A connection is only the start
Business broadband security combines a reliable internet connection with protected routers, separated Wi-Fi, correctly configured firewalls, software updates, access controls, and monitoring.
Fibre broadband or a leased line can improve speed, bandwidth, and availability. A leased line can also provide symmetrical speeds and a contractual uptime commitment. Neither option automatically protects devices, accounts, or data.
As of October 2026, the latest UK Government Cyber Security Breaches Survey found that 43% of UK businesses with employees had identified a breach or attack in the previous 12 months. Within the same survey population, the figure was 46% among small businesses and 65% among medium-sized businesses. Phishing affected 38% of businesses in that population.
A secure connection is therefore one layer within wider cyber security for SMEs. Threats can target employees, cloud accounts, laptops, and phones without attacking the broadband line itself.
A securely managed connection
A securely managed connection has known devices, protected boundaries, separated guest access, supported software, restricted administration, and clear responsibility for alerts and changes.
These controls reduce unauthorised access and limit how far an attacker can move if one device is compromised. They also make suspicious changes easier to spot.
The Information Commissioner’s Office explains that UK GDPR security is risk-based. Businesses handling personal data need appropriate measures for confidentiality, integrity, availability, restoration, and regular testing. No broadband package meets that responsibility by itself.
Before you change anything
Secure broadband changes begin with a complete asset list, named owners, and a way to reverse the work.
Gather these prerequisites before changing router, Wi-Fi, or firewall settings:
- Record internet gateways, routers, access points, switches, work devices, permitted personal devices, and home-working equipment.
- Collect administrator access details, saved configurations, model numbers, support status, and supplier contacts.
- Document necessary services such as remote access, guest Wi-Fi, printers, cloud applications, and public-facing systems.
- Assign owners for the broadband service, router, firewall, firmware, and security alerts.
- Agree a maintenance window and rollback route in case a legitimate service stops working.
- Write down which tasks belong to the business, carrier, IT provider, and cyber security provider.
Do not assume that a carrier maintains equipment or monitors security unless the contract says so.
Secure broadband in 7 steps
Secure broadband by controlling every route between the public internet and business information.
1. Map every route online
Record every gateway, network device, work device, and account that can reach business information.
Include office equipment, organisation-provided home routers, remote workers, and personally owned devices allowed to access company systems. The National Cyber Security Centre’s network security guidance warns that unknown or unsecured systems can create an entry point.
Assign an owner to every item and record whether the manufacturer still provides security updates. The result should be a defined boundary with no forgotten access points or unsupported routers.
2. Lock down the router
Protect the router by replacing default administrator credentials, disabling internet-facing management, and installing supported firmware.
Save the configuration before making changes. Use a strong, unique administrator password, and restrict management access to authorised people and trusted devices.
An NCSC alert about router hijacking described attackers changing Domain Name System (DNS) and automatic network-address settings to redirect selected login and email traffic. Unexpected DNS changes can therefore signal compromise.
If the router no longer receives updates, replace it rather than leaving a known weakness at the network boundary.
3. Separate business and guest Wi-Fi
Separate guest Wi-Fi from the network used by employees, printers, servers, and management interfaces.
Use secure encryption supported by the access point, set strong credentials, and disable Wi-Fi Protected Setup (WPS). Cabinet Office workplace guidance advises against WPS because its PIN can be vulnerable to guessing attacks.
Enforce separation with a virtual local area network (VLAN), routing controls, or firewall rules. IASME’s Cyber Essentials scope guidance treats guest Wi-Fi as separate only when outside users cannot interact with organisational data or services.
Test with a real guest device. It should reach the internet but not internal addresses, file shares, printers, or administration pages.
4. Set firewall and DNS rules
Configure firewalls to block unauthenticated inbound connections by default and permit only traffic with a documented business need.
The Cyber Essentials requirements for IT infrastructure require correctly configured firewalls for in-scope devices. Each permitted inbound rule needs approval, documentation, and a business justification.
