Designing a secure network architecture for a small-to-medium sized business

Designing a secure network architecture

for a small-to-medium sized business,

including firewall configuration,

intrusion detection and prevention

systems, and access control measures

Introduction

As businesses have adopted digital technologies and shifted more functions

and services online, their IT infrastructure and data have become

increasingly valuable targets for cybercriminals. While large enterprises have

of financial losses, reputational damage, and compliance penalties.

Therefore, it has become imperative for SMBs to establish effective security

controls and defenses commensurate with their needs and risks. A layered,

in-depth security architecture tailored specifically for the SMB environment

can help prevent unauthorized access, detect and stop intrusions, and

respond appropriately if an incident does occur. This paper proposes a design

for a secure network architecture for an illustrative SMB, outlining key

components such as firewall configuration, intrusion detection/prevention

systems (IDS/IPS), and access controls. The goal is to provide a cost-effective

yet comprehensive security strategy for SMBs to safeguard their critical

identified the following concerning vulnerabilities and threats:

- Lack of network segmentation allowing access between internal systems

and the DMZ

- No centralized logging or monitoring of network activity

- Vulnerable, outdated internet-facing systems like the company website

- Employees using personal devices on the corporate network

- Phishing emails targeting employees’ accounts for credential theft

- Potential for unauthorized remote access to systems via VPN or RDP

- Supply chain attacks disrupting manufacturing equipment controls

Based on this risk profile and the company’s available resources, the security

The first step is to logically segment the network into secure zones to isolate

systems and restrict lateral movement if a breach occurs. As shown in Figure

1, the proposed design divides the network into four main zones:

- DMZ: Houses public-facing servers like the website and externally-

accessible applications

- User Network: For employee laptops, workstations, and wireless access

- Operations Network: Connects industrial control, manufacturing, and IoT

devices

![Figure 1: Logical network segmentation diagram][]

_Figure 1: Logical network segmentation diagram_

flows and limits lateral movement if one zone is compromised. It also

The foundation of the security architecture is a next-generation firewall

(NGFW) appliance capable of deep packet inspection, application control, and

integrated IDS/IPS capabilities. Placed at the boundary of each segmented

zone, the firewalls will enforce granular access policies and monitor traffic

patterns for anomalies.

For starters, only necessary services and minimal required ports will be open

inbound. HTTPS and SSH port access will be allowed from trusted external

endpoints for remote access and updates as needed. Outbound, application

control rules block high-risk/unnecessary programs and limit admin access.

Figure 2 visualizes example firewall policies:![Figure 2: Example firewall

- DMZ – Allow inbound HTTPS to web servers, SSH from admin Workstations.

- Operations Network – isolate completely, allow limited necessary access.

This default-deny posture and granular control over traffic flows provide the

first line of defense against external and internal threats for critical assets on

each segmented zone. The firewalls also provide intrusion detection and

prevention capabilities.

Intrusion Detection and Prevention

Beyond packet inspection and filtering, next-gen firewalls will run optimized

IDS/IPS software modules to monitor all traffic crossing network boundaries.

Signatures, behaviors, and custom rules will identify known exploits and

anomalies indicative of attacks. Alerts allow rapid response if detections

occur.

The IDS/IPS components watch for:

- Scans of open ports or service enumeration

- Brute force login attempts

- Lateral movement between network zones

Enabled detection methods include protocol and signature analysis, real-time

forensic analysis if needed.

This layered approach to intrusion prevention – with network-level and host-

based inspection – substantially improves the chances of stopping known

and unknown threats before they can compromise assets. Centralized

monitoring also aids rapid response.

Access Controls

The final piece of the security architecture involves implementing robust

access controls to validate users, authorize systems, and audit activity. First,

802.1x network access control (NAC) will authenticate and authorize all

devices attempting to join the wireless or wired networks. Systems must

Logging all authentication events and system/application activity aids

forensic investigations. SIEM software integrates logs from across the IT

stack for correlation, alerting, and long-term archival. User entity behavior

analytics (UEBA) profiles normal user behaviors to detect anomalies

indicating compromised accounts. Regular auditing assesses access

privileges and policy compliance.

Together, these access controls establish a “zero trust” model wherein no

Implementation and Future Considerations

To deploy this proposed security architecture, the SMB could leverage

managed security services from a reputable MSSP or systems integrator.

