I think the first thing to get right is a clear boundary between the internet and the internal network. A modest hardware firewall does the job and is cheap enough for a shop of ten desks. It blocks inbound ports you don't need and logs attempts, so you can see when a scanner is probing your IP.

Perimeter Filtering

The firewall rules are simple: allow web traffic on port 80 and 443, allow outbound DNS, and deny everything else. You can add a rule to let VPN clients in if you need remote access.

iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -j DROP

That snippet shows a basic iptables setup on a Linux box you could use as a front‑line filter. It is short enough to audit quickly, and you can expand it later if you need more services.

Network Segmentation

Next I split the internal LAN into at least two VLANs. One VLAN holds the office PCs, another holds the servers that store customer data. A managed switch can enforce that traffic between VLANs must pass a router with ACLs. This way, if a workstation gets compromised, the attacker cannot jump straight to the database server.

• VLAN 10 – employee workstations
• VLAN 20 – file and application servers
• VLAN 30 – guest Wi‑Fi
• VLAN 40 – IoT devices like printers

Each VLAN has its own firewall rules. For example, VLAN 30 only gets internet access, no routes to the internal subnets. That cuts off a common path for ransomware that spreads via guest Wi‑Fi.

Strong Authentication

Passwords alone are not enough. I require multi‑factor authentication (MFA) for any admin account and for any remote connections. A Time‑Based One‑Time Password (TOTP) app works fine and costs nothing. For the local network, enforce a password policy that requires at least 12 characters and a mix of letters and numbers.

On Windows machines you can enable Windows Hello for Business, which ties a biometric factor to the domain login. On Linux you can add pam_google_authenticator to the SSH login flow.

Patching and Updates

Software that stays unpatched is an open door. I set up a schedule: every Tuesday check for OS updates, every Thursday check for application updates. Use a tool like Ansible to push patches across the fleet.

- name: Apply security updates
  apt:
    upgrade: yes
    update_cache: yes

The playbook runs on all Debian‑based machines and is easy to adapt for other distros. Keeping the patching process automated reduces the chance you forget a critical fix.

Monitoring and Logging

Any defence is weak if you cannot see what is happening. A central Syslog server collects logs from firewalls, routers, servers and workstations. I recommend rsyslog on a dedicated VM and a simple dashboard like Graylog to browse events.

Set alerts for repeated failed logins, unusual outbound connections, or large file transfers. When an alert fires, you can investigate immediately instead of discovering the breach weeks later.

Backups and Recovery

Even with many layers, a breach can happen. The last line of defence is a reliable backup strategy. I keep three copies: one on‑site fast backup for quick restores, one off‑site encrypted snapshot for ransomware protection, and a third copy in a cloud bucket with versioning turned on.

Test the restore process every month. A backup that you never open is as good as no backup.

Employee Awareness

People are often the weakest link. I run a short monthly briefing that covers phishing signs, safe USB use, and the importance of reporting odd messages. No need for a long lecture; a five‑minute reminder keeps the topic fresh.

Putting It All Together

All these pieces form a layered approach. The firewall stops obvious scans, VLANs stop lateral movement, MFA blocks stolen credentials, patches close known holes, monitoring spots the oddball, backups let you recover, and awareness reduces the chance an employee clicks a link.

If you start with the firewall and add one layer each month, you will have a robust defence without blowing the budget. The key is to keep each layer simple enough that you can maintain it, and to verify that it actually works by testing with a port scanner or a credential‑spray tool in a controlled environment.

That’s the gist – a small business can get solid depth without hiring a security team; just a few devices, a bit of scripting, and a regular habit of checking the logs.

Photo by Ludovic Delot on Pexels