Information Security & Firewall for companies in Tijucas - SC

Segmentation is the defense for what cannot be patched

When a piece of equipment cannot receive fixes, its protection does not come from itself — it comes from what surrounds it. That is where segmentation stops being good practice and becomes the only measure available.

In practice, it means the production network does not share a segment with the administrative network. The workstation that operates the machine does not browse the internet. The vendor's remote maintenance access does not land on a flat network with visibility of everything, but on a restricted path limited to the address and port it needs, with a record of when it was used.

None of this makes the old equipment less vulnerable. It makes the vulnerability unreachable from an attachment opened in the finance department — which is the route this kind of incident usually takes.

Vendor access deserves its own attention

Remote maintenance for industrial machinery was usually enabled in a hurry, on the day the line was down. Often a port forward was left open, with a default password, working ever since.

It is worth inventorying those accesses: who has them, to which equipment, over which path, and since when. The pattern that shows up in that survey is always the same — accesses nobody knew still existed. Closing them is the best cost-benefit security fix available in an industrial environment.

SD-WAN between head office, production, and distribution

The local profile frequently involves more than one address, sometimes with the head office in Itajaí, Brusque, or Balneário Camboriú and the Tijucas unit handling production and warehousing.

In that arrangement, the traffic that matters most is the internal kind: the ERP and the shipping system running in one place and being used in another. When that rides plain internet with no treatment, the local user's experience depends on how the link is doing at that minute — and the complaint arrives as "the system is slow," never as "the link is dropping packets."

SD-WAN changes the nature of the problem. With two paths available, critical traffic is classified and routed over whichever link is in better condition, with automatic switchover when one degrades. It is not just outage failover: it is a continuous decision based on measured latency and loss.

The second link does not need to be symmetrical

A common objection is the cost of contracting a link equal to the primary. It is not necessary. The second path exists to sustain the essentials — the ERP, shipping, tax invoicing, telephony — not to replicate total bandwidth.

By that logic, a connection using a different technology from the primary is usually worth more than a bigger one of the same technology, because it fails for different reasons. Two fibers on the same pole go down together.

Prioritization when bandwidth gets tight

In a shift-based operation, the peaks are predictable: the end-of-day shipping close, shift change, the overnight backup, system updates. Without prioritization, everything competes for the same bandwidth, and what loses is always whatever is most sensitive to delay.

The practical rule that works here puts first whatever stops the operation — shipping, barcode scanners, tax invoicing, and telephony. Second, what delays work without interrupting it: the ERP and file transfers. Last, what can wait minutes or hours: backups, updates, and general browsing. With that in place, congestion stops turning into a stoppage.

The sectors that drive demand in Tijucas

Industry, logistics, services, and retail make up the city's profile. Industry concentrates the issue of unpatchable equipment and vendor access. Logistics depends on the link for shipping and tracking, with a well-defined hourly cost when it fails.

Services and retail put the weight on payment processing and tax invoicing, where downtime interrupts the sale. In operations with units in different cities, all of them share the same need: inter-site traffic has to be treated as internal, not as browsing.

How we run the deployment

The first step is mapping what already exists: contracted links, edge equipment, inherited rules, active remote accesses, and what actually flows through the network. A firewall deployed without that survey tends to block what the operation uses and allow what nobody mapped.

Then comes the segmentation design, starting with the separation between production and administration, and the definition of policies per segment. Activation happens in a window agreed with the operation — the note ASSIST keeps on record for this city, because an intervention at the network edge takes everything down for a few minutes and that has to have a scheduled time.

After go-live, rules are adjusted based on real traffic from the first weeks, and link behavior is tracked from then on. Without that tracking, nobody notices when the secondary path stops working — and it will only be called upon on the day the primary goes down.