Information Security & Firewall in Araucária - PR

Segmentation is about the rule, not the VLAN

Creating VLANs is the easy part, and the part that feels like progress. The real work is the communication policy between them — and that is the step that tends to get postponed, because it requires knowing what the operation needs, and because getting it wrong breaks things.

The right criterion inverts the usual logic: deny everything by default and allow what the operation demands, item by item. The opposite — allow everything and block whatever you remember to block — never converges, because nobody can enumerate all the things that should not happen.

In practice, that produces a small, explainable rule set: production talks to the application server on the system's ports; scanners talk to their specific service; guests talk to the internet and nothing else; equipment administration is reachable only from the management segment. If the list does not fit on a page, it is probably still allowing too much.

Discovering what the operation actually needs

The legitimate objection is: how do you know what to allow without breaking the operation? The answer is to measure before enforcing.

The environment goes under observation for a period, recording who talks to whom, and out of that comes the real list of communications — usually much shorter than feared, and usually containing two or three useful surprises. The policy is then applied in permissive mode with logging, to capture whatever was missed, and only then does it start blocking.

It is slower than enforcing everything at once, and it is what prevents the Monday morning when half the plant does not work.

Where segmentation matters most in this market

Two segments concentrate the value.

The one for equipment that cannot be patched: controllers, fixed readers, scales, line-operation systems, assets whose warranty is voided if anyone touches them. You do not protect those through updates; you protect them through isolation — communication allowed only with what they need to reach, no browsing, and vendor access that is restricted, temporary, and logged.

The management segment: the administration interfaces of firewalls, switches, virtualization, and storage should not be reachable from the network where people read e-mail. With management isolated, a compromised workstation exposes one workstation; without it, it exposes the control panel of everything.

Contractors inside the plant

In an industrial environment with many vendors circulating, segmentation is also the mechanism that makes their presence manageable. A contractor who needs to reach one machine gets a path to that machine — not to the network.

And it pays to provision a working segment for third-party equipment — the maintenance laptop, the device that shipped with the machine, the temporary network of a shutdown. Without that defined place, those devices end up connected to the nearest port, which is almost always a segment that should have stayed restricted.

A single link and the second path

Another risk on record for the city is the absence of link redundancy. The decision about a second path is usually driven by the monthly price, when it should weigh another number: how long restoration takes when the failure sits in external infrastructure.

The secondary path does not need to replicate the primary — it sustains the essentials: the production system, shipping, invoicing, telephony. And it is worth more when it uses a different technology, because it fails for different reasons; two links riding the same infrastructure go down together.

With two paths in place, SD-WAN chooses continuously by measuring latency, loss, and jitter, and switches over when one of them degrades — covering partial degradation, which is the most common scenario and the hardest to diagnose without measurement.

The sectors that drive demand in Araucária

Manufacturing, logistics, services, and B2B retail make up the city's profile. Manufacturing concentrates the unpatchable equipment and vendor access. Logistics depends on the link for shipping and integrations. Services and B2B retail weigh in on orders and invoicing, with customer-facing integrations.

How we run the deployment

It starts with the survey: links, edge equipment, existing VLANs and the actual routing between them, inherited rules, active remote access, and the observed traffic. That survey is usually the most revealing part, because it shows the distance between the diagram and the behavior.

Then comes the design — segments, a default-deny policy, isolation of equipment and management, a working segment for third parties, authenticated remote access.

Enforcement follows the path of measuring, applying in permissive mode with logging, and only then blocking. The edge cutover is scheduled in a window, because it interrupts connectivity for a few minutes. After that, rules are tuned against real traffic and link behavior is tracked continuously — without that, nobody notices when the secondary path quietly stops working.