Firewalls and IT Security for Businesses

Is Your Business Protected — Or Do You Just Think It Is?

This is the question that causes the most unease for business leaders when they ask themselves this question honestly. Most organisations have some form of IT protection — an antivirus programme, perhaps a basic firewall included in the service provider’s router, and the belief that “nothing has ever happened”. The problem is that IT security is not measured by what has not yet happened. It is measured by the ability to withstand what will inevitably happen.

Cyberattacks on businesses in Portugal have increased significantly in recent years. Ransomware that encrypts all data and demands a ransom. Phishing that compromises access credentials to critical systems. Silent intrusions that go undetected for weeks or months — gathering information, mapping systems, preparing a larger attack. Unauthorised access via poorly configured VPNs or stolen credentials.

And the vast majority of these attacks do not begin by exploiting sophisticated vulnerabilities. They begin by exploiting the basics that have been overlooked: an out-of-date firewall, a VPN without multi-factor authentication, a user with remote access who is not subject to any controls, and a network without monitoring where nobody knows what is coming in and what is going out.

DataRoad keeps these doors secure. With enterprise-grade firewalls, a secure VPN with multi-factor authentication, strict control over remote access and 24/7 monitoring of the entire infrastructure — so that your business is truly protected, not just on paper.

Enterprise Firewall — The First and Most Critical Line of Defence

A firewall is not the router that the provider installed as part of your internet contract. It is a dedicated system, constantly updated, which inspects all traffic entering and leaving your company’s network — blocking threats, controlling access and logging everything that happens.

The difference between a home firewall and a business firewall is like the difference between a plastic door lock and a reinforced safe. One keeps out anyone without a key. The other keeps out anyone without a key, logs all attempts to gain entry, alerts you when someone tries to force the lock, and prevents anyone who has entered one room from accessing the others.

What a DataRoad enterprise firewall does for your business:

Deep Packet Inspection Analysis of the actual content of network traffic — not just ports and IP addresses — to detect and block threats hidden within seemingly legitimate traffic. Ransomware, spyware and advanced malware often hide within encrypted HTTPS traffic. The enterprise firewall’s SSL/TLS inspection decrypts, analyses and re-encrypts traffic — in milliseconds, transparently to users.

Application Control Identification and control of specific applications on the network — regardless of the port or protocol used. You can allow the use of Microsoft Teams whilst blocking WhatsApp Web. Allow access to LinkedIn whilst blocking Facebook. Ensure priority bandwidth for business-critical applications and limit streaming applications that consume resources unnecessarily.

Web Content Filtering Access control for website categories — automatic blocking of websites containing malware, phishing, adult content, online games or any other category defined by the company’s security policy. Filtering is applied to all devices on the network, including mobile devices when connected via VPN.

Intrusion Prevention (IPS) An intrusion detection and prevention system that analyses traffic patterns and anomalous behaviour — automatically blocking attempts to exploit vulnerabilities, brute-force attacks, port scanning and other known attack techniques.

Network Segmentation by VLAN Segmentation of the network into isolated zones — staff, visitors, IoT devices, critical systems, servers — with defined access policies between each zone. A compromised device on the visitors’ network cannot access the servers. An IoT device cannot communicate with workstations. Segmentation drastically limits the impact of any security incident.

VPN — Secure Remote Access for Teams Working Anywhere

Remote and hybrid working is no longer the exception but has become the new normal for most organisations. Employees accessing internal systems from home, whilst travelling or in co-working spaces — each of these access points is a potential entry point for threats if not properly controlled and protected.

A business VPN is not the same as a consumer VPN used to bypass geographical restrictions. It is an encrypted tunnel that ensures remote staff can access the company’s internal systems with the same level of security as those physically in the office — and with controls that allow the company to know who accessed the systems, at what time, from where and which systems were accessed.

