Information Security & Firewall in Novo Hamburgo - RS

One policy, administered from one place

The structural change is moving from independent edge devices to a centrally administered fleet: same equipment, same policy, changed in one place and propagated to all.

That has three compounding effects. The rule now applies identically at every address, so there is no more weak site by inheritance. A change is made once instead of ten times, which transforms the economics of any improvement — blocking a new category, adjusting an access rule, closing an exposure stops being a project. And visibility finally exists: it becomes possible to answer what is allowed at each site without visiting any of them.

For an operation served remotely, that third item is decisive. Without central administration, answering "does this rule exist at store X?" requires access to that specific device, with the specific credential someone configured years ago.

Opening a site with the policy ready

With a standardized edge, opening a new site includes applying an existing configuration rather than building a new one. The site is born with the same policy as the others, the same level of protection, and already visible in central administration.

It is the opposite of the usual pattern, where the new site starts on factory settings and gets adjusted as problems surface.

What to separate inside each site

In a customer-facing operation, three segments resolve most of the risk.

The corporate network, with the workstations and access to business systems. The guest network, isolated from everything — no reach to servers, workstations, terminals, or the other devices connected to it — and with a bandwidth cap, so the public does not consume the path the operation depends on. And the segment for what sustains sales: the terminal, the payment device, and the fiscal printer, which deserve their own treatment given their criticality.

On a high-traffic day, the guest network cap stops being a detail. Without it, dozens of customer devices compete with the payment device, and the symptom is a slow card machine at exactly the moment the queue is longest.

Prioritization on a small site's link

A point-of-service location rarely has bandwidth to spare. Without priority rules, everything competes on equal terms, and what loses is whatever is most sensitive to delay.

The ordering that works puts first what interrupts a sale: the payment path, fiscal issuance, and telephony. Then what delays without interrupting: the management system, inventory lookups, file access. Last, what tolerates waiting: backups, updates, general browsing, and the guest network.

Where there are two paths, SD-WAN adds a continuous choice between them, measuring latency, loss, and jitter, with automatic failover when one degrades. The secondary link does not need to replicate the primary — it sustains the essentials — and it is worth more if it uses a different technology, because it fails for different reasons.

Site-to-site traffic and the central system

A multi-site operation usually runs centralized management and inventory systems, queried from every address. That traffic is internal, not browsing, and should be classified and prioritized as such.

Communication between sites deserves its own rule: a site needs to reach the central system, not the other sites or their workstations. Allowing only what is necessary limits the reach of any incident to the address where it started.

The sectors that drive demand in Novo Hamburgo

Professional services, industry, retail, and technology make up the city's profile. Retail and services concentrate the guest network, the payment path, and multi-site operations. Industry brings equipment that cannot be updated and vendor access, both handled through isolation. Technology companies demand finer-grained policy, with separation between environments and access logging.

How we run the deployment

It starts with a survey of every site: links, edge equipment and its support status, inherited rules, active remote-access paths, and the actual traffic. That inventory usually reveals how far apart the addresses have drifted.

Then comes the design — a single policy with the defined segments, classification and prioritization of critical traffic, the guest network cap, the site-to-site communication rule, and authenticated remote access with individual credentials.

Activation happens site by site, scheduled outside business hours, because swapping the edge device interrupts connectivity for a few minutes. Afterwards, rules are tuned against observed traffic and link behavior is monitored continuously — without that, nobody notices when the secondary path stops working.