double as the Way in for Ransomware
VPNs and firewalls sit on the internet by design, hold the keys to your internal network and are often patched less often than laptops. Remote desktop exposed to the internet is one of the most common entry points for ransomware.
| Common today | What we put in place |
|---|---|
| Remote desktop exposed directly to the internet | Port closed. Access goes through a VPN or a zero trust access service with MFA. |
| VPN accounts without multi-factor authentication | MFA on every VPN account, with no exceptions for executives. |
| Old accounts that were never disabled | Accounts reviewed and unused ones disabled. |
| A vendor who insists on direct access to support a system | A controlled, logged access path instead of an open port. |
| A traditional VPN for everyone, by default | Zero trust network access evaluated as a replacement where it makes sense. |
Job Sites, Branches and Home Offices
Canadian SMBs rarely have one tidy office: trailers on job sites with cellular routers, clinic groups with different internet providers at each location, staff working from home part of the week. We document a standard for each type of location, so new sites start secure instead of becoming another exception.
Branches and job sites
Managed firewalls or secure routers with the same baseline policy as head office, centrally logged.
Home workers
A VPN or zero trust access service with MFA, from company-managed devices where possible.
Cellular and temporary connections
Never direct access to internal systems without the same controls as everywhere else.
Segmentation and Wi-Fi
Zones, So One Infected Laptop Cannot Reach Every Server
Segmentation divides your network into zones so devices only talk to what they need. If ransomware lands on one laptop, it limits how far it can spread. It is one of the most effective controls against large outages.
CONSOLEDemo tenantSOC online00:00:00 ET3MTNetwork / Segmentation
Segmentation review
Before: flat network
10.0.0.0/16Any device can reach any other on SMB, RDP and admin shares.
After: segmented
4 VLANs · FortiGateStaffVLAN 10
GuestVLAN 40
ServersVLAN 20
Plant floorVLAN 30
Illustration. Twelve devices on one flat network compared with the same devices in four zones.
Zones We Separate
- ServersFile, application and backup systems
- Staff devicesLaptops, desktops and printers
- Guest Wi-FiVisitors and personal phones
- Payment terminalsThe cardholder data environment
- Cameras and building systemsDevices you often cannot patch
- Operational technologyPlant floor systems, kept apart from the office
Planned, not rushed. Segmentation done carelessly breaks things, so each zone gets only the connections it needs, agreed with you and your IT provider before anything changes.
Wi-Fi: Two Networks with Two Different Jobs
Staff Wi-Fi
- Enterprise authentication with individual credentials
- Shared passwords removed, so leavers lose access when their account is disabled
- On the staff devices zone, not beside the servers
Guest Wi-Fi
- Isolated from internal systems: guests cannot see servers or staff devices
- Internet access only
- A password on the waiting room wall is then a convenience, not a route to patient records
Monitoring and your IT provider
Watched by Analysts, Run Alongside Your IT Provider
Firewall, VPN and DNS logs feed our SOC, where analysts review them rather than leaving them in storage.
What Analysts Look For
- Brute force attempts
- Unusual VPN logins
- Connections to known malicious infrastructure
- Critical alerts
- Triaged with response beginning within 15 minutes, 24/7/365
- Monitoring data
- Kept in Canadian data centres by default: 90 days searchable, 1 year archived
Who Does What
The model in most engagements. Your IT provider keeps hands-on management of the equipment; we provide the security review, oversight and monitoring.
Your IT provider
- Hands-on management of firewalls, switches and Wi-Fi
- Applies agreed changes in planned maintenance windows
- Installs firmware updates
Cyberphore
- Rule-by-rule configuration review
- Change plans with rollback steps
- Vendor advisory tracking and patch follow-up
- Log monitoring and exposure checks
If you prefer, Cyberphore takes over day-to-day firewall administration as a managed service, on Fortinet, Palo Alto Networks, Cisco, Check Point and Sophos platforms.
Your IT provider
- The rest of your IT environment
- Coordinates with us on changes that touch their systems
Cyberphore
- Day-to-day firewall administration
- Firmware updates for critical advisories
- Rule changes, documented with their reason
- Everything in the oversight model
How an engagement runs
Map, Review, Harden, Then Keep Watching
Network diagrams are usually out of date, so we start with what is really there. A single office with one firewall is a short engagement; a multi-site business with plant networks takes longer.