Site-to-Site VPN for Connecting Offices Secure interconnection of multiple offices, branches or data centres — creating a virtual private network that links all locations as if they were a single local network. Staff in Porto can access servers in Lisbon with the same latency and security as those at head office. Deployment using Fortinet FortiGate, Sophos or Cisco, with connection redundancy and automatic failover.

Zero Trust Network Access (ZTNA) For organisations with more advanced security requirements, DataRoad implements Zero Trust architectures — where no user or device is automatically trusted, even within the organisation’s network. Access to each resource is verified individually, based on the user’s identity, the device’s security status and the context of the access. The Zero Trust model is the natural evolution of the traditional VPN for environments where security cannot be compromised.

Controlled Remote Access — Who Has Access, to What and When

Uncontrolled remote access is one of the greatest security risks facing Portuguese companies. Employees with access to critical systems without any restrictions on time, device or location. Suppliers and partners with permanent access to systems that they only need to access occasionally. Former employees whose credentials have never been deactivated.

DataRoad implements strict remote access policies — because security starts with controlling who has access to what.

Identity and Access Management Integration with Active Directory and Azure AD for centralised management of all users and access rights. When an employee joins the company, they have immediate access to the systems they need. When they leave, all access rights are revoked immediately — no exceptions, no oversights.

Privileged Access for Administrators Administrator access to critical systems is the most valuable — and the most targeted. DataRoad implements Privileged Access Management (PAM) solutions that log all administrative sessions, require approval for sensitive access and limit the duration of each privileged session.

Device-Based Access Control Only devices that are registered and comply with the company’s security policies — up-to-date antivirus software, a patched operating system, and an encrypted hard drive — may access the network and internal systems via VPN. Unmanaged personal devices are automatically blocked.

Temporary Access for Suppliers and Partners Management of temporary access for suppliers, partners and external service providers — with a limited duration, restricted access to only those systems that are strictly necessary, and a full log of all activities during the session.

24/7 Monitoring and Alerts — Because Problems Don’t Wait for Office Hours

Most incidents do not get past the firewall

It arrives via email, with a credible request from a plausible address. No perimeter security measures can prevent an employee from changing an IBAN because they received an invoice that appeared to be genuine.

That is why we treat the firewall as one layer — an important one, but just one of many. Strong authentication, process verification and training are, in practice, just as important as the hardware itself.

Most security incidents and infrastructure problems occur outside working hours. Cyber-attacks are often launched in the early hours of the morning, at weekends or during holiday periods — precisely because IT teams are not monitoring the system. Hardware failures occur at 3 am. Servers run out of disk space on Sundays.

Without continuous monitoring, these problems are only discovered when staff arrive at work and realise that nothing is working. With DataRoad monitoring, they are detected and resolved whilst everyone is still asleep.

What DataRoad Monitors in Real Time:

Network infrastructure Status of all switches, routers, firewalls and wireless access points — with immediate alerts for any offline equipment, performance degradation or anomalous behaviour. Network latency, packet loss and interface congestion are monitored continuously.

Servers and critical systems CPU, memory, disk, temperature, RAID status and critical services — with alerts configured before critical thresholds are reached. A server with a disk utilisation of 90% is detected and the issue resolved before it reaches 100% and crashes.

Firewall and security Firewall logs analysed in real time to detect attack patterns, intrusion attempts, anomalous user behaviour and suspicious communications with known malicious IP addresses.

Backups Daily verification that backups have been carried out successfully and that the data can actually be recovered. A backup that has been silently failing for weeks is not a backup — it is a false sense of security.

SSL certificates and domains Monitoring of SSL certificate and domain expiry dates — with automatic alerts sent weeks before expiry to prevent service interruptions caused by expired certificates.

Availability of external services Monitoring of websites, customer portals, APIs and business-critical external services — with immediate alerts when a service becomes unavailable and monthly uptime reports.

VPN connections Status of all site-to-site VPN connections — with immediate alerts for any connection drops between offices and automatic reconnection attempts where configured.

