Multiple stores or offices: one safety rule for all

7 min read · DataRoad

Security in various stores or offices It only works with a single rule for everyone. If each location has its firewall configured in its own way, by different technicians and at different times, the company doesn’t have a security policy: it has ten. The answer is central management — the same rules, the same updates, and the same alerts in all locations, controlled from a single dashboard.

This article is for anyone who manages a network of stores, restaurants, clinics, or offices and wants to know, honestly, if everything is the same everywhere.

As each store ends up with its own security system

No one decides to have ten different policies. It happens. The first store opened with the equipment of the internet operator. The second had a local technician who “solved” the payment terminal by opening a port in the firewall. The third copied the configuration of another, but of an older version. The central office was updated; the others were not.

After five years, no one can answer three simple questions: which rules are active in each location, who has remote access to each device, and when was the last update to each of them.

The three typical problems of a network with multiple locations

1. Different rules in each store

One store blocks dangerous websites, another does not. One allows remote access to the management software provider only during intervention, while another has left that access open since installation. Just one location with the door open is enough for an attacker to enter and from there reach the rest, if they are connected to each other.

2. Equipment without an update

Firewalls and routers also have security flaws, and manufacturers release patches. The problem is that no one remembers to update the equipment behind the counter in a store in Faro. Verizon’s 2026 report shows that in small and medium-sized businesses, exploiting vulnerabilities was the entry point in 26% of the data breaches analyzed—ahead of credential theft and phishing.

3. Wi-Fi from customers mixed with the store network

It is most common in restaurants and retail: the customers' Wi-Fi network shares the same space as the manager's computer, the kitchen printer and the cash register terminal. A customer with an infected laptop is technically in the same room as the billing department. We explained how to separate these networks in the guide on Wi-Fi security and guest network.

Centralized managed firewall, explained without acronyms

The firewall is the gatekeeper of each location: it decides what enters and what leaves the network. Managed centrally, this means that all the gatekeepers follow the same manual, and that that manual is kept in one place.

In practice, central management brings five things:

• A single set of rules — what is allowed and blocked in all locations, with documented exceptions.
• Planned updates — applied to all the equipment in a defined window, with confirmation that they worked well.
• Alerts in a single dashboard — if a store goes without internet or a device detects an attack, someone knows.
• Networks separated by function — customers, staff, cash register and cameras on different networks, the same everywhere.
• Secure connection between locations — the stores communicate with the headquarters via encrypted channels, and only for what they need.

Store-by-store vs central management

A real case: 16 restaurants and more than 350 outlets

A Fullicious, The restaurant group in Lisbon and Porto chose DataRoad for the network infrastructure of 16 restaurants — including Adega de São Roque, Bacalhau com Todos and Peixaria do Rossio. The project included structured cabling, enterprise wireless network, firewall and security, with centralized management via the cloud, remote monitoring in real time and configuration applied to all restaurants. The network was segmented to separate employees and customers, with an entry portal for customers.

On another scale, the Ventask, With more than 350 jobs and a DataRoad customer since 2016, the network area is managed by our team: administration and maintenance of corporate firewalls, switches and access points, equipment security and remote work solutions. In the case of Ventask, 24/7 proactive monitoring and alarm management are part of the Premium 365 plan.

Common to all: the rules do not depend on who is in each location. They are defined, applied and monitored from a single place.

How to move to central management without stopping the stores

1. Inventory — what equipment exists in each location, what version it has, who accesses it.
2. Model of rules — defined by the direction: what is allowed, what is blocked, what exceptions exist.
3. Pilot in a store — the model is validated with the payment terminal, the management software and the cameras that are working.
4. Expansion in phases — store to store, during less busy hours, without stops.
5. Continuous surveillance — alerts, updates and reports become routine, through proactive monitoring.

Many current equipment already allows for central management; in other cases, it pays to replace it. We compared the two options — buying and managing internally or hiring as a service — in the article managed firewall vs bought firewall. And if the local internet is critical, it’s worth reading about. Internet redundancy in companies.

Frequently Asked Questions

Do I have to replace all the equipment in the stores?

Not necessarily. We start with the inventory: some equipment already allows central management and only needs to be reconfigured. Those that do not receive updates or do not allow central management should be replaced, in order of risk.

Does every store need to have its own firewall?

As a rule, yes. Each location has its own connection to the internet, and that’s where the firewall comes into play. The difference is in managing them all as if they were one, with the same set of rules.

What happens if a store's internet connection fails?

With centralized management, the failure is detected by alerts and not by a customer complaint. If the location has a second connection, the switchover can be automatic. We assess each location individually to determine whether this redundancy is sufficient.

How long does it take to go through to central management?

It depends on the number of locations and the state of the equipment. The inventory and the model of the rules are completed in a few weeks; the expansion is done in phases, without stopping the operation of the stores.

Security map of your stores in 10 working days

We inventory your premises' firewalls and networks, identify different rules, outdated equipment and mixed networks, and deliver a plan for a single rule. For companies with more than 10 locations · contract support · remote and on-site support · management firewalls and computer security It is included in the plans IT Unlimited Premium, With on-site assistance.

Sources

• Verizon — 2026 Data Breach Investigations Report, Executive Summary (small business data)