Network / Cabling / Wi-Fi / SD-WAN
Networks that segment, fail over and get patched.
Firewalls, VPN concentrators and routers are now a primary target. Texwan designs and runs the network layer, from structured cabling and Wi-Fi to firewalls, multi-site links and circuit failover, with configuration control and documented change management.
01 / Threat Briefing
Threat Briefing
Exploited vulnerabilities in edge devices such as firewalls and VPNs appeared in 29% of small and midsize business breaches in the Verizon 2026 DBIR. (Verizon 2026 DBIR)
CISA, the FBI and international partners published joint hardening guidance after PRC-affiliated actors compromised the networks of major telecommunications providers, calling for strict configuration management, removal of unused services and centralized logging on network devices. (CISA)
Network-related issues are the largest share of IT service outages in Uptime Institute’s 2026 resiliency survey, driven mainly by configuration and change management failures. Outages linked to fiber and connectivity issues are rising and tend to last longer. (Uptime Institute 2026)
02 / Risk and Compliance Matrix
Risk and Compliance Matrix
| Risk | Control or compliance mapping | Business impact |
|---|---|---|
| Firewall or VPN running firmware with a known exploited vulnerability | CISA KEV (catalog); NIST CSF 2.0 PR.PS; NIST SP 800-41 firewall policy (NIST) | Remote takeover of the network perimeter; ransomware staging |
| Flat network where guest Wi-Fi, phones, cameras and servers share one segment | NIST SP 800-207 Zero Trust Architecture (NIST); PCI DSS v4 segmentation scoping (PCI SSC) | One compromised device reaches everything; larger PCI audit scope |
| Management interfaces exposed to the internet, default credentials, no config backups | NSA Network Infrastructure Security Guide (NSA); CISA communications hardening guidance | Device takeover; long rebuilds after failure |
| Single internet circuit and single firewall at a site | NIST CSF 2.0 RC.RP; NIST SP 800-34 (NIST) | Phones, payments and cloud apps stop together |
| Weak or legacy Wi-Fi security (WPA2-PSK shared with staff and guests) | NIST SP 800-153 wireless LAN guidance (NIST) | Credential sharing that never gets revoked; rogue access |
03 / Architecture and Remediation Directives
Architecture and Remediation Directives
- Keep every firewall, router, switch and access point on a supported firmware train. Subscribe to the vendor advisories and the CISA KEV catalog and patch listed items on an expedited schedule.
- Disable internet-facing management (HTTPS, SSH, SNMP) on edge devices. Manage them from a dedicated management VLAN or through a zero trust access broker.
- Segment by function: servers, staff endpoints, voice, cameras and IoT, payment systems and guest each get their own VLAN with deny-by-default rules between them.
- Back up device configurations automatically after every change and keep a change log. Most outages are configuration changes.
- Use WPA3-Enterprise or 802.1X for staff Wi-Fi where devices support it; keep guest Wi-Fi isolated and rate-limited.
- At sites that cannot stop, add a second circuit from a different carrier and physical path, plus automatic failover (SD-WAN or dual-WAN). Test failover by pulling the primary.
- Link offices with encrypted site-to-site tunnels or SD-WAN rather than exposing services through port forwards.
- Install structured cabling to current ANSI/TIA-568 practice, label both ends, and certify each run with a cable tester. Keep the test results.
04 / Vendor-Neutral Verification Checklist
Vendor-Neutral Verification Checklist
Three checks you can run yourself, with or without us.
- Exposure check. From outside your network, scan your public IP addresses (or ask a third party to). Any login page for a firewall, VPN, remote desktop or camera system reachable from the internet without a zero trust broker is a finding.
- Segmentation check. Plug a laptop into a guest Wi-Fi network or a phone port and try to reach a server, a printer admin page or a camera. If it connects, the network is flat.
- Failover check. During a planned window, disconnect the primary internet circuit and time how long until calls, card payments and cloud apps work again. Record the result and repeat after every change.
Security stack by layer
What protects each layer of the network
The risk table above shows what goes wrong. This is the other side: the controls we apply at each layer of every site we run, and a check you can do yourself for each one.
| Layer | What we put in place | How you can check it |
|---|---|---|
| Circuit and edge | Managed firewall at every site, internet-facing management turned off, firmware kept on a supported release. | Scan your public IPs from outside. No admin login pages should answer. |
| Voice | SIP accepted only from the carrier, international and premium-rate dialing blocked unless needed, call limits per trunk, caller ID signed by the carrier (STIR/SHAKEN in the US). | Ask for the toll-fraud policy in writing and the list of countries allowed. |
| Segmentation | Separate networks for staff, voice, cameras and building systems, payment terminals and guests, with deny-by-default rules between them. | From guest Wi-Fi, try to open a printer or camera page. It should fail. |
| Wi-Fi | WPA3 or 802.1X for staff where devices support it, isolated and rate-limited guest Wi-Fi, no shared passwords that never change. | Check whether a former employee could still join the staff network. |
| Remote access | Zero trust access or a VPN with multi-factor sign-in. No port forwards to phone systems, cameras or servers. | List every port forward on the firewall. The target is none. |
| Management and change | Admin accounts with multi-factor sign-in, automatic configuration backups after every change, and a written change log. | Ask for the date of the last configuration backup for each device. |
| Monitoring | Devices and circuits watched in our Ares RMM platform, with alerts routed to our team and a monthly report for each site. | Ask what alerted last month and what was done about it. |
More than one site?
Plans and multi-site builds
See how the same standard is rolled out across locations on the multi-site networks page, or compare the Connect and Multi-Site plans.
Next step
Request a network assessment
We review your edge devices, segmentation, Wi-Fi, cabling and failover and send a written findings list.
Sources
- Verizon 2026 Data Breach Investigations Report (PDF)
- CISA: Enhanced Visibility and Hardening Guidance for Communications Infrastructure
- NSA Network Infrastructure Security Guide (PDF)
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 800-41 Rev. 1, Firewalls and Firewall Policy
- NIST SP 800-153, Securing Wireless Local Area Networks
- Uptime Institute Annual Outage Analysis 2026 (PDF)
- NIST SP 800-34 Rev. 1
- PCI Security Standards Council document library