The firewall occupies a strange place in small-business imagination: purchased once, installed once, and then trusted indefinitely — a guard assumed to be standing at the door because someone hired him in 2019. The reality: a firewall is a computer running security software at the most exposed position on your network, and everything true of computers is true of it — it needs patching, its configuration drifts, its rules accumulate archaeology, and it eventually ages off its vendor’s support. “We have a firewall” is a purchase; managed firewall care is the practice. Here’s what the practice contains.
Firmware first: the guard’s own armor
The uncomfortable pattern of recent years: firewall and VPN-appliance vulnerabilities are among the most actively exploited on the internet — attackers specifically hunt the security devices, because compromising the gatekeeper yields the gate. Vendors patch these flaws on urgent timelines; the businesses that get breached are the ones running firmware from the install date. So the first discipline is simply the patch cycle, applied to the firewall itself: firmware updates on a schedule, critical advisories fast-tracked, changes handled with maintenance-window care since this device’s reboot is everyone’s internet blinking. And the hard deadline behind it all: end of support. A firewall past its vendor’s software-support date stops receiving those patches — the guard’s armor stops being repaired while the arrows keep coming — and some cyber insurers now scan for exactly this before quoting. The support date belongs on the lifecycle calendar the day the unit is purchased.
Rule hygiene: the archaeology problem
Firewall rules only accumulate. The port opened for the 2021 project, the vendor’s remote-access hole “for the install”, the temporary exception that calcified, the rule nobody can explain — each one a door, standing open, guarding nothing. The disciplines: every rule gets a comment — what it’s for, who asked, when (the change-log habit, applied here) — because the uncommented rule is unremovable-by-fear forever · an annual rule review: walk the list, retire what’s dead, challenge what’s vague — an hour that reliably closes doors nobody remembered opening · and the standing red flags handled on sight: no RDP or management interfaces exposed to the internet, no “any/any” conveniences, inbound holes replaced by proper remote-access patterns. The firewall is also where the segmentation design lives — its zones and doors are rules, which makes the annual review double as the map’s accuracy check.
The features you’re paying for (and may not be using)
Modern business firewalls bundle real capability beyond packet filtering — intrusion prevention, DNS/web filtering, application awareness, the dual-WAN failover brain — much of it license-gated and, in the wild, frequently expired or never enabled: the security-services subscription that lapsed two renewals ago is the firewall equivalent of the backup nobody tested. The audit questions: which licensed protections are active, when do the subscriptions renew (calendar them), and are the logs going anywhere? — because the firewall sees every connection at the perimeter, and logs nobody retains or reads are the usual answer to why an intrusion’s entry went unnoticed.
Who watches the watcher
Pulling it together, managed firewall care is a short standing list: firmware current and advisories tracked · rules commented, reviewed annually, red-flags closed · subscriptions active and renewals calendared · logs shipped into the monitoring that humans actually watch · configuration backed up — the runbook’s forgotten item; a failed firewall with no config export turns a hardware swap into a rebuild-from-memory day · and admin access to the device itself treated as the crown-jewel credential it is. In a managed relationship, all of this is table stakes; if you’re not sure it’s happening, the quarterly questions list has room for one more: when was our firewall’s firmware last updated, and when were its rules last reviewed?
The bottom line
A firewall protects exactly as well as it’s maintained: firmware patched like the exposed computer it is, rules kept commented and pruned, subscriptions actually active, logs actually watched, config actually backed up, and the whole unit retired before its support cliff. The guard at the door is only as good as whoever’s managing the guard — make sure that’s someone, by name, on a schedule.