The Internet Company Installed Our Router Years Ago and Nobody Has Touched It Since. Is Our Network Actually Secure?

The owner of a family restaurant in Clarion asked us a simple question last winter: "Is our network secure?" The honest answer took a walkthrough to find. The router was the one the internet provider dropped off when the restaurant opened. The wifi password printed on the menu board was the same network the card terminals used. The office PC, where payroll ran, sat on that same network too. A camera system installed by a security company had a port opened to the internet so the owner could watch the dining room from a phone, and the camera's admin password was still the factory default.

Nothing had gone wrong yet. That was the whole reason nobody had looked.

This post is built from a composite of what we find when we walk into small offices, shops, and restaurants across Clarion, Venango, Mercer, Butler, and Crawford counties and in the Youngstown area. It explains what network security for small business actually means, where most small networks are exposed, what the regulations tied to card payments and patient data expect, and how to fix it in a sensible order.

What does network security for a small business actually mean?

Most small business owners picture cybersecurity as something that lives on the computers: antivirus, updates, maybe a training video. Those matter. But every one of those computers sits on a network, and the network decides who can reach what.

Small business network security comes down to five questions:

1. What is allowed in from the internet, and what is allowed out? That is the firewall's job.

2. Can a device on one part of the network reach everything else? That is segmentation. A guest phone on the wifi should never be able to see the payroll PC.

3. How do people and vendors connect from outside the building? Remote access is the most common way attackers walk in.

4. Are the network devices themselves maintained? Firewalls, switches, and wireless access points run software that needs updates just like a laptop does.

5. Is anybody watching? A network that nobody monitors only tells you something is wrong when it stops working.

If you can answer all five with confidence, you are ahead of most small businesses in the region. If you cannot answer any of them, you are in the same place the Clarion restaurant was.

Is the router your internet provider installed enough?

Usually not, and it is not the provider's fault. The box they install is designed to get you online with the fewest support calls. It does basic address translation, which hides your devices from casual scanning, and that is about it.

A business firewall that is configured on purpose does several things a provider's router does not:

• Blocks outbound traffic you never meant to allow. Most small networks let anything inside talk to anything on the internet. A compromised PC can quietly send your data out, and nothing stops it.
• Filters known bad destinations. Blocking connections to known malicious sites catches a lot of phishing clicks after the click happens.
• Handles remote access properly. A real VPN with multi-factor authentication, instead of a port opened to a desktop or a camera.
• Logs what it does. When something goes wrong, the firewall log is often the only record of what left the building and when.
• Gets firmware updates. Firewalls from every major vendor have had serious vulnerabilities in recent years. A firewall nobody updates becomes the way in.

The test is simple. Ask whoever handles your IT: who has the admin login to our firewall, when was its firmware last updated, and what rules are open to the internet right now? If nobody can answer, that is your first project. Our firewall configuration work almost always starts with that inventory, because the open rules left behind by old vendor projects are where the surprises live.

Why should guest wifi, card terminals, and office computers be on separate networks?

Because the cheapest device on your network sets the security level for all of it.

In the Clarion restaurant, the menu board wifi, the card terminals, the office PC, the cameras, the smart thermostat, and the music system all shared one flat network. A customer's infected phone, or a camera with a known flaw, had a direct path to the machine running payroll and to the terminals handling card data.

Segmentation fixes that by splitting one network into several that cannot see each other unless you allow it. For a small business, that usually means:

• Guest wifi that reaches the internet and nothing else.
• Payment devices on their own segment, talking only to the payment processor.
• Office and staff computers on the business network.
• Cameras, printers, door controllers, and other smart devices on a separate segment, because they are rarely patched and often ship with weak defaults.

This does not require ripping out equipment in most cases. It requires a business-grade firewall and managed switches and access points that support separate networks, set up by someone who documents what they did. Switch configuration and a proper wifi survey are usually part of the same project, because a flat network and dead spots in the kitchen tend to come from the same original install.

How should employees and vendors connect from outside the office?

Remote access is where small business networks get broken into most often, and it is usually set up in a hurry. Someone needed to work from home, a vendor needed to support the point of sale, the owner wanted to see the cameras, and each request got its own hole in the firewall.

A safer setup looks like this:

• One front door. Remote users connect through a VPN or a managed remote access tool, not through ports opened straight to individual machines.
• Multi-factor authentication on every remote connection. No exceptions for the owner, and no exceptions for the vendor.
• Named accounts. Every employee and every vendor technician gets their own login, so you can see who connected and shut off one person without changing everyone's password.
• Vendor access that is off by default. The point-of-sale company or the software vendor connects when they have a reason to, and the access is turned off after.

