Should I have a firewall at my office

Circumstances Have Changes

In the past, the answer would have always been yes!

But circumstances have changed:

1. Fewer companies have an office, and if they do, most of the team is at home most of the time
2. Fewer companies have on-premise servers
3. Hackers are targeting cloud identities instead of your office network

This means the decision to have or not have a firewall is less clear-cut.

1. Is my business more resilient and secure with a firewall?
2. Could this security budget be better spent elsewhere?

Is my business more resilient and secure with a firewall?

The answer is yes. However, firewalls, their installation, and annual security services are expensive.

The more important question is about economics.

What protection do you get if you install a firewall, and what is it protecting?

Protections

A firewall sits on the edge of your network and scans all incoming and outgoing traffic for malicious activity.

Your computers do this too, but only for traffic getting to them. But a good firewall will stop this malicious activity before it gets to your computers. If the user is in the office, behind the firewall.

If you install a firewall in your office and only have five people working from that location, it only protects five people. If the remainder of your workforce is at home, it provides no protection.

It only makes sense to install a firewall if you are protecting many people or have on-premise server resources to protect. If you do not, the budget will be better spent on other security services.

I recommend that clients with less than twenty concurrent users in the office invest their money in identity protection, not network perimeter protection.

Could This Security Budget Be Better Spent Elsewhere?

Zero Trust frameworks suggest we redefine the ‘Identity’ as the perimeter. If you have very few users in the office, I recommend investing in Identity protection.

If you are a Microsoft 365 user, which I highly recommend, and you use a Business Premium license, you can use Conditional Access and Intune to deploy enterprise-grade identity protection. Data shows this approach improves security and resilience:

• Identity-Centric Security – According to Verizon’s 2023 Data Breach Investigations Report, 74% of breaches involve human elements, including privilege misuse and compromised credentials. Enforcing strict identity verification and least privilege access drastically reduces risk.
• Research shows that organisations adopting Zero Trust see a 50% reduction in breaches compared to traditional perimeter-based security models.

Verdict

If you can’t afford to do both a firewall and identity protection, and you have less than twenty users in the office, choose identity protection.

If you have more than twenty, I would encourage you to do both.

Deploying identity protection for M365 Business Premium users represents a one-off cost. Budget and plan for it in the next 24 months. It’s the best way to improve resilience today.