In this article
In a company with several shops, restaurants, clinics or offices, network security is only as strong as the most neglected site. The solution is a centrally managed firewall: a policy defined once, applied to every site, with updates and alerts controlled from a single dashboard. This is how DataRoad - IT Services and Consulting manages distributed business networks, from restaurant groups to offices with hundreds of workstations.
In brief
- The weakest link decides One badly configured site is enough to compromise the rest.
- Three recurring failures Different rules at each site, devices without updates and customer Wi-Fi on the same network as the till.
- One answer Central firewall management, with the same rule template everywhere.
- The figure In SMEs, 26% of data breaches began with the exploitation of vulnerabilities (Verizon, 2026).
Nobody chooses to have ten security policies
It simply happens. The first shop opened with the operator's router. At the second, a local technician opened a port on the firewall to get the payment terminal working. The third inherited another site's configuration, but an old version of it. Head office was updated; the other sites were left for later.
Five years on, nobody can answer three questions: which rules are active at each site, who has remote access to each device and when the last update was carried out.
Where multi-site networks usually fail
Policies that vary from shop to shop
At one site, dangerous websites are blocked; at another, they are not. At one, the management software supplier only has remote access during an intervention; at another, that access has been left open since installation. An attacker needs only one open door to get in and, if the sites are interconnected, to move on to the others.
Firewalls and routers left un-updated
These devices have vulnerabilities too, and manufacturers publish fixes. But nobody remembers the device behind the counter of a shop in Faro. According to Verizon (2026), in SMEs the exploitation of vulnerabilities was the entry point in 26% of the breaches analysed, ahead of credential theft and phishing.
Customers on the same network as invoicing
In hospitality and retail this is the most frequent case: customer Wi-Fi shares the network with the manager's computer, the kitchen printer and the till terminal. A customer's infected laptop is, technically, in the same room as invoicing. See how to separate these networks in secure business Wi-Fi and guest networks.
What central firewall management means
The firewall is each site's doorman: it decides what comes in and what goes out. With central management, every doorman follows the same manual, kept in one place. As in a hotel chain, the procedure is written at head office and carried out identically in every unit; when it changes, it changes everywhere on the same day, without anyone travelling.
- A single rule template What is allowed and blocked at every site, with documented exceptions.
- Planned updates Applied to every device within a defined window and confirmed.
- A single alert dashboard If a shop loses its internet or a device detects an attack, someone finds out.
- Segmentation by function Customers, staff, tills and cameras on separate networks, the same everywhere.
- Encrypted links between sites Shops communicate with head office only for what they need.
Side-by-side comparison
| Situation | Each site on its own | Central management |
|---|---|---|
| Changing a rule | One intervention per shop, different results | One change, applied to all |
| Updates | Whenever someone remembers | Planned and logged window |
| New shop | Manual configuration from scratch | The existing template is applied |
| Visibility | Only when someone complains | Alerts and reports on one dashboard |
| Customer Wi-Fi | Often alongside the till | Isolated network at every site |
| Supplier access | Left open and forgotten | Individual, limited and logged |
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
Two clients, the same logic
The restaurant group Fullest entrusted DataRoad with the network for 16 restaurants in Lisbon and Porto, among them Adega de São Roque, Bacalhau com Todos and Peixaria do Rossio. The project included structured cabling, a business wireless network, firewall and security, with centralised cloud management, real-time remote monitoring and the same configuration in every restaurant. The network was segmented between staff and customers, with a captive portal for customers.
On a different scale, Ventask, with more than 350 workstations and a client since 2016, has its networking managed by DataRoad: corporate firewalls, switches, access points, device security and remote working solutions. Ventask's 24/7 monitoring and proactive alerting are part of the Premium 365 plan.
In both cases, the rules do not depend on who is at each site: they are defined, applied and watched from a single point.
Migration in five stages, without closing the doors
- Inventory — each site's device, installed version and who has access to it.
- Rule template — defined with management: permissions, blocks and exceptions.
- Pilot shop — validation with the payment terminal, management software and cameras all running.
- Phased roll-out — site by site, during quieter hours.
- Continuous oversight — alerts, updates and reports become routine through the NOC and proactive monitoring.
Many current devices already support central management; for others, replacement pays off. We compare the options in managed or purchased firewall. If a site's internet is critical, also read about internet connection redundancy.
Frequently asked questions
Do all the shops' devices need replacing?
Not always. The inventory shows which already support central management and only need reconfiguring. Those that no longer receive updates or do not allow central management are replaced in order of risk.
Does each shop need its own firewall?
As a rule, yes, because each site has its own internet connection and that is where the firewall operates. The difference lies in managing them all as one.
What if a shop's internet goes down?
With central management, the failure is detected by the alerts rather than by a customer complaint. With a second connection, failover can be automatic; we assess site by site whether it is worthwhile.
How long does the transition take?
It depends on the number of sites and the condition of the devices. The inventory and rule template are ready within a few weeks; the roll-out then follows in phases, without stopping operations.
Next step: a security map of your sites in 10 working days
We inventory the firewalls and networks at every site, identify diverging rules, outdated devices and mixed networks, and hand over the plan for a single policy. Management of managed firewalls and cybersecurity is included in IT Unlimited Premium, with on-site support. Request a no-commitment proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
