You may be planning a firewall refresh, responding to an audit finding, changing how people work across several sites or assessing whether your security controls remain effective as AI changes the threat landscape. We help you assess what is in place before recommending what should change.
Reviewing network security or planning a site-connectivity change? Tell us what is prompting the review and we’ll help you scope a useful next step. Email solutions@oxspring.com to arrange an initial conversation.
Is your current approach keeping pace?
A review may be useful if:
- a firewall is approaching end of support, or its capacity and features no longer suit the traffic it needs to inspect;
- users, sites or cloud services have changed, but internet access and security policies have not been reviewed;
- remote users need security controls that remain consistent when they work away from an office;
- web or DNS filtering is incomplete, difficult to manage or raised as a gap during an audit;
- a new site, acquisition or network refresh means you need to reassess how locations connect;
- you are considering SD-WAN but need to compare it with your existing connectivity and operating model;
- your team lacks a clear view of current firewall rules, ownership, renewals or the process for reviewing changes.
A technology change on its own does not resolve unclear ownership, unsuitable policy or missing operational processes. We start by understanding the business requirement and current environment, then set out the options, dependencies and responsibilities to consider.
Network security and site connectivity are connected decisions
Firewalls, DNS and web controls, remote-user access and wide-area connectivity affect one another. The right design depends on where applications are hosted, how people and sites connect, what traffic needs to be inspected, and who will operate the resulting service.
Firewall and internet-edge security
A firewall controls traffic between networks according to an agreed policy. A review can consider the current architecture, support status, rule set, required inspection, internet connections and the operational process for making changes. The aim is to identify whether the current design can be retained, needs targeted improvement or should be replaced as part of a wider change.
DNS and web protection
DNS-layer and web controls can help block access to known malicious destinations and apply internet-use policies. Their reach depends on the selected service, configuration and how it is applied to office, site and remote users. They are one layer of a wider security approach, not a substitute for endpoint protection, identity controls or an incident-response plan.
Read about the role of DNS-layer security for a closer look at how it works.
Remote users and cloud applications
When people work away from an office, security requirements may change with them. We can review how remote users reach business applications and the internet, which controls apply off-site, and whether the current arrangement remains practical for your users and IT team. The appropriate design depends on your applications, identity arrangements, existing services and support responsibilities.
Secure connectivity between sites
The way branches connect affects application performance, resilience, security policy and day-to-day management. We help assess the existing WAN, the services that depend on it, available connection types and what should happen if a link fails. Where appropriate, SD-WAN can provide a policy-led way to manage connectivity across multiple sites, but the design must fit the applications, links and operational capability you actually have.
Considering SASE?
Some organisations are assessing Secure Access Service Edge (SASE) to bring site connectivity and cloud-delivered security closer together. For Cisco environments, the approach may combine Catalyst SD-WAN with Cisco Secure Access, Cisco’s Security Service Edge (SSE) solution. The right design depends on user and application locations, identity policies, existing WAN and firewall services, and who will operate the controls. We can help map those dependencies, compare a staged change with the current architecture, and define an engineer-reviewed route. SASE is one architectural option, not a default recommendation.
If the wider requirement includes wired LAN or workplace Wi-Fi, see our Enterprise networks and Wi-Fi networks guidance.
Start with the decision you need to make
Reviewing or replacing a firewall
We establish what is installed, which sites and services it protects, its support and renewal position, and how policies are maintained. We then discuss whether an upgrade, configuration change or broader redesign is appropriate. A full estate refresh or significant change to traffic flows needs an agreed technical design and delivery plan before equipment is selected.
Improving internet access controls
If the concern is web access, DNS filtering or consistent protection for users away from the office, we clarify which users, devices and locations are in scope. We review the current controls and identify how any change would interact with identity, endpoint and network services.
Planning SD-WAN or a multi-site change
We review the number and role of sites, applications, current circuits, performance and availability requirements, security policies, and who will operate the service. This helps determine whether SD-WAN is a suitable fit, what dependencies need addressing and how a migration could be staged.
Understanding an audit or security finding
We translate the finding into the network controls and evidence it concerns. A firewall or web-filtering change may support particular technical controls, but technology alone does not establish that an organisation meets a standard or certification. We clarify the boundary of the work and identify where policy, process or other technical owners need to be involved.
A practical, engineer-led review
- Understand the trigger. We discuss the business change, issue, audit finding or renewal that prompted the review.
- Establish the current position. We consider sites, internet links, firewalls, remote users, applications, policies, support status and available documentation.
- Identify gaps and dependencies. We look at what should be retained, changed or investigated further, including interactions with LAN, Wi-Fi, identity and cloud services.
- Set out options. We explain the practical choices, likely dependencies, sequencing and responsibilities, then agree a suitable scope.
- Design and deliver where agreed. If implementation is required, the technical design, change approval, testing, migration and handover are agreed before work begins.
The review should result in a clear next step, which may be a focused configuration change, a planned refresh, a more detailed design or no immediate change. Ongoing monitoring or support is discussed separately and included only where it forms part of the agreed scope.
Experience with Cisco networking
Oxspring has worked with Cisco networking technologies for more than 25 years. We bring networking and security experience to the decision, explain the trade-offs in practical terms and work directly with your team to agree what should happen next.
For wider business-continuity context, read Building network resilience. For manufacturing and logistics environments, explore Connected Factory and Connected Warehouse, where network and security decisions sit alongside operational requirements.
Frequently asked questions
Do we need to replace our firewall to improve security?
Not necessarily. A review may identify a configuration or policy change, a targeted upgrade or a wider refresh. The appropriate option depends on the current platform, support status, traffic, required features and business requirements.
What is SD-WAN?
SD-WAN is an approach to managing wide-area connections between sites using centrally defined policies. It can help organisations coordinate different links and traffic requirements, but its suitability depends on application needs, available connectivity, resilience requirements and the team that will operate it.
Does SD-WAN automatically make a network more secure?
No. SD-WAN and security controls need to be designed together. The outcome depends on the architecture, policy, configuration, identity integration and operational processes in scope.
Can a firewall or DNS security achieve Cyber Essentials Plus?
No single product or network change achieves certification. Firewalling and secure configuration can support relevant technical controls, while other technical requirements, policies and processes also need to be addressed by the organisation.
Can you help if we already have a network supplier?
We can discuss the project-specific responsibilities, technical dependencies and handover with your existing supplier. The parties involved, access and change approvals should be agreed before work begins.
What information should we prepare?
A useful starting point is the reason for the review, the sites and users involved, a high-level network diagram if available, current firewall and WAN details, important applications, known issues, renewal dates and any audit findings. You do not need a complete technical pack to start the conversation.
Discuss your network security review
Tell us what has prompted the review, which sites or users are affected, what is changing and when a decision is needed. If you have an existing network diagram, firewall inventory, connectivity details or audit finding, we can use those to shape the discussion.
We’ll help identify the most useful next step and agree any further technical work before it begins. Email solutions@oxspring.com.
