Ask who patches your laptops and most business owners can give you a name. Ask who patches the firewall and the answer I usually hear is “our IT people look after that, I think”.
Sometimes they do. Often nobody has checked.
What the box is
Somewhere between your office and the internet sits a router or firewall. It may also run the VPN, the connection that lets your staff reach the office from home. In a small business it’s often one device, sometimes the one your internet provider posted out when you connected.
It runs its own software, and that software gets security flaws like anything else. It’s also the one piece of equipment you own that’s on the internet all day, so anyone can try it.
Why nobody is looking after it
It usually comes down to how the box got there:
- Your internet provider supplied it. Most providers give you the hardware and don’t manage it unless your plan says so. “Managed” is the word to look for in the contract. Without it, the updates are yours.
- A previous IT provider installed it. Your current provider’s contract may cover computers and Microsoft 365, and stop short of the box.
- Someone handy set it up. It worked, so nobody has logged in since.
In all three, it keeps working, so nothing prompts anyone to look.
Why it’s worth an hour now
In October, one US security advisory feed listed serious flaws in this kind of equipment from four makers. Cisco’s firewalls and Ivanti’s VPN were already being attacked. SonicWall’s had no reported attacks yet. Citrix sat in between, with related flaws under attack.
Those are mostly products for larger networks, but small gear gets attention too. The Australian Signals Directorate’s latest threat report describes hidden networks that state-backed attackers use to disguise their activity, made up mainly of compromised small office and home office routers. Yours could be useful to someone without your business ever being the target.
The same report says AI is shrinking the time between a flaw being found and someone using it. That makes “we’ll get to it at the next visit” a weaker answer than it used to be.
Three questions for whoever you think is responsible
1. Is it in scope? Ask to see it in the contract. If the box isn’t named, or the wording only covers “your IT environment”, ask them to confirm by email.
2. How fast do you patch it? A maker releases a fix. How many days until it’s on your device, and who is watching for those fixes? “We do it quarterly” is an answer. It may not be good enough for something already being attacked, but at least you know.
3. How would I know? Ask for the make, the model, the software version it’s running and the date the maker stops supporting it. Someone looking after it can tell you this quickly.
A good answer has a name, a number of days and a date in it. “It’s all covered” has none of those.
If the answer is nobody
That’s a common result and you can fix it, usually without much drama:
- Add it to someone’s job. Your IT provider may take it on for a small change to the contract. Your internet provider may sell a managed version. Get it in writing either way.
- Turn on automatic updates if the device supports them. It’s what ASD advises for small businesses.
- Replace it if the maker has stopped supporting it. Without fixes, no amount of good management helps.
- Switch off what you don’t use. If nobody has used the VPN since the lockdowns, ask for it to be turned off. ASD’s advice is to expose only what’s necessary.
Don’t log in and start changing settings yourself unless you know how to get back to where you started. A firewall that won’t let anyone out is a bad way to spend a Monday.
Who is responsible for a business firewall?
Responsibility for a business firewall or VPN sits with whoever your contract names, and in many small businesses the contract names nobody. An internet provider that supplies a router generally doesn’t update or watch it unless the plan is sold as managed. An IT support agreement may cover computers and cloud accounts and leave the internet connection out. That leaves a device facing the internet all day with no one assigned to install its security fixes. To settle it, ask three things: is the device named in someone’s scope, how many days does it take them to apply a fix, and can they tell you its make, model, software version and end-of-support date? The Australian Signals Directorate advises small businesses to turn on automatic updates and be clear about who is responsible. It advises medium businesses to keep a list of internet-facing systems and patch them promptly.
Next step
Find out the make and model, ask the three questions, and see what comes back. If the answers don’t add up, or you’d like someone on your side of the table when you ask, get in touch. The cybersecurity assessment covers this and the rest of your setup, and the internet and network review looks at what your carrier contract really covers.