I had a conversation recently with a business-owner friend (not local) who wanted to know a few things about cybersecurity. Later, I asked him about practices and policies at his own business. He said, “Oh, we’ve got good cybersecurity. Our IT guy has our firewall finely tuned so that, sometimes, we even have to email him just to get permission to visit regular websites.” 

Look, that’s not a bad thing. A properly configured firewall is an important part of your cybersecurity. It’s like having a sturdy lock on your front door. But here’s the problem: cybersecurity isn’t about the door. It’s about the entire building.  

Securing a single level of your IT infrastructure simply gives a false sense of security. If all you’re doing is “tightening up” your firewall, you might be locking the front door while the back door and windows are wide open….and your employees may be letting strangers in through the locked door anyway. 

Single Layer Security and Impromptu IT 

This “single layer” approach to security isn’t even close to sufficient. 

To make matters worse, the trust that business owners place in IT techs to secure networks is often very misplaced. This is particularly true in those “impromptu IT” situations we always touch on: when your IT tech is a well-meaning internal employee assigned IT duties because they seem more tech-savvy than your other folks. OR when your IT tech is “that guy” who does this Help Desk support as a one-man-band side gig. 

It simply isn’t feasible for such IT techs to provide multi-layered cybersecurity. Most don’t have the correct expertise or experience. Very few have access to the required tools (which can change over time!) or vendor relationships. They don’t have the organizational capacity to provide monitoring or network planning.  Most aren’t “in the loop” on ever-changing, pressing security threats, especially threats that happen locally or in particular industries.

What a Firewall Actually Does 

To go back to the firewall conversation, let’s illustrate how this “single-layer security” isn’t sufficient.  

Think of your firewall as a digital traffic cop. It decides which internet traffic gets in and out of your network. That’s great, and you do need that control. But a firewall can’t stop someone who has your password. It can’t prevent an employee from clicking on a malicious email link. And it certainly can’t recover your data after ransomware hits. 

Again, it’s like saying, “My building is secure because the front door is locked,” while your side doors, back doors, and windows are wide open.  And when your well-meaning but untrained employees are opening the front door for anyone who knocks, no matter who they are.   

Cybersecurity Is About Layers, Not Locks 

Real cybersecurity isn’t a single device. It’s a system. 

It includes things like: 

  • Email protection and phishing defense (because hackers love using inboxes more than they love firewalls) 
  • Endpoint protection (so each computer and mobile device is guarded, not just the network) 
  • Data backups that are actually tested (not just “set and forget”) 
  • User training (because the #1 way attackers get in is through human error) 
  • Daily Monitoring and response (so someone is watching when something looks off) 

A good IT provider builds those layers so that if one defense fails, another kicks in. 

Cybersecurity vs. IT 

Firewalls are one essential piece of a secure network, but they are not enough alone. Cybersecurity should be proactive, layered, and documented. 

So many SMB owners believe they are sufficiently covered because they have an IT guy. As we have repeatedly warned, SMB owners cannot simply trust that their cybersecurity is in order because they have an IT guy. 

To take this back to the building analogy, IT is like having maintenance staff to make sure your building is operational. That’s obviously a vital part of your business. But while maintenance staff can lock the front door at the end of the day, they are simply not sufficient as security staff and a trained workforce. 

Your network DOES have EXTREMELY valuable information. Cybercriminals WILL try to get into your digital building. A single layer security system WILL ultimately fail. 

It’s vital for the health of your business that you ensure your IT provider is giving you robust, multi-layered security which is backed up by an expert team.