Managed firewalls: what they protect and where they fail

• Function It defines which systems talk to each other and to the internet; it does not do the job of antivirus, backup or awareness training.
• Operator equipment Basic filtering, insufficient for a business.
• Main vector Most successful intrusions use legitimate credentials, not forgotten ports.
• Operation Expired licences or unread alerts turn the firewall into expensive decoration.

Five capabilities an ordinary router does not offer:

1. Isolated zones: guests kept away from the internal network, production machines away from admin workstations; an incident stays contained.
2. Traffic analysis: detection of known attack signatures and behaviours.
3. Web filtering: blocking by category and of recently registered domains, fertile ground for phishing.
4. VPN and remote access: controlled entry for people working off site, without publishing internal services.
5. Logs: reconstructing an incident depends on them.

This is the list where false certainties are born. A firewall does not stop the employee who opens an infected attachment, does not prevent the use of a password circulating in a data leak, does not follow the laptop home and does not return files encrypted by ransomware, that is the backup's job.

Today, the most serious attacks come in with a real username and password, obtained through phishing, reuse or a badly configured VPN. The perimeter still matters, but a growing share of the risk no longer passes through it.

At home, that is enough. In a business, having rules that change in a silent update is unacceptable.

This is where most security is won or lost. Three rules with immediate return:

• Zero direct publishing RDP and admin consoles open to the internet are scanned by bots around the clock.
• Mandatory MFA The measure with the best effort-to-protection ratio; a stolen password is no longer enough.
• Access with an end date Supplier and former employee accounts forgotten for years are more common than you might think.

By the number of simultaneous users and, above all, by real throughput with every inspection switched on. Catalogues quote figures measured with security switched off; switched on, the number can drop to a fraction.

Check the licensing too: web filtering, IPS and signatures depend on annual subscriptions. When they expire, the box keeps its lights on and stops defending, with no visible warning.

• Configure once and never review Obsolete rules pile up; an annual audit is the minimum.
• Expired licences The most silent failure of all.
• Everything on the same network Guests, production, CCTV and office together mean an infection reaches everywhere.
• Logs with no reader Useful for the post-mortem, useless for prevention.
• Permanent temporary exceptions The door opened for an outside engineer one Saturday is still there two years later.

A firewall is one layer of defence. It pays off when it works together with tested backups, up-to-date patches, MFA and teams trained to spot fraud.

DataRoad installs and operates managed firewalls and cybersecurity within its managed IT services, with alerts followed up and rules reviewed periodically. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950 * or write to sales@dataroad.pt.

*Call to a Portuguese landline.