Information Security & Firewall: coverage in Curitiba - PR

A flat network is the inherited default, not a choice

Almost no company ever decided that everything should talk to everything. The environment simply grew that way: each new device joined the same network because that was what worked, and nobody went back to separate things.

The practical consequence is that the reach of any problem is the entire environment. A compromised workstation in sales can see the file server, the finance system, and the partner's machine. Not because anyone allowed it — because there was never a division.

Segmenting means dividing the environment by function and allowing only the traffic that needs to exist: workstations in one segment, servers in another, guests in a third, equipment administration in a fourth, restricted one. It is configuration work, not a purchase, and the return is capping the damage of any future incident.

Administrative access is the segment that matters most

One segment delivers disproportionate value: management. The administration interfaces of the firewall, switches, virtualized servers, and storage should not be reachable from the same network where people read email.

Separating it is cheap and changes the outcome of an incident. A compromised workstation on a flat network means the attacker can see the administration panel of everything. With management in its own segment, the attacker sees one workstation.

What the audit asks, and how configuration answers

Vendor questionnaires tend to ask the same things, and each one has a direct technical translation.

Who has access, and to what — answered with individual credentials per person, never shared, and with policy by group rather than by exception. How access is revoked — answered with an offboarding process that disables the credential, which is only possible if the credential is individual. How long records are kept — answered with a log retention period that is defined and verified, not with "the device keeps something."

And what the environment allows out — the forgotten part. Egress control limits where data can go, which matters as much as controlling who gets in.

Third-party and remote team access

A modern corporate operation has people coming in from outside every day: staff working remotely, contractors, a software vendor doing maintenance, an auditor requesting temporary access.

The wrong way to solve this is the fastest one: open a port and send the password. It works, stays active for years, and nobody remembers it exists. The initial assessment of an environment that has never been reviewed always turns up a few of these — access created in some old emergency, protected by a simple credential, still operational.

The treatment is authenticated access with individual credentials, a second factor, permissions limited to what the person actually needs to reach, and an expiration date when the access is temporary. Auditor access with an expiry date is the difference between granting and forgetting.

SD-WAN when the service lives outside

In corporate and technology environments, the traffic that matters most almost never stays inside the building: it is access to cloud services, third-party platforms, integrations, and videoconferencing. Link quality has stopped being an infrastructure detail and become the experience of the work itself.

That changes the requirement. Voice and video do not tolerate delay variation — the symptom of jitter is a choppy call, even with bandwidth to spare. Cloud applications suffer from packet loss, which shows up as intermittent slowness with no apparent cause.

With two paths available, SD-WAN classifies that traffic and routes it over whichever link is in better condition, continuously measuring latency, loss, and variation, and switching when one degrades. It is not just a fallback for outages: it is what prevents half an hour of a bad meeting.

The sectors that drive demand in Curitiba

Professional services, healthcare, technology, and education compose the capital's profile. Professional services weigh heavily on confidentiality — the client's data is the asset — and on access records. Healthcare brings clinics and laboratories, with sensitive personal data and segmentation requirements. Technology demands separation between environments and per-team policies. Education combines a student network, an administrative network, and labs — three worlds that should never meet.

How we run the deployment

It starts with the assessment: links, edge equipment, inherited rules, active remote access, administrative privileges, and the actual traffic. A firewall deployed without that map blocks what the operation uses and leaves open what nobody noticed.

Then comes the segmentation design — workstations, servers, management, guests, and whatever else the environment requires — with per-segment policy, an authenticated remote access structure, and a defined log retention period.

Activation is scheduled, because an intervention at the network edge interrupts connectivity for a few minutes. Afterwards, rules are tuned based on observed traffic, and link behavior goes under continuous watch — without that, nobody notices when the secondary path stops working, and it will only be called upon the day the primary goes down.