Ask an IT Guy: Do Small Businesses Need a Firewall?

Your first line of defense should always be the strongest. In a world where cybercrime has a “break in where you can” mentality, layered security is the only way to keep you safe.

The Great Wall of China's purpose was to defend against invaders. Your firewall protects you from the attacks of hackers. Think of it as your personal Great Wall.

Joe Popper, CIO (Chief Information Officer) at VC3 spoke to us about what firewalls are and their importance to your security.

What is a Firewall?

Unlike the Great Wall, your company’s firewall is not a brick wall that stands between you and hackers. It’s more like a super computer with extraordinary strengths.

“It’s a physical box, like a desktop computer, but it’s optimized to do firewall functions. The public has access to your network through the internet, so the firewall is between you and the public. The primary purpose of a firewall is to block all your private traffic from going out to the public. Otherwise, if you plug your machine right into the internet, it’ll be infected within minutes.”

In a nutshell, it’s a barrier between your users and the internet. It's set up as a security system to prevent unauthorized access to your company’s network.

Why Are Firewalls Important?

Keeping the bad guys out, whether it’s from your home or business, is much more than a security system and a dead bolt. The security of your system is as, if not, more important than your inventory or workstations. 

Intrusions could include malicious users, or stolen data and intellectual property.

"Enterprise firewalls have an enormous array of features on them. You can do things like scan for viruses/malware, filter websites, or create secure tunnels for your employees to connect to. 

But what makes them so important is they are the gatekeepers to your network. They govern the allowances in and out of your network. It is your first and strongest line of defense against hackers."

There isn't a single company that can survive without a firewall. Would you leave your car unlocked in a dark alley? If not, why would you leave your business’s data open like that?

What are Enterprise Firewall Standards?

Hackers are constantly raising the bar on cybersecurity. Joe explains why having a standard in the world of firewalls can be challenging.

“Standards are a big issue. The problem is, we have a standard and its designed to catch a certain level of threats. But the threats are that much bigger now. So, we have to raise the standards so they’re now countering all the current threats. And next year will be the chasing the same ghosts. The threat level will rise, and we’ll need to raise above that." 

It's an always evolving game, which is why security requires a layered approach. A firewall is one component, endpoint detection and response (EDR) is another, and so is backup. These are all parts to accomplishing the goal of network security.

Unfortunately, buying a firewall and installing it is not going to help. You have to do a whole lot of work behind the scenes of the firewall for it to be effective. It’s a very complex problem.”

Firewall Intrusion Prevention

Consider intrusion prevention like customs at the airport. You got on your flight after you made it through the TSA. But before they let you leave the airport, there’s one more checkpoint.

"Intrusion prevention is a service typically provided by the firewall. If your firewall is a steel door, the intrusion prevention is your deadbolt. These are all parts of that layered approach.

It's the second layer of protection for your network. It's placed behind the firewall, and it analyzes the incoming traffic flow. Its job is to prevent any potential attacks."

Is Having a Firewall Enough to Secure Your Business?

“The challenge is that most business owners don’t understand the complexity of a firewall. They know they have one and that's the end of it. But that should be the START of the discussion.

Their mentality is, “I have a firewall, and I have a guy that knows the firewall.” But, does he really?

What security certifications does he have? What services are you enabling on the firewall? What are you protecting against? Is it being consistently monitored?

My experience with business owners and firewalls is that they expect managed IT services providers to know how to do that, which is great because we DO know how and we consistently show proof. But if it's being managing internally, how do they know for sure?

And here is the bigger issue.

Up until recently, the bad guys have been trying to figure out how to steal from corporate America. And they would steal by putting malware on a device, and get revenue off of the spam email.

But they have moved on to basic blackmail and larceny. They put malware on your machine to shut down your entire network. You now have to pay a fee to recover your network - this is ransomware. It’s an incredibly efficient, multi-billion-dollar industry. 

So, it’s a basic security question: Mr. Client do you have money? And do you want to keep it? If you do, then you need to do all the layers.”

Network security is an ever-changing battlefield. Without firewalls and its layered components, you might as well be posting your password on an open forum for every hacker to steal. Keep hackers at bay with a strong defense. Talk to your IT provider to see which firewall and security strategy are best for you.

Ask an IT Guy

We know that sometimes, figuring out the question is harder than finding the answer.

Ask an IT Guy was created with you in mind. This bi-monthly series will help you get to the bottom of IT questions you didn't even know you had.

Have a question? Ask us anything in the comments and we'll answer it in a future Ask an IT Guy post!