Alarm Management — From Detection to Resolution in Minutes

Monitoring without taking action is pointless. DataRoad does more than just send alerts — it has defined escalation and resolution processes for each type of alert, with response times guaranteed by contract.

Level 1 — Automatic alert with automatic remediation For known issues with automated solutions — restarting services, freeing up disk space, reconnecting to a VPN — the monitoring system carries out the remediation automatically, without human intervention, and logs the incident for later analysis.

Level 2 — Alert requiring remote technical intervention For issues that require technical analysis and intervention but can be resolved remotely — a DataRoad technician is alerted immediately, whatever the time of day, and remotely accesses the system to diagnose and resolve the problem.

Level 3 — Critical alert requiring immediate escalation In the event of critical incidents — such as the main server being offline, an ongoing attack, a firewall failure or unauthorised access being detected — the immediate escalation protocol is activated, with simultaneous notification of the technical team and the client’s IT manager, and on-site intervention where necessary.

Logging and Auditing A comprehensive log of all access to critical systems, configuration changes, remote access and security events — with retention periods set in accordance with legal requirements and the ability to generate audit reports where necessary.

Encryption of Data in Transit and at Rest Implementation of disk encryption on all workstations and servers that process personal data, and ensuring that all communications between systems use encrypted protocols.

Real-World DataRoad Security and Monitoring Projects

European Embassy in Lisbon — Diplomatic-level security Implementation of a fully segregated network architecture using Fortinet FortiGate, three VLAN-isolated networks for administrative, consular and visitor use, an encrypted site-to-site VPN to the overseas headquarters, centralised logging with a 12-month retention period, and a 2-hour response SLA for critical incidents. All technical staff involved have signed confidentiality agreements.

Clínica Mulher and Clínica do Lambert — Security and GDPR Compliance Implementation of VLAN-based network segmentation to isolate medical equipment, a firewall with traffic inspection, encrypted hybrid backup with daily checks, and a GDPR compliance audit including a report and remediation plan. 24/7 monitoring of all critical systems with immediate alerts for any anomalies.

Infocapital SA — Continuous Monitoring and Security Since 2015 DataRoad has been a partner of Infocapital SA — one of Portugal’s largest independent video game distributors — since 2015, in a partnership spanning more than a decade. Comprehensive IT security management, 24/7 monitoring, a Fortinet firewall, a VPN for remote staff and incident response are all included in the IT Unlimited contract.

Multinational Group — Portuguese Subsidiary with ISO 27001 Certification Implementation of security policies aligned with the head office’s ISO 27001 requirements, identity management using Microsoft Intune and Azure AD, mandatory MFA for all remote access, and centralised monitoring. The Portuguese subsidiary has gone from being the group’s weakest link in terms of security to being praised internally for its operational maturity.

Why Choose DataRoad for Your Company’s Security?

Certified partner  — with certified technicians, not with generalists who configure firewalls “as best they can”.

A proactive, rather than reactive, approach — We don’t wait for something to go wrong before taking action. 24/7 monitoring and early warning systems enable us to resolve most problems before they have an impact.

No conflict of interest — Our fixed monthly fee model means that our interests are aligned with those of the client: the better the security, the fewer incidents there are – which is better for both of us.

Full documentation and transparency — All configurations, firewall rules, access policies and monitoring logs are documented and shared with the client. You’ll never be held hostage by DataRoad because “only we know how it’s configured”.

Incident response included — We do not charge by the hour when there is a security issue. Incident response is included in the IT Unlimited contract — because it is precisely in times of crisis that the IT partner needs to be available.

Your network is secure. Are you sure?

DataRoad carries out free security audits for businesses — analysing existing firewalls, reviewing remote access policies, checking monitoring status and identifying critical vulnerabilities.

The report is provided to the client regardless of whether or not they decide to use our services. Because we believe that safer businesses are better for everyone — and because we know that once you’ve seen the report, you’ll want us to sort it out.

Request a security audit → ☎ 211 459 950 (call to a national landline)

Frequently Asked Questions