Description
Your firewall is the front door of your network, and in many small businesses it has not been reviewed since the day it was installed. The Firewall & Security Hardening service is a focused, remote engagement that reviews your firewall and network edge, removes unnecessary risk, and leaves you with a cleaner, safer and fully documented configuration.
Overview
Firewall configurations tend to accumulate history. A port forward opened for a contractor years ago, an “allow any” rule added during troubleshooting, a remote access VPN with shared accounts, management pages reachable from the internet, firmware that is several versions behind. None of these may be causing visible problems today, but together they make your network an easier target.
This service applies a structured, checklist-driven approach, based on the principles in our free firewall hardening checklist, to your actual environment. We review what exists, agree on changes with you, implement them carefully with rollback options, and document everything. The goal is not perfection on paper but meaningful, practical risk reduction that your team can maintain.
Who it is for
- Small and mid-sized businesses with an existing firewall that has not been reviewed recently.
- Organizations that have taken over a network from a previous IT provider.
- Teams that recently experienced a security scare and want to close obvious gaps.
- Businesses preparing for a cyber insurance questionnaire or a customer security review and wanting their edge in good shape.
- IT generalists who want an expert to work through the firewall alongside them.
What is included
The standard scope covers one firewall or a single high-availability pair at one site, including its remote access VPN.
- Rule base review: identification of unused, shadowed, duplicate or overly permissive rules, and a cleaned-up rule set based on least privilege.
- NAT and exposed services: review of port forwards and published services, with recommendations to close, restrict or move them behind a VPN.
- Management plane hardening: disabling management access from untrusted networks, enforcing strong authentication, removing default and shared accounts, and enabling multi-factor authentication where supported.
- Remote access VPN review: authentication methods, individual user accounts, encryption settings and access restrictions.
- Segmentation checks: verification that guest, staff and device networks are properly isolated, with inter-network rules tightened where needed.
- Security services: review and tuning of available features such as intrusion prevention, DNS filtering or geo-restrictions, where your platform and licensing support them.
- Logging and alerting: sensible log retention, time synchronization and alerts for important events. Our guide to network monitoring covers the wider picture.
- Firmware and backups: firmware update planning and an automated or documented configuration backup routine.
Deliverables
- A findings report rating each issue by risk and describing the recommended fix.
- A detailed change log listing every change made, when and why.
- Before-and-after configuration backups.
- A summary of the final rule base in readable form.
- A list of remaining recommendations that were out of scope or deferred by you.
- A 60-minute review call and 14 days of email follow-up.
Process and timeline
Most engagements are completed within 1 to 2 weeks.
- Intake and kickoff: you complete a questionnaire covering your firewall model, services that must remain available and any known concerns. We agree secure access on a short kickoff call.
- Review (days 1–3): we export and analyze the current configuration and document findings.
- Change plan (days 3–4): we present proposed changes, explain their impact and agree which to implement and when.
- Implementation (days 4–8): changes are applied in agreed maintenance windows, with a configuration backup before each stage and testing after.
- Report and review (days 8–10): final documentation is delivered and we walk through the results together.
Hardening can affect legacy systems or undocumented workflows that rely on open access. We identify these risks during the change plan, but please tell us about any critical services, remote users or third-party vendors that connect to your network.
What we need from you
- Administrative access to the firewall, provided through a temporary account or supervised session.
- A list of business-critical services, remote users and third parties that need access.
- A decision-maker who can approve changes and maintenance windows.
- Access to any required vendor portals or licenses for firmware and security subscriptions.
- Someone available during change windows to confirm that key services work.
What is not included
- Penetration testing, red teaming or formal vulnerability assessments.
- Compliance certification or audit sign-off for any specific standard.
- Endpoint security, email security, server hardening or cloud account configuration.
- Purchase of firewall hardware, licenses or security subscriptions.
- Multiple firewalls across several sites, unless agreed in writing.
- Incident response for an active compromise. If you suspect an ongoing breach, contact a specialist incident response provider first.
The outcome
You end with a firewall that exposes only what it must, is managed securely, logs what matters and is documented clearly. You will also understand why each rule exists, which makes future changes safer. For a broader view of the whole network, pair this service with a Network Health Assessment, or keep everything recorded with our Network Documentation & Diagram Package.
Unsure whether your firewall is in scope? Contact us with the make and model before you order.