We wrote more about what safe remote access looks like from the support side in our post on remote IT support for small business.

Who is watching the network, and how would you know if something was wrong?

This is the question behind a lot of searches for the best network monitoring tools, and the honest answer is that the tool matters less than whether a person is reading what it says. Plenty of small businesses own a firewall that can send alerts. The alerts go to an email address nobody checks, or to a technician who left two years ago.

Useful monitoring for a small network covers a short list:

• Is every important device up? Firewall, internet connection, switches, access points, servers.
• Did something new show up? A device nobody recognizes plugged into the network is worth a phone call.
• Is anything talking to places it should not? Unusual outbound traffic is one of the earliest signs of a compromised machine.
• Are the network devices current? Firmware versions tracked against known vulnerabilities, not checked once a year.
• Who responds? A named person or team who sees the alert and acts on it, during business hours and after.

That last point is the difference between owning software and having security monitoring. For a restaurant that closes at 10 p.m. or an office that empties at 5, the hours when nobody is in the building are exactly when an attacker prefers to work.

What do PCI and HIPAA expect from small business network security?

Network security is not only good practice. For many small businesses in the region, it is a line item in a compliance obligation they already carry.

If you take cards (PCI DSS). Any business that accepts credit cards agrees to follow the Payment Card Industry Data Security Standard through its processor. The standard expects network security controls (a properly configured firewall), multi-factor authentication for remote access into the systems that handle card data, and secure configuration of the devices involved. Segmentation is not strictly mandatory, but separating payment devices from everything else shrinks how much of your network falls under the standard, which makes the annual questionnaire far easier to answer honestly. Restaurants, retailers, and service businesses that run cards are the most common example in our area. If you handle patient information (HIPAA). Medical and dental practices must protect patient data in transit and control who can access it. A flat network where the guest wifi in the waiting room shares space with the imaging server is the kind of finding that shows up on a HIPAA security risk assessment. If you are a financial business (FTC Safeguards Rule). Accountants, tax preparers, auto dealers that arrange financing, and similar businesses fall under the FTC Safeguards Rule, which requires multi-factor authentication, encryption, and either continuous monitoring or regular testing of the network. Cyber insurance. Insurers now ask directly about MFA on remote access, firewall management, and monitoring. A "no" on those questions can raise the premium or void a claim.

What does a small business network security checklist look like?

If you want to check your own network before calling anyone, start here:

1. Write down who has the admin login to the firewall, and confirm it is not a shared or default password.

2. Find out when the firewall firmware was last updated.

3. List every rule or port open to the internet and who asked for it.

4. Confirm guest wifi cannot reach your office computers or printers.

5. Confirm card terminals or patient systems are separated from everything else.

6. Check that every remote connection requires multi-factor authentication.

7. Change the default passwords on cameras, printers, and other smart devices, or take them off the internet.

8. Find out where network alerts go, and who reads them.

Most owners can answer two or three of these. That is normal. It is also the gap a cyber security audit is designed to close in writing.

What happened at the Clarion restaurant?

The fix took two evenings after close and one short follow-up visit. The provider's router went into bridge mode and a business firewall took over. The network was split into four segments: guest wifi, payment terminals, office, and cameras and devices. The open camera port was closed, and the owner now views the cameras through a VPN app on the phone, with a code on every login. The point-of-sale vendor got its own named account that the restaurant turns on when they call. Every network device went onto monitoring, with alerts going to a person instead of an inbox.

The next PCI questionnaire took the office manager twenty minutes instead of an afternoon of guessing. Nothing about the restaurant's day-to-day operation changed, except that the menu board wifi now actually is just for guests.

That is what network security for small business should look like: not a pile of products, but a network set up on purpose, documented, and watched. For where network work fits among everything else a small business might buy, see our guide to cybersecurity services for small business.

MCR Business Tech Solutions designs, secures, and monitors business networks for offices, practices, shops, and restaurants across Clarion, Venango, Mercer, Lawrence, Butler, Crawford, Erie, and Allegheny counties in Western Pennsylvania, and Trumbull and Mahoning counties in eastern Ohio. If you are not sure who has the keys to your firewall, call 833-859-9021 or Request an IT assessment through our contact page. We will walk the network, show you what is exposed, and fix it in the order that matters.