Most businesses install a firewall once, confirm it is running, and never
think about it again. That is a reasonable assumption for a lot of
technology, but it does not hold up for firewalls. A firewall that was
configured correctly three years ago is not necessarily configured
correctly today, and “it is turned on” is a very different thing from
“it is actually protecting you.”

Here is the gap that usually opens up. Firewall rules accumulate over
time: a temporary exception added for a vendor two years ago that was
never removed, a port opened for a project that finished months ago, an
outdated rule inherited from whoever set the network up originally. None
of these show up as a problem day to day. The firewall still says
“active.” But each one is a small hole in what is supposed to be your
main line of defense, and they tend to stack up quietly until someone
goes looking.

This gets missed for an understandable reason: nobody budgets time to
re-audit something that already works. IT teams and business owners
alike tend to treat a firewall as a one-time setup cost rather than an
ongoing practice, so once it is installed, it drops off the radar
entirely.

What proper firewall hygiene looks like is a periodic audit against a
known security standard, not just a glance to confirm the device is
still on. That means reviewing every rule and asking whether it is still
needed, checking that firmware and threat definitions are actually
up to date, and confirming the configuration matches current best
practice rather than whatever made sense when it was first set up. This
is typically benchmarked against frameworks like CIS (Center for Internet
Security), which give a concrete standard to audit against instead of a
vague sense that “it should be fine.”

A firewall that has never been re-audited since installation is not
necessarily doing anything wrong today. But nobody actually knows that
for certain, and for something that is supposed to be your first line of
defense, “probably fine” is a risky place to leave it.

It is one of the most common setups in small business IT: everyone on the
team has admin rights on their own laptop, and a handful of “power users”
have standing admin access across the whole network. It is convenient.
Nobody has to wait for IT to install anything. And it is one of the
easiest ways for a small security problem to become a business-wide one.

Here is why it matters. When an account with admin access gets
compromised, whether through a phishing email, a weak password, or a
piece of malware, the attacker inherits everything that account can do.
If that account has standing admin rights, “everything it can do” often
means every device, every file share, every system the business runs on.
A single mistake by one employee can turn into a company-wide incident,
not because the attack was sophisticated, but because the access was
already wide open.

This risk usually gets overlooked for a simple reason: setting up proper
access controls takes more work upfront than just giving everyone admin
rights and moving on. It also feels unnecessary, right up until the day
it is not. Most businesses we talk to have never had an incident that
forced the issue, so the convenience wins by default.

What good access control actually looks like is simpler than most people
expect. Day-to-day work should not require admin rights at all. When
someone genuinely needs elevated access, for a specific task, they should
be able to get it temporarily, with a record of who requested it, why,
and when it expired. This is often called “just-in-time” access, and it
means that even if an account is compromised, there is no standing
door left open for an attacker to walk through.

The businesses that get hit hardest by ransomware are rarely the ones
targeted specifically. More often, they are the ones where a single
compromised login happened to have the keys to everything.