Network Security

Traditional firewalls inspect traffic at the port and IP level — they decide whether to let traffic through based on source, destination and port number, but they cannot see what is inside the connection. Next-gen firewalls add application awareness (they recognise that a specific stream of traffic is Microsoft Teams or Dropbox rather than just 'TCP port 443'), intrusion prevention (they detect known attack signatures inside permitted traffic), TLS inspection (they can decrypt and inspect encrypted traffic where policy allows), and threat-intelligence-fed blocklists. The practical difference: a traditional firewall lets anyone with a permitted port through; a next-gen firewall lets the application you actually approved through, and blocks malicious activity inside otherwise legitimate connections.

Almost always no for any organisation with more than a handful of staff. Consumer routers are sized for residential traffic patterns, have limited security policy controls, and typically lack the segmentation features needed to separate finance traffic from guest Wi-Fi from IoT devices like printers and cameras. They also have no central monitoring — when one device on the network is compromised, the router has no visibility into the lateral movement. The pragmatic threshold for upgrading is around 10 staff, multi-site operation, regulated industry (finance, government, healthcare), or any environment that holds customer data. Below that threshold, careful configuration of the consumer router plus basic Wi-Fi segmentation is sometimes enough; above it, an enterprise firewall pays back quickly.

Segmentation means splitting the network into separate zones, each with its own policy — typically production (servers, finance systems), staff (laptops and desktops), guest (visitor Wi-Fi), IoT (printers, cameras, building systems), and management (network gear administration). Each zone is allowed to talk to the others only where policy explicitly permits. Without segmentation, a compromised printer or guest laptop can reach the finance server directly; with segmentation, the same attack hits a policy wall and fails. Pacific offices commonly run a single flat network where everything can talk to everything — which is the configuration most current attacks rely on. The first engagement typically introduces four to seven VLANs and the practical risk reduction is immediate.

Traditional VPN treats every remote site or remote user as the same generic tunnel back to head office — slow, manually configured, fragile when the underlying internet connection changes. SD-WAN is purpose-built for multi-site businesses: it manages multiple internet connections per site (typically a primary fibre link plus a 4G or 5G failover), automatically routes traffic over the best available path per application, encrypts site-to-site traffic end to end, and is managed from a central console rather than configured per device. For organisations with two or more sites, SD-WAN is almost always materially better than a per-site VPN setup. For single-site businesses with no branch offices, traditional VPN for remote workers is usually still the right answer.

Zero-trust remote access replaces the traditional 'full-tunnel VPN' approach with identity-based access to specific applications. Instead of trusting any device that authenticates with a VPN client and giving it access to the entire network, zero-trust verifies the user identity, the device's compliance state, the location and the time, then grants access only to the specific applications the user needs. The practical experience for users is usually better — applications are reachable directly from their browser or client without a separate VPN client to launch, and the same access works without launching a separate VPN client from the office, home or a customer site. From a security standpoint, a compromised credential cannot pivot laterally because access is application-scoped, not network-scoped.

A single-site small-business network refresh — firewall replacement, basic segmentation, secure Wi-Fi, remote access — typically deploys in two to three weeks once equipment is in country. Multi-site SD-WAN rollouts run six to twelve weeks for organisations with three to ten sites, planned in batches so each site goes live with the previous one stable. Larger enterprise refresh projects with significant existing infrastructure to migrate from extend to several months. We avoid weekend big-bang cutovers — every project we run keeps a working network in place throughout the migration and cuts over piece by piece.

Project costs cover hardware, design and installation. A single-site small-business deployment with a managed firewall, switches and Wi-Fi typically lands in the high four-figure or low five-figure range (NZD) for hardware plus a comparable installation fee. Multi-site SD-WAN scales with site count and the SD-WAN platform licensing. Ongoing managed network services are then a per-site or per-user monthly fee covering firewall monitoring, policy management, firmware updates, threat-intelligence subscription, incident response and the central management platform. The recurring fee is what keeps the security posture current as threats and platforms evolve — set-and-forget network gear becomes dangerously out of date within twelve to eighteen months.