Day 16 looked at access control from the outside in: securing the connection when staff work beyond school walls. Today we go back to the perimeter itself: the firewall every one of those connections has to pass through, and the network behind it. A firewall that's switched on but never reviewed, or a network where one device can talk to everything else, undoes a lot of the good work covered so far this month. Perimeter and gateway security is less glamorous than ransomware or phishing, but it's the layer that decides whether an intrusion stays contained or spreads.

The firewall is your gatekeeper, but only if it's correctly configured

A firewall isn't a box or software you install once and forget. It's the control point every external connection into your network has to pass through, and and the DfE's own Cyber Security Core Standard is specific about what "properly configured" actually means.

What good firewall configuration looks like

Per the DfE Cyber Security Core Standard, every school and college should:

• Protect digital technology with a correctly configured boundary firewall or software firewall, and make sure every external connection to the network runs through it i.e.  with no side doors.
• Change the default administrator password on the firewall itself, and restrict remote access to it to authorised maintenance staff only.
• Block inbound unauthenticated connections by default.
• Keep firewall rules to an absolute minimum, with each one documented and risk-assessed, and review why inbound traffic has been permitted at least termly, signed off by senior leadership.
• Actively monitor firewall traffic and switch on alerts so suspicious activity doesn't go unnoticed.

If your firewall rules haven't been reviewed this term, that's the Core Standard's own bar, not an optional extra.

Why segmentation matters as much as the firewall itself

The NCSC frames it simply: breaking one network into smaller ones makes a compromise harder to achieve and limits the damage if one happens anyway. For a school, that means:

• Separate your guest Wi-Fi from staff and administrative systems entirely — a compromised guest device should never be able to reach your MIS.
• Isolate IoT devices (smart boards, CCTV, building management systems) onto their own segment, since these are rarely patched as consistently as laptops and servers.
• Where a device can't be patched (an unsupported legacy system, say), the DfE standard's answer isn't "leave it be" — it's to isolate it from higher-risk systems and data until it can be replaced or remediated.

Securing the Wi-Fi itself

• Change default router/access point credentials immediately as these are often publicly known for the make and model.
• Use WPA2 or WPA3 encryption; avoid anything older.
• Disable WPS (Wi-Fi Protected Setup); it's a known weak point.
• Keep firmware updated; this is where critical fixes land.  This is something often over-looked in smaller schools.
• Use a genuinely separate guest network with its own password, changed regularly,  not just a different SSID on the same underlying network. This is specified under the DfE Wireless Networking Standard, under Security Features: Secure Segregated Guest Access.  You should also consider this when you review the DfE Filtering and Monitoring Standards as web filtering rules must apply to guest Wi-Fi connections as well as BYOD and managed devices.

💡Your Daily Cyber Tip

Ask your IT support (in-house or outsourced) one direct question this week: "When did we last review our firewall rules, and can I see the sign-off?" If there isn't one, that's today's action.

What the DfE Digital and Technology Standards say about this specifically

This article sits across three named standards, not just the Cyber Security one:

Cyber Security: Core Standard: covers the boundary firewall requirements directly: a correctly configured boundary or software firewall with every external connection routed through it, default admin passwords changed, inbound unauthenticated connections blocked by default, rules kept to a minimum and documented, and reviewed at least termly with senior leadership sign-off.

Wireless Network: Core Standard: requires guest and mobile users to be "securely authenticated individually onto the network," and specifically calls for VLANs, access control lists (ACLs), and secure segregated guest access, alongside WPA3, wireless intrusion protection, certificate-based authentication, and MFA for privileged users and technical support staff managing the network.

Network Switching: Core Standard: requires switches to be "configured to support network segregation, security and quality of service," with network access controls (NACs) ensuring authorised devices and guest roles are securely authenticated,  though this standard stays general and doesn't prescribe specific VLAN architecture the way the Wireless standard does.

Together, these three standards are where "firewalls" and "network isolation" stop being good practice and become a named, specific DfE expectation , not just the NCSC's general advice.

Filtering and Monitoring: Core Standard:  a different angle on the same guest network: filtering and monitoring "should apply to all users and all school or college-managed devices," explicitly including "guests who have access to the school internet." Monitoring data should make users "identifiable to the school or college, so concerns can be traced back to an individual, including guest accounts where possible."

So a segregated guest network isn't the whole job,  under this standard, guest traffic also needs to be filtered to the same safeguarding standard as staff and student traffic, and ideally traceable back to whoever was using it. A guest VLAN that's isolated but unfiltered meets the Wireless and Switching standards, but not this one.

More from DPE

• Use the DfE Digital Standards Tracker to check your wireless network setup against the Core Standard
• Review our Webinar about our DfE Digital Standards Tracker