Remove obsolete rules rather than leaving them available “just in case”. Protect internet-facing administration with two-step verification or a tightly restricted trusted-address list.
Use DNS filtering where appropriate to block access to known malicious domains. Keep endpoint firewalls active on laptops used in homes, hotels, and other untrusted networks. The office firewall cannot protect a device that is elsewhere.
5. Patch every connected device
Enable automatic security updates for router firmware, operating systems, browsers, applications, firewalls, and anti-malware tools.
The NCSC’s device guidance recommends replacing products that no longer receive security support. Unsupported equipment can retain known defects indefinitely.
Cyber Essentials v3.3 sets a benchmark of installing qualifying critical or high-risk fixes within 14 days. Remove unused, unsupported applications and create a replacement plan for ageing network equipment.
6. Restrict accounts and administration
Limit administration to named people, protected accounts, and tasks that genuinely require elevated access.
Use passkeys where supported. Otherwise, use unique passwords with two-step verification. Keep separate administrator accounts for privileged work and standard accounts for everyday email and browsing.
The NCSC’s account security guidance recommends reviewing access regularly and disabling accounts belonging to departed employees, contractors, or suppliers. Store recovery codes securely so a lost phone does not lock the business out.
7. Assign monitoring and change control
Define who reviews logs, applies updates, approves firewall changes, handles alerts, and escalates suspected incidents.
“Managed broadband” does not automatically mean managed firewall maintenance, round-the-clock security monitoring, or incident response. The NCSC’s guidance on choosing a managed service provider recommends documenting responsibility for patching, monitoring, firmware, firewall changes, and reporting.
Confirm support hours, alert routes, change approval, and provider access. Ask what happens after an alert, not just whether alerts are generated. Every control should have a named owner and a tested escalation route.
Pass these security checks
A business broadband setup passes its basic security check when every device, boundary, account, and supplier responsibility can be verified.
Confirm that:
- Every router, gateway, access point, and work device is recorded, supported, and owned.
- Default credentials have been removed.
- Router management is unavailable from the public internet.
- Guest devices cannot reach internal systems or management pages.
- Unauthenticated inbound connections are blocked unless formally approved.
- Obsolete firewall rules have been removed.
- Administrator access uses two-step verification.
- Automatic updates, endpoint firewalls, and anti-malware protection are active.
- Logs have a reviewer and an escalation route.
- Supplier responsibilities, support hours, and change procedures are documented.
Fix common setup problems
Common broadband security problems should be reversed carefully, recorded, and escalated through the correct support route.
- Connection fails after a change: Restore the saved configuration and record what changed. Ofcom advises businesses to note when the fault began and which checks have already been completed.
- Update path is unclear: Use the manufacturer’s official support page. Connect the device to reliable power and internet access before updating.
- Guest devices reach internal systems: Recheck VLAN, routing, firewall, and wireless isolation settings before reopening guest access.
- DNS settings change unexpectedly: Treat the change as suspected compromise and follow the manufacturer’s reset and firmware-integrity process.
- Internet access returns after a fault: Continue the security checks. Restored connectivity does not prove that router settings, accounts, or devices are safe.
Questions beyond the office
Business broadband security must account for remote workers and legal duties, but the controls depend on ownership and risk.
Do home-working routers count? Organisation-provided home routers fall within Cyber Essentials scope. Other home routers may sit outside that boundary, but work devices still need correctly configured firewalls and supported software.
Does UK GDPR require a particular broadband package? No. UK GDPR requires safeguards appropriate to the personal data, available technology, implementation cost, and identified risks. A particular connection or firewall does not satisfy that duty automatically.
Put one owner in charge
One named owner should close responsibility gaps before the business buys more technology.
Blowfish Technology can manage connectivity, Wi-Fi, firewalls, DNS filtering, and related cyber security controls through one accountable team. Our ISO 27001 and Cyber Essentials Plus credentials are independently audited, not claimed, and we have supported businesses from Ormskirk since 2012.
Ask Blowfish to review who owns each connectivity and security control in your business.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.