Reduce the reachable surface
Security begins with a clear inventory of services and permitted paths. A firewall rule should have an owner, a reason and a review date.
- Deny unsolicited inbound traffic by default.
- Expose only required services and restrict management access.
- Separate guest, user, server and management networks where appropriate.
- Log denied traffic selectively so useful signals remain visible.
Protect access and transport
A VPN protects a path; it does not make every device on that path trustworthy. Authenticate users and devices, limit permissions and keep systems patched.
- Use encrypted application protocols and validate certificates.
- Use multifactor authentication for administrative access.
- Treat DNSSEC as authenticity for DNS data, not encryption.
- Review remote access and remove accounts that no longer need it.
Be ready to recover
Detection and recovery need rehearsed procedures. Network controls complement endpoint protection, backups and application security.
- Keep an isolated, tested backup and document restoration steps.
- Synchronise clocks so logs can be correlated.
- Record configuration changes and retain a known-good recovery path.
- If an incident occurs, preserve evidence and follow the organisation’s response process.