Professionals would conduct the Installation, configuration, and initial staff

Some additional future considerations include:

- DMARC/DKIM for email to validate authenticity and block spoofing

- Dedicated security awareness training and simulated phishing exercises

- Offsite backup/DR solutions for data protection and quick recovery

By implementing these layered security controls in a phased approach, the

proposed architecture establishes a strong baseline defense tailored for the

expertise and resources exceeding internal staff capabilities. Over time, the

security posture can further mature based on evolving threats and

technologies. Most importantly, critical systems and sensitive data remain

well-protected through a defense-in-depth approach.

As businesses have adopted digital technologies and shifted more functions

increasingly valuable targets for cybercriminals. While large enterprises have

that threat actors are eager to access or exploit. If victimized by a data

breach or network intrusion, the costs to an SMB can be devastating in terms

of financial losses, reputational damage, and compliance penalties.

components such as firewall configuration, intrusion detection/prevention

systems (IDS/IPS), and access controls. The goal is to provide a cost-effective

yet comprehensive security strategy for SMBs to safeguard their critical

assets and systems.

Company Overview and Risk Assessment

The target SMB in this design case is a small manufacturing company with

50 employees that produces specialty plastics and polymers. The company

operates out of a single physical location but also utilizes cloud-based

applications and hosts a public-facing website. A preliminary risk assessment

identified the following concerning vulnerabilities and threats:

- No centralized logging or monitoring of network activity

Network Design and Segmentation

security systems, small and medium-sized businesses (SMBs) often lack the

- Vulnerable, outdated internet-facing systems like the company website

- Phishing emails targeting employees’ accounts for credential theft

implements firewall rules, enables IDS/IPS monitoring, and enforces access

controls to progressively harden the SMB’s attack surface and security

posture.

Network Design and Segmentation

The first step is to logically segment the network into secure zones to isolate

systems and restrict lateral movement if a breach occurs. As shown in Figure

1, the proposed design divides the network into four main zones:

- DMZ: Houses public-facing servers like the website and externally-

accessible applications

- User Network: For employee laptops, workstations, and wireless access

- Application Network: Hosts critical backend systems and databases

- Operations Network: Connects industrial control, manufacturing, and IoT

devices

Physically, these zones will be implemented on separate VLANs and subnets

enables robust firewall and IDS/IPS rulesets tuned for each network function.

The foundation of the security architecture is a next-generation firewall

For starters, only necessary services and minimal required ports will be open

inbound. HTTPS and SSH port access will be allowed from trusted external

endpoints for remote access and updates as needed. Outbound, application

_Figure 2: Example firewall ruleset diagram_

Specific configurations will include:

- DMZ – Allow inbound HTTPS to web servers, SSH from admin Workstations.

Outbound limited to necessary Internet access.

- User Network – Block personal services, limit admin/remote access. Filter

Internet access.

- Application Network – no public inbound/outbound access, allow specified

internal access.

- Operations Network – isolate completely, allow limited necessary access.

This default-deny posture and granular control over traffic flows provide the

Intrusion Detection and Prevention

Beyond packet inspection and filtering, next-gen firewalls will run optimized

IDS/IPS software modules to monitor all traffic crossing network boundaries.

Signatures, behaviors, and custom rules will identify known exploits and

The IDS/IPS components watch for:

- SQLi, XSS, and other common web application attacks

- Brute force login attempts

- Lateral movement between network zones

- Internal reconnaissance or privilege escalation

blacklisting, VM sandboxing, and machine learning techniques.

Administrative workstations running administrator access will have host-

all IDS/IPS deployments centrally aggregate for correlation and long-term

forensic analysis if needed.

and unknown threats before they can compromise assets. Centralized

The final piece of the security architecture involves implementing robust

access controls to validate users, authorize systems, and audit activity. First,

802.1x network access control (NAC) will authenticate and authorize all

devices attempting to join the wireless or wired networks. Systems must

adhere to security posture checks and patching requirements.

For systems and applications themselves, multi-factor authentication (MFA)

enforces strong authentication for all remote access VPN connections and

privileged administrative accounts. A directory service like Active Directory

provides centralized identity and role management. Granular ACLs authorize

only required resources per assigned groups.

system or user is implicitly trusted once on the network. They validate

identity, authorize access, log activity, and enable proactive monitoring to

detect compromised credentials or insider threats in a timely fashion.

Implementation and Future Considerations

To deploy this proposed security architecture, the SMB could leverage

managed security services from a reputable MSSP or systems integrator.

