Features
Part of Provider comparisons: a small-business evaluation method
Provider security boundaries: four questions to ask a business internet provider
What a business internet or phone provider defends, what stays yours, and the four questions to put to each provider in writing before you sign: notification, contacts, attack handling and data location.
Every provider will say security is included. The question that separates them is not what they block. It is where their responsibility stops, and what they tell you when something happens on your side of the line.
This page is about that boundary. The wider choice between carriers is in provider comparisons.
What to take away
- Draw the boundary on paper before you buy. The provider defends their network. Everything from the demarcation point inward is yours, whatever the brochure says.
- The two commitments worth comparing are notification and contact: will they tell you, and can you reach a human who can act.
- A filtered connection changes nothing about devices, accounts or backups. Those are the attacks that reach small businesses.
Where the boundary sits
Typically theirs
- The path
- Their network, their equipment up to the demarcation point
- Traffic
- Capacity, and absorbing a volumetric attack aimed at their network
- Accounts
- Their portal
- Detection
- Their own monitoring, for their own purposes
- Recovery
- Restoring their service
Typically yours
- The path
- Cabling and equipment inside the building
- Traffic
- What your devices send and receive
- Accounts
- Your email, your systems, your staff
- Detection
- Anything happening inside your network
- Recovery
- Restoring your data
The row that surprises people is detection. A provider watches its own network, not yours, and an infection inside your building generates traffic that looks ordinary from outside. What you can watch from inside is covered in setup and troubleshooting.
Provider vs. Your Responsibility
Typically theirs
- The path
- Network to demarcation
- Traffic
- Capacity, attack absorption
- Accounts
- Their portal
- Detection
- Their network monitoring
- Recovery
- Restoring their service
Typically yours
- The path
- Cabling inside building
- Traffic
- What devices send
- Accounts
- Your email, systems
- Detection
- Inside your network
- Recovery
- Restoring your data
The four questions to ask every candidate
- What will you tell me, and when?If they receive an abuse report about traffic from your address, or see an attack aimed at it, does anyone contact you? Through which channel, to which address, and how quickly?
- Who do I reach, and what can they do?A support desk that can only raise a ticket is not an incident channel. Ask what the out-of-hours path is and what authority the person on it has.
- What happens during a volumetric attack?Some providers absorb it. Some null-route your address, which stops the attack by removing you from the internet. Both are defensible. Only one of them is a surprise.
- Where does my traffic and my data sit?Relevant if the service includes filtering, logging or a hosted component, and to obligations you may have about where records live.
Four Questions for Providers
- What will you tell me, and when?
- Who do I reach, and what can they do?
- What happens during a volumetric attack?
- Where does my traffic and data sit?
Get all four in writing. They are cheap to ask before a contract and impossible to change after one.
What is still yours whatever you buy
The attacks that reach a small business mostly arrive through a person and an account, not through the connection. A line filter does not touch them.
What the connection itself is supposed to provide is in business internet.
The controls that work are unglamorous and well documented: multi-factor authentication on everything facing outward, which NIST SP 800-63B sets out plainly; a tested restore; and a written first-hour plan for who does what.
For that hour, NIST SP 800-61, the federal computer security incident handling guide, is the reference professionals use. The parts a small business needs are the first ones.
Controls That Stay Yours
- Multi-factor authentication on outward-facing systems
- Tested restore of your data
- Written first-hour roles
- Change default credentials on provider devices
- Disable remote management from internet
- Keep account contact details current
- Change the default credentials on every device the provider leaves behind, and turn off remote management from the internet unless you want it.
- Keep the account contact details current. The most common reason a warning goes unread is that it went to somebody who left.
- Know which of your services depend on the connection staying up and which have a path of their own.
The phone system is part of this
An internet-based phone service is an account that can place calls and be charged for them, and voip systems covers the mechanism. It is a target, and the loss is money, not data. The controls belong in the same review as the connection: strong credentials on the phone accounts, international dialing turned off unless needed, and an alert when call volume moves.
Common questions
Does a business connection come with better security than a consumer one?
Usually it comes with a better contract. The traffic travels the same way. The difference you are buying is the service-level agreement: the repair commitment, the out-of-hours terms, and the contact path.
Should we take the provider's security package?
It is one useful layer if it is priced as one layer. It is a poor buy if it is sold as a reason to skip the rest, because it does not cover accounts, devices, or restores.
They null-route us during an attack. Is that acceptable?
It is common and it protects other customers. What matters is that you know it in advance, and that you have a second path that is not on the same address. Fixed wireless is often that second path, and a second path with the same weaknesses is not one.
Who do we tell if we are breached?
In the United States, that is usually a state breach-notification law: you notify the people affected and, in many states, the state attorney general, and the clock starts when you discover the breach. Regulated sectors add their own authority. A HIPAA-covered business reports to the federal Department of Health and Human Services. Find out which one covers you, and write the answer down before you need it.
