I'm setting up a small company (~3 employees) but having about 10 High-End PCs and maybe also open Wlan for guests. The later probably within a separated LAN.

How to provide this Wlan for guests so that guests are not able to attack somehow and how to prevent in general that no one is able to steal bank account details or something similar.

I wonder if a Zone Alarm account does the job (~200€) or if I need something bigger like Sophos (2000€)?

Certainly, the cost-benefit ratio should fit our company size.

Can anybody please tell me anything about our possible security needs?

  • @MichaelKjörling Thank you! And for "a general security"? As mentioned we do not something special, I just want to have the systems running and not somebody buying things with the help of my credit card information. – Ben Mar 2 '18 at 12:41
  • 2
    @ben why not provide the wifi on a completely different and separated network? A router that offers 2 wifi networks can be had for less than $100. – schroeder Mar 2 '18 at 17:09
  • Really? That sounds the most convient and cheap way! (I cannot vote comments but I would if I could..). – Ben Mar 2 '18 at 17:13
  • 1
    if you are looking for good practice, the UK has the CyberEssentials scheme – schroeder Mar 2 '18 at 21:15

I don't know exactly what you get from a Zone Alarm account, or exactly which capabilities the Sophos firewalls you've been recommended have, so I'm going to keep this pretty generic.

It sounds like you want to have two different networks, one "guest" network and one "employees" network. You don't say whether users who are legitimately on the employees network should be able to access devices on the guest network, but you do have concerns with users on the guest network gaining access to devices on the employee network.

This is actually a pretty easy scenario to solve.

First, you'll want a reasonably secure configuration on each computer in the employee network. Thankfully, modern operating systems are pretty reasonable in this regard, so you might be able to get away with simply a basic, no-frills installation with default settings. Make sure they are set up to apply patches in a timely manner. A host-based software firewall and antivirus software can augment this to great effect. Good passwords help, too. This is nothing fancy at all, just basic computer hygiene.

Second, you want to isolate hosts on the guest network from the employee network. There are basically two ways to do this.

The first option for creating two such isolated networks, and the one I'd probably prefer, is to buy two "small or medium business" NAT routers from your preferred vendor. I'd stay away from the home user ones, as they might not be able to deal well with the loads imposed by a somewhat large number of clients, but you definitely don't need the high-end stuff. Depending on which ones you choose, this will likely set you back up to a few hundred euros apiece. Set the two routers up in (electrical) parallel. Configure one to serve your employee network, and the other to serve your guest network. Connect both routers' upstream (WAN) port to the LAN side of whatever gives you Internet connectivity. Done. The normal firewalling and NAT functionality will serve to isolate the networks from each other in the same manner that the local network is isolated from the Internet. You can punch a hole from the employee network to the guest network if you want to, for administration purposes, but that should be it as far as any special configuration is concerned.

The second option, which relies somewhat on clients being at least somewhat cooperative, is to use VLAN (virtual LAN, typically 802.1Q) functionality. In this configuration, you'll use only one router that joins both networks, but it will need to support multiple VLANs with VLAN isolation. Assuming that owners of guest devices aren't going to want to mess with VLAN settings, and set up the default VLAN to be the guest network. Set the guest VLAN to be isolated from everything else. For the employee network, set up a separate VLAN confined to the systems that should use it, either port-based or via something like 802.1X. It might be possible to do this with a WiFi router that offers multiple wireless networks, but you'll need to make sure they are properly isolated from each other, and it'll likely give you the downsides of being stuck on a shared WiFi, including throughput limitations. Either way, the mechanics of how to do this will depend very much on the specific router and its capabilities.

The second option is more flexible, especially if used with authentication-based VLANs or other generic client-based authentication, since this would allow any properly authenticated device to join the employee network. However, it's more complex to set up, and much more opaque in the way it works. The first option requires either another NAT router in front of the two, or that your ISP provides you with multiple IP addresses (which is not a given), but rather than requiring networking expertise and an in-depth analysis of the router configuration, you can simply look at the cables and see how things fit together and how data can physically flow, then apply the normal reasoning of more or less just "WAN = potentially dangerous; LAN = assumed safe".