Professionals would conduct the Installation, configuration, and initial staff

training over approximately 2-4 weeks. Ongoing managed services provide

monitoring, maintenance, log correlation/alerting, and on-call incident

Some additional future considerations include:

- Secure web gateway to filter internet access more granularly

- DMARC/DKIM for email to validate authenticity and block spoofing

By implementing these layered security controls in a phased approach, the

security posture can further mature based on evolving threats and

technologies. Most importantly, critical systems and sensitive data remain

of financial losses, reputational damage, and compliance penalties.

Therefore, it has become imperative for SMBs to establish effective security

controls and defenses commensurate with their needs and risks. A layered,

in-depth security architecture tailored specifically for the SMB environment

can help prevent unauthorized access, detect and stop intrusions, and

respond appropriately if an incident does occur. This paper proposes a design

assets and systems.

The target SMB in this design case is a small manufacturing company with

- Lack of network segmentation allowing access between internal systems

and the DMZ

- Vulnerable, outdated internet-facing systems like the company website

- Employees using personal devices on the corporate network

- Phishing emails targeting employees’ accounts for credential theft

- Potential for unauthorized remote access to systems via VPN or RDP

architecture below aims to introduce controls that mitigate common SMB

attack vectors in a cost-effective way. Importantly, it creates network zones,

implements firewall rules, enables IDS/IPS monitoring, and enforces access

controls to progressively harden the SMB’s attack surface and security

Network Design and Segmentation

The first step is to logically segment the network into secure zones to isolate

systems and restrict lateral movement if a breach occurs. As shown in Figure

accessible applications

![Figure 1: Logical network segmentation diagram][]

_Figure 1: Logical network segmentation diagram_

Physically, these zones will be implemented on separate VLANs and subnets

routed through a centralized managed firewall. Critical resources in each

zone will be placed on their own VLANs/subnets for added isolation. This

network design establishes boundaries to control inbound/outbound traffic

flows and limits lateral movement if one zone is compromised. It also

enables robust firewall and IDS/IPS rulesets tuned for each network function.

Firewall Configuration and Rules

The foundation of the security architecture is a next-generation firewall

(NGFW) appliance capable of deep packet inspection, application control, and

integrated IDS/IPS capabilities. Placed at the boundary of each segmented

For starters, only necessary services and minimal required ports will be open

ruleset diagram][]

Specific configurations will include:

- DMZ – Allow inbound HTTPS to web servers, SSH from admin Workstations.

- User Network – Block personal services, limit admin/remote access. Filter

each segmented zone. The firewalls also provide intrusion detection and

prevention capabilities.

Intrusion Detection and Prevention

Beyond packet inspection and filtering, next-gen firewalls will run optimized

IDS/IPS software modules to monitor all traffic crossing network boundaries.

Signatures, behaviors, and custom rules will identify known exploits and

anomalies indicative of attacks. Alerts allow rapid response if detections

The IDS/IPS components watch for:

- Scans of open ports or service enumeration

- Brute force login attempts

based IDS/IPS agents for additional endpoint visibility and controls. Logs from

all IDS/IPS deployments centrally aggregate for correlation and long-term

forensic analysis if needed.

This layered approach to intrusion prevention – with network-level and host-

based inspection – substantially improves the chances of stopping known

Access Controls

The final piece of the security architecture involves implementing robust

access controls to validate users, authorize systems, and audit activity. First,

devices attempting to join the wireless or wired networks. Systems must

adhere to security posture checks and patching requirements.

For systems and applications themselves, multi-factor authentication (MFA)

enforces strong authentication for all remote access VPN connections and

privileged administrative accounts. A directory service like Active Directory

only required resources per assigned groups.

To deploy this proposed security architecture, the SMB could leverage

response capabilities beyond the SMB’s in-house expertise.

Some additional future considerations include:

- Endpoint protection like EDR for all workstations and servers

- Secure web gateway to filter internet access more granularly

- DMARC/DKIM for email to validate authenticity and block spoofing

- Annual external penetration tests and bi-annual internal security audits

- Dedicated security awareness training and simulated phishing exercises

- Offsite backup/DR solutions for data protection and quick recovery

By implementing these layered security controls in a phased approach, the

proposed architecture establishes a strong baseline defense tailored for the

expertise and resources exceeding internal staff capabilities. Over time, the