Information Security & Firewall: coverage in Palhoça - SC

Three networks, three levels of trust

The separation starts by recognizing that the devices come from different origins. An administrative workstation is managed by the institution. Lab equipment is known, but handled by many people. A student's device is unknown by definition — and will remain so, because demanding control over personal phones is simply not viable.

The design reflects that: the student network gets internet access and nothing else; the teaching network reaches what classroom activity requires; and the administrative network stays isolated, reachable only from managed devices. Traffic between them flows only where there is a real, explicitly authorized need.

Minors' data demands additional care

An institution serving children and adolescents processes personal data under the reinforced protection of LGPD, Brazil's data protection law. That pulls in concrete requirements: controlling who can access the academic system, keeping records that allow access to be audited afterwards, and segregation that prevents an unmanaged device from ever reaching that data. This is not excess caution — it is what the law expects from anyone holding this class of information.

Content policy and the student network

A network open to hundreds of personal devices needs a usage policy. That includes per-device bandwidth limits, so that one person downloading heavy content does not degrade the connection for an entire classroom, and content filters appropriate to the environment and the age groups served.

The balance point is institutional, not technical: it is up to the school or college to define what is appropriate, and up to the infrastructure to enforce that decision consistently at every point on the campus.

Continuity during the school term

Internet down on a campus mid-class is not an administrative inconvenience — it is activity interrupted, with a lot of people left waiting. Where the operation depends on cloud systems for attendance, content, or assessment, a link failure stops the entire institution.

SD-WAN with two active links and automatic failover covers that scenario without depending on someone being available to reconfigure anything. It also enables prioritization: traffic from the academic system and teaching activity passes ahead of general consumption on the student network, keeping the essential running even under load.

Multiple sites and growth

An institution with more than one address — or a services company with an office in Palhoça and a unit in São José or Florianópolis — gains from administering a single policy. The rule becomes the same at every site, and a change made once propagates everywhere, instead of each address accumulating its own configuration over time.

Deployment on the right calendar

In an educational environment the window is clear: vacation and recess. That is when migration, testing, and adjustment can happen without impact. The work is planned to fit inside those windows, with the new environment built in parallel and a rollback point defined at every stage.

It also means the conversation has to start well in advance. A project decided in November rarely fits into the December window; one decided in September fits with room to spare.