Information Security & Firewall in Canoas - RS

Traffic between sites is not web browsing

The first adjustment is conceptual, with a direct technical consequence. When a system runs at one address and is used at another, the traffic between them is internal — even if it physically crosses the internet.

Treated as ordinary browsing, it competes on equal footing with downloads, updates, backups, and streaming. Treated as internal, it is classified, prioritized, and measured, and gains a guaranteed path in moments of contention.

The difference shows up at exactly the times that matter most: shipping cutoff, shift change, month-end close. Those are the predictable peaks where, without a rule, critical traffic loses to what could have waited.

Latency and loss matter more than bandwidth

For an application that makes many small requests — and ERPs and management systems are exactly that — what determines the feeling of speed is round-trip time, not channel width. Buying more bandwidth does not improve that number.

What improves it is reducing loss and jitter: loss forces retransmission, and each retransmission costs a full round trip. A small loss rate that goes unnoticed in web browsing visibly degrades a conversational application.

That is why SD-WAN measures latency, loss, and jitter continuously and picks the path by those criteria rather than by nominal speed. With two links, the switchover happens when one degrades — not only when it drops.

The second path, sized for the essentials

The usual objection is the cost of a link equivalent to the primary. It is not needed: the secondary path exists to sustain what cannot stop — ERP, shipping, tax document issuance, telephony — not to replicate total bandwidth.

In that logic, a different technology from the primary is worth more than more bandwidth over the same technology, because it fails for different reasons. Two links riding the same physical infrastructure tend to drop together, and that defeats the purpose.

Segment between sites, not just inside them

Here is the point multi-site operations most often miss. After interconnecting the addresses, the common outcome is a single flat network: any device at the plant can reach anything at the head office, and vice versa.

That is not what you want. Shipping needs the ERP, not the finance department's file share. A handheld scanner needs to talk to the system, not to the executive suite's workstation. The correct rule allows between sites only the traffic the operation requires, and denies the rest by default.

That limits the reach of an incident, and it is the most effective measure in a distributed setup: a compromised workstation at one site sees that site and the systems it uses, instead of seeing the entire company.

A standardized edge at every address

When each site keeps whatever edge device the carrier left behind, the security policy is different at every location — and nobody knows exactly what it is at any of them.

Standardizing the edge, with the same device and the same policy administered from a single point, has three effects: the rule applies equally at every address, a change is applied once, and the smallest site stops being the easy way into the rest of the network.

Remote and vendor access

Industrial operations have vendors coming in to service systems and equipment, and people connecting from outside. Solved in a rush, that leaves port forwarding open — and the initial survey of a never-reviewed environment always finds a few still active, created during some long-forgotten urgency.

The treatment is authenticated access with individual credentials, a second factor, permission limited to the required destination, and an expiry date when temporary. Individual matters: shared access makes it impossible to know who did what, or to revoke without affecting everyone.

The sectors that drive demand in Canoas

Manufacturing, logistics, services, and retail define the city's profile. Manufacturing concentrates system integration and vendor access. Logistics depends on the link for shipping and tracking, with a cost per hour that is well defined. Services and retail weigh in on payment processing and tax document issuance, where unavailability stops the sale.

How we run the deployment

It starts by mapping what exists at each address: contracted links, edge equipment, inherited rules, active remote accesses, and the real traffic between sites. A firewall deployed without that survey blocks what the operation uses and leaves open what nobody ever mapped.

Then comes the design — segmentation inside each site and between them, policy per segment, classification and prioritization of critical traffic, and an authenticated remote access structure.

Cutover happens in a window agreed with the operation — the practice we keep on record for this city — because intervention at the edge drops the connection for a few minutes. After go-live, rules are tuned against observed traffic and link behavior is monitored continuously — without that, nobody notices when the secondary path stops working, and it will only be called upon the day the primary drops.