12 Network Security Tips Every Small Business Should Follow

Most of the network breaches we get called in to clean up don't start with some exotic zero-day exploit. They start with a default admin password nobody changed, a router that hasn't been patched in two years, or a guest network that was never actually separated from the office file server.

Good network security isn't about buying the most expensive firewall. It's about consistently doing the boring, unglamorous things that close off the easiest paths in. Here are the 12 that matter most, roughly in order of impact.

1. Change Every Default Credential

Routers, switches, access points, cameras, NVRs — anything with a web login ships with a well-known default username and password. Attackers and botnets scan the internet constantly for devices still using them. The very first thing to do with any new piece of network gear is set a unique, strong password before it ever touches production traffic.

2. Keep Firmware Up to Date

Firmware updates aren't just new features — they're patches for vulnerabilities that are often already being exploited in the wild by the time the update ships. Set a recurring reminder (or better, use a platform like UniFi that can notify you) to check for and apply firmware updates on your gateway, switches, and APs at least monthly.

Tip: Read the release notes before updating production equipment during business hours. Schedule major firmware jumps for a maintenance window in case a rollback is needed.

3. Segment Your Network with VLANs

A flat network means that if one device gets compromised — a smart thermostat, an employee's phone, a guest's laptop — it can potentially reach everything else on the network. Segmenting devices into VLANs by trust level (trusted staff devices, IoT, guest, cameras, servers) limits how far an attacker can move if they get a foothold. See our VLAN setup guide if you haven't done this yet — it's one of the highest-impact changes you can make.

4. Use a Real Firewall Policy, Not "Allow All"

Plenty of small business networks are running with the equivalent of no firewall at all — every VLAN can talk to every other VLAN, unrestricted. If you're on UniFi Network 9.0 or newer, the zone-based firewall makes it straightforward to define exactly which zones can reach which, and block everything else by default.

5. Separate Your Guest Wi-Fi Completely

Guest Wi-Fi should be on its own VLAN with no route to your internal network, printers, or file shares — not just a different SSID on the same broadcast domain. This is a five-minute fix on most modern equipment and closes off one of the most common ways outsiders end up with a foothold on internal resources.

6. Use WPA3 (or WPA2-Enterprise) — Never Open or WEP

WPA3 is standard on any access point sold in the last few years and offers meaningfully better protection against offline password-cracking attempts than WPA2. For business networks with more than a handful of staff, WPA2/WPA3-Enterprise with per-user 802.1X credentials is even better — it means you can revoke a single employee's Wi-Fi access without changing the password for everyone else.

7. Disable WPS and UPnP

WPS (Wi-Fi Protected Setup) has known vulnerabilities that let attackers brute-force their way onto your network in hours, and most people never use the physical button anyway. UPnP automatically opens ports on your firewall at the request of devices on your network — convenient for a game console, dangerous for a business network where you don't want unattended software deciding what's exposed to the internet. Turn both off unless you have a specific reason not to.

8. Lock Down Remote Management

Never expose your router, switch, or firewall's admin interface directly to the internet. If you need remote access to manage equipment, use a VPN into the network first, or a cloud-managed platform (like UniFi's own cloud console) that doesn't require punching a hole in your firewall for the admin panel itself.

9. Require MFA Everywhere You Can

This goes beyond the network layer, but it's directly related: a compromised password is far less useful to an attacker if multi-factor authentication is required to actually log in — to your VPN, your cloud management consoles, your email, and any remote access tools. If you only do one thing from this list for your accounts (not just your network), make it this.

10. Monitor What's Actually Connected

You can't secure what you don't know about. Periodically review the client list on your controller and flag anything unrecognized — an unfamiliar device name, an unexpected vendor, a MAC address you don't recognize on a VLAN it shouldn't be on. Modern platforms like UniFi make this a five-minute check from the dashboard, not a manual audit.

11. Back Up Your Network Configuration

Ransomware and hardware failures don't just threaten your files — a wiped controller or a bricked gateway with no config backup can mean hours or days rebuilding VLANs, firewall rules, and Wi-Fi networks from memory. Automated, versioned config backups (most controllers support this natively) mean a bad day stays a bad day instead of becoming a bad week.

12. Get a Second Set of Eyes

It's easy to become blind to your own network's blind spots. An outside review — even an informal one — regularly turns up an old rule nobody remembers writing, a device that should've been decommissioned a year ago, or a VLAN that quietly stopped being isolated after a firmware reset. Compliance requirements (HIPAA, PCI, cyber insurance questionnaires) increasingly expect this kind of periodic review anyway.

Where to Start

If you only have time for three things this week: change any default credentials still in use, put your guest network on its own isolated VLAN, and check that firmware is current across your gateway, switches, and APs. Those three alone close off the majority of the easy, opportunistic attacks we see hit small business networks.