Ask who handles installing a firewall in your business and you might get the name of whoever installed it. Ask when they last checked the rules, updated the software or removed an old supplier’s access, and the answer may take a little longer.

A firewall can keep passing traffic long after its settings have fallen behind the way the business operates. Staff can still work, so there may be no obvious reason to investigate.

But the business keeps changing. Its firewall needs attention along the way.

Old permissions need a second look

Suppose a supplier needed remote access to fix a problem with your accounts system. Someone approved the connection, the repair was completed, and the supplier moved on.

Six months later, is that access still available?

The same question applies to an application you stopped using or a server that was replaced. Firewall rules can outlive the work they were created for.

Record why each rule exists, who requested it and what it allows. Temporary arrangements need a removal date. During a review, check with the people using the affected systems before changing access.

Remote access reviews should include the supplier account as well as the firewall rule. Disabling one route may leave another available. Confirm how the supplier connects, which systems they can reach and who approves any future access.

This documentation helps with support, too. When an application stops connecting, a technician has somewhere to start instead of trying to work out what an unexplained rule was meant to do.

Don’t wait for a fault to check updates

A firewall runs software. Like other software, it can have security weaknesses that need fixing.

It may continue working perfectly well while an update is outstanding. Waiting for users to report a fault is therefore a poor way to decide when maintenance is due.

The Australian Cyber Security Centre’s guidance on securing network edge devices covers updates, restricted administration and replacing equipment that is no longer supported.

Ask your support provider how it handles security advisories. A routine update can usually be planned. An actively exploited weakness affecting your device may call for urgent action.

Check administrator access as well. Former technicians should not retain accounts indefinitely, and access to settings should be restricted to authorised people using strong authentication.

The administration page should not be openly reachable from the internet. Use a controlled management route and review who can use it when support staff change.

When an alert arrives, who reads it?

Your firewall applies its rules automatically. Logs and alerts help people investigate what is happening around those rules.

That investigation takes judgement. Heavy traffic overnight could be a backup. Repeated failed logins could deserve a closer look. A configuration change might be approved maintenance, or something nobody authorised.

With firewall and threat monitoring, establish who checks important events and what they can do about them. Does somebody investigate, contact the business or restrict a suspicious connection?

After-hours arrangements matter here. An email delivered at midnight may sit unread until the following morning. Agree on the response your business needs, particularly where an incident could interrupt trading or affect sensitive information.

Installing a new firewall changes the picture

Think about what has joined your network since the firewall was installed. Perhaps you added cameras, a payment terminal, another server or equipment that a supplier maintains remotely.

Each addition brings connections that somebody needs to understand.

A camera may need to reach its recording system. That does not automatically give it a reason to reach your payroll server. MITRE’s network segmentation guidance describes how separating systems and controlling traffic between them can limit an attacker’s movement.

Those restrictions need checking after network changes. Putting devices into separate groups achieves little if broad access rules still allow unnecessary connections between them.

In 2026, that review also needs to account for work outside the office. A laptop connecting directly to cloud applications from home may bypass the office firewall. Check what protects the device and account on that route.

Test the work people actually do

Maintenance can cause disruption when a change blocks something the business relies on.

Before significant changes, keep a protected copy of the current configuration and agree how to restore it if needed. Schedule the work around the systems affected and tell staff what to expect.

Then test those systems.

Can the card terminal process a payment? Can the branch reach its application? Does authorised remote access still work? Opening a website proves very little about those other connections.

Keep a record of the change and its outcome. The next person investigating a problem will need to know what happened, especially if the symptoms only appear during a particular task.

Firewall management needs a named person

For a South African SME using an outside support company, business firewall maintenance belongs in the service agreement. Check whether your managed IT services cover updates, access reviews, alerts and configuration backups.

Also confirm who tracks support and security subscription renewals. Some features depend on active subscriptions, so find out what an expiry would affect.

You should be able to ask when the firewall was last reviewed and receive a useful answer, including outstanding work and who is handling it.

Keep endpoint protection, account security and backups in that conversation. A firewall has an important job, but other controls must cover risks beyond the traffic it can inspect.

If you’re unsure what attention your firewall has received since installation, UIT can review its settings, maintenance and monitoring arrangements. Get in touch to arrange a discussion.