Network security doesn’t need to be complicated to cover the essential basics — a handful of specific measures, applied consistently, address the majority of common risk regardless of organisation size or industry.

What you’ll learn

  • The specific basics every network should have
  • Why each one addresses a distinct kind of risk
  • What’s most commonly missing in practice

A properly configured firewall

Not a default configuration left unreviewed since installation, but rules built around your actual traffic — restricting what’s allowed rather than broadly permitting by default. See our piece on firewall security for what “properly configured” actually means.

Network segmentation

Guest Wi-Fi, staff devices, and sensitive systems (finance, CCTV, servers) should sit on separate network segments, not one flat network where everything can technically reach everything else. This is one of the most commonly missing basics in organisations that haven’t had an independent assessment.

Endpoint protection on every device

A firewall protects the network boundary; endpoint protection protects each individual device, which matters because a large share of real compromises start with a single infected device, not a direct network breach.

Multi-factor authentication for remote and administrative access

Anyone accessing your network remotely, or with elevated administrative privileges, should be required to use MFA — a basic control that significantly reduces the risk of a stolen or guessed password alone granting access.

Monitoring for unusual activity

Even basic monitoring — flagging unusual sign-in patterns or unexpected traffic between segments — catches signs of trouble that would otherwise go unnoticed until a breach is already well underway.

Documented, reviewed configuration

Security configuration that’s never reviewed after initial setup tends to drift from what’s actually needed as your network changes. An annual review, or a review after significant change, keeps configuration matched to reality rather than assumption.

A written policy covering the basics

Beyond the technical controls, a short written policy — password requirements, access approval process, what to do if a device is lost — makes these basics something staff are actually expected to follow, rather than something that exists only in configuration nobody’s told them about.

These basics work together, not in isolation

None of these measures fully substitutes for another — a firewall doesn’t replace the need for segmentation, and MFA doesn’t replace the need for monitoring. The value comes from having all of them in place together, each covering a different way a real incident could unfold.

Checking your own network against this list

If more than one of these basics is missing or uncertain in your own network, a cybersecurity assessment will confirm specifically where the gaps are, rather than leaving you to guess. Treat this list as a starting checklist you can work through directly with whoever manages your network today.