With this in place, chances are pretty good that the employee network devices will be unreachable by guest users via normal means, thus greatly reducing the attack surface via the guest network. The protections on each host in the employee network will further serve to stop anything that does manage to get through. This likely won't stop a truly determined attacker who has set their mind on getting into your network specifically, but most attackers don't care about you or your data! They care about easy pickings. Make your network somewhat unpalatable to the attacker, and you have dramatically reduced the odds of a non-targeted break-in or malware outbreak.

It's much the same as in the physical world: a good lock doesn't stop someone from breaking a window, and an alarm system doesn't stop someone from pointing a gun at you and telling you to turn it off. However, both increase resistance. Sometimes, making the attacker's job more difficult is sufficient to keep them from succeeding.


First off, it's worth pointing out that Technology Is Not A Panacea. No set of technologies will ever get you to a point where you can dust your hands off and walk away, satisfied that you are perfectly secure against all threats.

When you are deciding which technologies and policies to implement, you need to first determine a few things.

1) You need to determine all of your risks. You will never exhaustively categorize all of your risks, but you will need to make an approximation of what they are. This will vary business by business. Common ones are things like "web compromise of our internet facing servers", "compromise of credentials", "data theft", etc.

2) You need to categorize the cost presented to your organization for a specific risk. For example, Server 1 being taken down by a DDoS attack will cost the company $20000 per hour. An unmitigated DDoS will typically last 5 hours. Therefore, the risk of DDoS is ~$100k. You'll have a different cost per risk - a DDoS on one system may cost you lots, while a complete compromise of another system may just require you to re-image that machine.

3) Calculate the likelihood per year of each risk. For example, maybe you predict that your site will get DDoS'd once every other year, for a risk likelihood of .5

4) Multiply the likelihood by the cost - $100000 * .5 = $50k / year

5) Determine the cost to implement mitigations for that risk - Say that you want to buy an anti-DDoS service to mitigate the above risk. The vendor says "Well, we have a $60k/year option that will magically prevent all DDoS attacks. We also have a $20k/year option that will prevent 80% of DDoS attacks." Now you obviously don't want the $60k option, it costs more money than it will ever save you. The $20k option sounds good though.

Looking at the math, we see that you'll still have a residual, unmitigated risk of $10k/year from DDoS, but you're mitigating $40k by spending $20k. In this case, the tool is worth it.

This is how you determine what you need. There is no magic tool that will save you. You have to sit down, examine your risks, their potential impact, and the cost to mitigate, and make case by case decisions. Security is hard and time consuming.

Additional Reading: NIST 800-37 Guide fro Applying the Risk Management Framework

  • 1
    Nothing that you have said is incorrect, but this is not the helpful way for a micro business to start thinking about risk or security. You've fallen into a numbers hole, just like the OP. The OP states in the comment that they do not want things to crash or someone stealing bank account info. And with the unspecified threat actor, it would appear that the concern is over the guests on the wifi and the proposed treatment is host-based firewalls. Before looking to number crunching, first determine the threats. – schroeder Feb 27 '18 at 16:55
  • Once you determine your threats, then you can start thinking about mitigations. And often, mitigations for a new business do not cost a thing. – schroeder Feb 27 '18 at 16:56
  • What I said is relevant to every level of business, and is the best answer OP will get for his broad question. In a small business, OP can do everything I said on the back of a napkin, or in his head, and still be better off than the directionless shots in the dark that his question implied. You identify risks, then determine if it's worth the time and money to mitigate. Per your example, he'll identify that there is some nebulous but real risk in guest WiFi. He'll then determine that it's very cheap to mitigate it, and will go along with the deicision to mitigate. It's wholly compatible. – Adonalsium Feb 27 '18 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.