1Map
We document sites, internet connections, firewalls, switches, Wi-Fi, VPNs and the traffic that actually flows, and look at your network from the outside the way an attacker would.
You haveA current network diagram and a view of what is exposed
2Review
We assess configuration, exposure and segmentation against your risk and recognized baselines, rule by rule.
You haveFindings and a segmentation plan
3Harden
Changes are applied in planned maintenance windows with rollback plans, working with your IT provider.
You haveA cleaned, documented rule base and closed exposures
4Monitor
We watch firewall and VPN activity, track vendor advisories for your devices and recheck exposure regularly.
You haveAnalyst review of network logs, ongoing
Anything unticked is where a review starts. Unsure counts as unticked.
All seven in place. An independent penetration test is the best way to confirm it.
Questions to Ask Any Network Security Provider
- 1How would you find out about a critical vulnerability in our specific firewall model, and how quickly would you act on it?
- 2Do you review the rules, or just check the firmware version?
- 3Can we see a sample segmentation plan?
- 4Will you test your own work?
An independent penetration test is the best check that the network is as tight as the diagram says.
Canada and cost
Canadian Requirements, and What Drives the Cost
- Baseline controls
- The Cyber Centre’s baseline cyber security controls for small and medium organizations include secure configuration, patching, network defences and secure remote access. CyberSecure Canada certification is built on similar controls, and a well-documented network program provides much of the evidence for both. Compliance readiness.
- Cyber insurance
- Applications frequently ask about MFA on remote access, exposed remote desktop and how quickly critical patches are applied. Answer accurately. Insurance readiness.
- Payment card data
- PCI DSS requires network security controls and segmentation of the cardholder data environment. Good segmentation can also reduce how much of your network falls in scope for assessment.
- Operational technology
- Manufacturers, utilities and resource companies often run plant systems that cannot be patched easily. Segmentation and monitoring are the realistic protection.
General information, not legal advice.
FAQ
Network and Firewall Security: Common Questions
Do we still need a firewall if everything is in the cloud?
Usually, yes, though its role changes. Offices still have printers, Wi-Fi, cameras and laptops that need protection, and many businesses keep at least one on-premises system. If you are fully cloud-based, the priorities shift toward identity, device security and secure web filtering, and a simpler firewall may be enough.
Why are VPNs and firewalls such common attack targets?
They sit on the internet by design, they hold the keys to your internal network and they are often patched less frequently than laptops. Attackers actively scan for known vulnerabilities in popular firewall and VPN products soon after they are announced. The Canadian Centre for Cyber Security regularly publishes alerts about exploited flaws in these devices.
What is network segmentation and why does it matter?
Segmentation divides your network into zones so that devices only talk to what they need. Guest Wi-Fi cannot see servers, cameras cannot reach accounting, and the plant floor is separated from the office. If ransomware lands on one laptop, segmentation limits how far it can spread. It is one of the most effective controls against large outages.
Is it safe to allow remote desktop from the internet?
No. Remote Desktop Protocol exposed directly to the internet is one of the most common entry points for ransomware. Put remote access behind a VPN or a zero trust access service with multi-factor authentication, and close the port. If a vendor insists on direct access to support a system, give them a controlled, logged method instead.
Do you replace our firewall?
Only if it genuinely needs replacing, for example because it is end of life and no longer receives security updates. In most cases we work with the equipment you have, tighten its configuration and monitor it. When replacement is justified, we give you vendor-neutral requirements so you can buy from your IT provider or reseller.
Get started
Find Out What Your Network Exposes Today
A free scoping call with a certified specialist about your sites, firewalls, remote access and Wi-Fi. No obligation, and no change to your equipment until you agree a plan.
- 1Free scoping callWe learn how many sites and firewalls you run, who manages them and what worries you most.
- 2Written quote in CADFor a one-time review or ongoing monitoring and management, whichever fits.
- 3Map and reviewWe document what is really there, then plan changes with you and your IT provider.