Applying data security to a network means protecting data everywhere it sits and travels. Secure the edge with supported, patched firewalls and VPN gateways. Encrypt traffic in transit, segment the network and limit who can reach what. Log and monitor activity and sanitize network gear before you retire it, because switches, routers, and firewalls store configurations, credentials, and keys.
Why the Network Matters
A network is how your data moves, and it’s where attackers look first. In Verizon’s 2026 Data Breach Investigations Report, ransomware showed up in 48% of breaches and the human element in 62%. Keepnet’s breakdown of that report adds that exploiting unpatched software is now the most common way breaches begin, at 31%. Much of what gets exploited sits on the network: firewalls, VPN gateways, routers, and the servers behind them.
The cost is real. According to Baker Donelson’s summary of IBM’s 2026 Cost of a Data Breach Report, the global average reached a record $4.99 million, and $11.5 million in the United States. Those averages skew toward larger organizations, so don’t treat them as your number, but the direction is clear.
Five Places to Apply Security
Think of your data’s journey, and put a control at each stop.
1. The Edge: Where the Network Meets the Internet
Firewalls and VPN gateways decide what gets in. They also get attacked directly. A joint fact sheet from CISA, the FBI, and the UK’s NCSC warns that nation-state attackers exploit unsupported edge devices such as firewalls, routers, VPN gateways, and load balancers, and it strongly encourages organizations to follow the guidance in CISA’s Binding Operational Directive 26-02. That directive requires federal agencies to inventory and remove end-of-support edge devices. It doesn’t bind private companies, but the logic applies to everyone.
So the rule for the edge is simple. Keep firewalls and gateways patched, replace them when the vendor stops supporting them, and close every port you don’t use. Our guide to replacing networking gear explains how to track support dates.
2. In Transit: Data on the Move
Data crossing a network can be read by anyone who can see the traffic, unless it’s encrypted. The NSA’s Network Infrastructure Security Guidance recommends using encrypted services to protect network communications, disabling clear-text administration services such as Telnet, HTTP, FTP, and early SNMP versions, and configuring encrypted web services to accept only TLS 1.2 or higher.
Put that into practice. Use TLS for websites and email, a VPN or a zero trust access tool for remote workers, and modern Wi-Fi encryption (WPA3 where your equipment supports it) with a separate guest network. Check your own network devices too. An old switch still managed over Telnet is sending its admin password in plain text.
3. Inside: Who Can Reach What
Once an attacker is in, the next question is how far they can go. Segmentation is the answer. Divide the network into zones, such as guests, office computers, servers, cameras, and payment systems, and control what can cross between them.
Consider a 25-person law firm with a flat network, where every device can talk to every other device. A visitor’s infected laptop on the guest Wi-Fi can reach the file server. Segment guest traffic, and that same laptop reaches only the internet. The fix costs a few hours of configuration.
Pair segmentation with access control. Give each person access to what their job needs and nothing more, require multi-factor authentication for remote and administrative access, and remove accounts the day someone leaves. Our guide to small business data security covers passwords, MFA, and backups.
4. Under Watch: Logging and Detection
You can’t respond to what you can’t see. Collect logs from firewalls, servers, and key applications, keep them somewhere attackers can’t easily erase, and look at them. Intrusion detection and prevention systems add automated alerts and, for prevention, the ability to block known attack patterns.
Our view: a small team doesn’t need a huge system on day one. It needs logs in one place, a person who owns reviewing them, and a few alerts that matter, such as repeated failed logins and logins from unexpected places. Our partner’s guide to AI network management covers where automation can help.
5. End of Life: When the Equipment Leaves
This is the stop most guides skip. Switches, routers, firewalls, and access points store configurations, passwords, certificates, VPN keys, and logs on onboard storage. A retired device that leaves without being wiped carries all of it. A factory reset doesn’t always meet your security requirements.
Follow NIST SP 800-88 Revision 2, published September 26, 2025: revoke the device’s credentials and certificates first, remove it from your monitoring and management tools, then sanitize or destroy its storage. Keep a Certificate of Data Destruction with serial numbers, and track custody until the device is gone. See our guides to secure IT equipment disposal and IT asset management.
Network gear often has resale value too. We buy used networking equipment, and our network equipment buyback guide explains the process.
What Security Costs You
The original ended on an honest but unfinished line: security measures can be disruptive. They can. Encryption adds a little processing overhead. Segmentation can break an application that assumed everything could talk to everything. Strict access rules annoy people. A misconfigured firewall rule can take down a service.
You can manage all of that. Test changes before you apply them, roll out in stages, keep a rollback plan, and tell people what’s changing and why. The cost of a careful rollout is small compared with the cost of a breach.
Rules That May Apply
Security helps with compliance, though which rules apply depends on your industry. For example, HIPAA’s Security Rule, which is part of 45 CFR Part 164, includes standards for protecting health information as it moves across networks. Other frameworks and contracts set similar expectations for encryption, access control, and logging. If you’re unsure what applies, ask your legal or compliance contact.
Mistakes to Avoid
- Trusting the perimeter alone. Once something is inside, a flat network lets it go anywhere.
- Leaving defaults in place. Default passwords and open management ports are a common way in.
- Running unsupported gear on the edge. Genuine, working devices can still be a liability without security updates.
- Collecting logs nobody reads. Assign an owner.
- Skipping the retirement step. Old network gear still holds keys and credentials.
- Changing everything at once. Stage your rollout, and keep a way back.
Frequently Asked Questions
How is data security applied to a network?
By protecting data at every stage: securing the edge with supported firewalls and gateways, encrypting traffic in transit, segmenting the network and limiting access, logging and monitoring activity, and sanitizing equipment before it’s retired.
What’s the difference between network security and data security?
Network security protects the infrastructure that data moves across. Data security protects the data itself, wherever it lives. In practice, you need both, and they overlap in tools like encryption and access control.
Do I need a firewall if my data is encrypted?
Yes. Encryption protects what’s inside a connection. A firewall controls which connections are allowed in the first place. They solve different problems.
What is network segmentation?
It divides a network into zones with rules between them, so a problem in one zone can’t easily spread to another. A guest Wi-Fi network kept apart from your servers is a simple example.
Can retired network equipment leak data?
Yes. Switches, routers, and firewalls store configurations, credentials, certificates, and keys. Sanitize or destroy their storage following NIST SP 800-88 Revision 2 before they leave your control.
Can I sell old networking equipment?
Often, yes. Switches, routers, and firewalls frequently have resale value. Get the equipment evaluated before you recycle it, and sanitize it first.
Ready to Retire Network Equipment?
Get a free quote to see what your old switches, routers, and firewalls are worth. Send us your list, and we cover secure shipping. Every device goes through our Phoenix Certified process, and you get paid with a Certificate of Data Destruction. Questions? Our FAQ covers most of them.
