Security services · Infrastructure

Network security that limits the damage.

If one laptop is compromised, how far can an attacker get? On a flat network, everywhere. We review your firewalls, design network zones that contain an attack, and set up monitoring that spots unusual traffic inside your network.

Get a fixed-price quote
Vendor-neutralFirewall clean-up without outagesSegments tested, not assumed
network review · sample● demo
  1. FOUND Guest Wi-Fi can reach the server network
  2. FLAGGED 312 firewall rules unused for a year
  3. BLOCKED Lateral movement stopped at segment gate
  4. FIXED VPN now requires MFA
  5. PASSED Card data zone isolated and tested
In plain words

Network security is about controlling which traffic can go where, from the internet edge to your data centre and cloud. We review firewall rules and remove risky and unused ones, design segmentation so an attacker who gets into one area cannot reach the rest, deploy and tune intrusion prevention and network detection (IDS/IPS, NDR), and secure remote access. We are vendor-neutral and work with the equipment you already have.

Duration
2–6 weeks
Vendors
Vendor-neutral
Covers
Firewalls · segments · NDR · VPN
Pricing
Project or managed
Why segmentation

One infected laptop: contained, or company-wide?

Ransomware moves fastest across flat networks, where every machine can talk to every other. Segmentation turns one infected machine into a contained incident.

Flat versus segmented network. On a flat network one infected laptop can reach HR, files, database, payments, backups and cameras. On a segmented network the laptop sits in a users zone; a gate blocks its traffic, and only approved traffic, such as HR staff reaching the file server, crosses into the server zone. FLAT NETWORKLAPTOPHRFILESDATABASEPAYMENTSBACKUPSCAMERASOne infected laptop can reach everything.SEGMENTEDUSERSSERVERSCARD ZONERECOVERYDEVICESGATEBLOCKEDLAPTOPHRFILESDATABASEPAYMENTSBACKUPSCAMERASThe infection stays in one zone. Only approved traffic crosses.
Segmentation does not stop the first infection. It stops the first infection from becoming a company-wide outage.
What we cover

From the edge to the data centre.

  • Firewall rule review

    Risky, duplicated and unused rules found, with a clean-up plan that avoids outages.

  • Segmentation design

    Zones for users, servers, payments, backups, guests and devices.

  • IDS/IPS and NDR

    Detection that spots attackers moving around inside your network.

  • Secure remote access

    VPN hardening or replacement, with MFA and device checks.

  • Wi-Fi security

    Guest isolation, modern encryption and rogue access points.

  • Device hardening

    Routers, switches and firewalls set up against CIS Benchmarks.

  • DNS and web filtering

    Blocking known-bad sites and suspicious domains.

  • Factory and building systems

    Cameras, building management and factory equipment kept apart from the office network.

  • Cloud networking

    VPCs, peering, private endpoints and cloud firewalls.

How it works

Measured changes, no surprises.

  1. Week 1

    Topology mapping

    An accurate diagram of how your network really connects today.

  2. Weeks 1–2

    Rule analysis

    Every firewall rule checked against real traffic logs.

  3. Weeks 2–3

    Design

    Target zones and rules, agreed with your team.

  4. Weeks 3–5

    Implementation

    Changes made in stages within your change windows, each with a rollback plan.

  5. Week 6

    Validation

    We test that every zone blocks what it should, and allows only what it must.

What you get

A network you can explain and defend.

HANULSECNetwork security review CLIENTSample · hospital network SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High5Medium8Low12 RULES · 1,240 REVIEWED · 312 REMOVED SEGMENTS VERIFIED Sample layout, not client data
  • 01
    Network architecture diagram

    Current and target, readable by auditors and new staff.

  • 02
    Rule base risk report

    Risky, unused and duplicate rules, and what to do with each.

  • 03
    Segmentation roadmap

    Zones and rules in a practical order.

  • 04
    Validation test results

    Proof that segments hold, useful for PCI DSS and ISO 27001.

  • 05
    Managed option

    Ongoing rule reviews and device management, if you want it.

Who it is for

For networks that grew over the years.

  • Organisations whose network grew without a plan
  • Companies with firewall rules nobody dares to touch
  • Payment businesses that need card data isolated for PCI DSS
  • Hospitals, factories and offices full of connected devices
  • Firms planning to move from VPN to zero trust

Next step: zero trust

Good segmentation is the foundation for zero trust, where every request is checked, wherever it comes from.

Standards

Designed against proven baselines.

CIS BenchmarksSecure configuration
PCI DSS v4.0Card data security
NIST SP 800-207Zero trust architecture
NIST CSF 2.0Govern to recover
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is network segmentation?
Dividing a network into separate zones, such as users, servers, payments and guest Wi-Fi, with controlled gates between them. If an attacker gets into one zone, they cannot freely reach the others.
Q02Will cleaning up firewall rules cause outages?
Not if it is done carefully. We use traffic logs to show which rules are really unused, remove them in stages within your change windows, and keep a rollback plan for every change.
Q03What is NDR?
Network detection and response tools watch traffic inside your network for signs of an attacker moving around, something firewalls at the edge cannot see. They feed alerts to your SOC.
Q04Which firewall vendors do you work with?
We are vendor-neutral and work with the equipment you already own, such as Fortinet, Palo Alto Networks, Cisco, Check Point or Sophos, as well as cloud firewalls.
Q05Do we need segmentation for PCI DSS?
PCI DSS does not strictly require it, but isolating card data systems greatly reduces how much of your network is in scope for the assessment. If segmentation is used to reduce scope, it must be tested regularly.
Q06How is it priced?
As a fixed-fee project for reviews and design, or a monthly fee for managed rule reviews and device management.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings