Business broadband security: choosing the right BT plan

Why the broadband connection matters for security

Your broadband hub is the front door between your business and the internet. Everything passes through it: staff laptops, phones, the card machine, the printer, cameras, a smart TV in the meeting room and whatever visitors bring. Security at the connection can warn people away from harmful websites, filter what is reachable, keep unknown devices off the network and, on the higher plans, inspect traffic for threats.

It also has limits, and it helps to be clear about them from the start. Connection-level security protects traffic while it uses your line. A laptop on a hotel network, a phone on mobile data, a weak password or an unpatched device are outside its reach. That is why the right answer is usually a plan with the right level of network protection, plus protection on the devices themselves and a few good habits.

The BT security ladder at a glance

This is how security steps up across BT Business Broadband:

The layers build on each other. A Pro customer still has Content Controls and Web Protect; an Ultra customer uses the Meraki package in place of the Smart Hub's controls.

Every plan: Content Controls and Web Protect

Content Controls and Web Protect are BT's network-level security, included with every BT Business Broadband plan. Web Protect, which BT also calls Web Threat Protect, warns before someone visits a website known to be harmful or malicious. Content Controls let you filter categories of website for the whole connection.

Because they work at the network, they cover every device using your BT connection without installing anything. The catch is that BT leaves both switched off by default, so you need to turn them on in My Account. It is the first thing we suggest any new BT Business Broadband customer does.

They are not antivirus: a device that leaves the building, or uses mobile data, is outside their reach.

Pro: Wi-Fi Security Controls

Wi-Fi Security Controls is included as standard with BT Business Broadband Pro and runs on Smart Hub 3, managed from the BT Business app. It adds control over devices, not just websites:

• See and approve devices: identify what is connected and hold new devices until you approve them.
• Groups and schedules: give staff, shared kit and payment devices different rules, and block access on a schedule or instantly.
• Website filters: light, moderate, strict or custom filters, plus blocks on named websites.
• Device threat protection and a dashboard: BT says it detects threats such as malware and phishing, and the dashboard shows usage and the threats stopped.

BT is clear on the limits. It filters websites, not apps. It is Pro only and cannot be added to Essential or Enhanced. It needs Smart Hub 3, so it does not work if you use your own router or put the hub into modem-only mode. You can opt out when the Pro order is placed, for example if an IT provider already runs a firewall that does the same job.

Ultra: the Cisco Meraki security package

BT Ultra Broadband replaces the Smart Hub with a Cisco Meraki security appliance and adds a security package that BT manages:

• Next-generation layer 7 firewall: controls traffic between your network and the internet, including by application.
• URL content filtering: more than 70 website categories with a default template for quick set-up, plus custom allow and block lists.
• Malware protection: backed by Cisco's threat intelligence.
• Intrusion detection and prevention: inspects traffic for known attack signatures and blocks it.
• A cloud dashboard: device, application, usage and security information in one place.

Configuration changes are made by BT when you request them through BT's online form, so you get a managed firewall without running it yourself. BT is equally clear about who Ultra is not for: businesses with complex or bespoke networks, those that want to manage their own security settings, those wanting a proactively monitored service, and those keeping an existing third-party firewall. Ultra also has no static IP. Read more in Ultra Broadband security, and for Meraki firewalls outside BT's package see Forever Group's Meraki firewall page.

Devices: Endpoint Threat Protect

Network security protects the connection; endpoint security protects the device. BT sells Endpoint Threat Protect as a paid add-on to any BT Business Broadband plan, priced per device, and describes it as protection for the devices that power your business.

Because it runs on the laptop or computer itself, it is the layer that stays with a device when it leaves the office, which neither Web Protect nor a firewall can do. If your team works from home, on the road or on client sites, it is worth including in the quote. We confirm the terms and the devices it covers when we quote.

Security basics no broadband plan replaces

Whichever plan you choose, these habits do more for a small business than any single product:

1. Turn on what you already have. Switch on Content Controls and Web Protect in My Account, and set up Wi-Fi Security Controls on Pro.
2. Separate guests. Put visitors and personal devices on guest Wi-Fi.
3. Keep the Wi-Fi password private and change it when people leave.
4. Update everything: computers, phones, printers and other connected kit, and replace devices that no longer get updates.
5. Use multi-factor authentication on email, cloud apps and remote access.
6. Back up your data somewhere separate from the office network, and test a restore.
7. Review what is exposed. If you have a static IP with remote access or port forwarding set up, check it is still needed and locked down.
8. Help staff spot phishing, since a convincing email is still the easiest way in.

The government-backed Cyber Essentials scheme sets out a similar baseline of technical controls, and is worth a look if customers or contracts ask for it.

Which level of security fits your business?

A starting point for matching the plan to the risk:

Our Ultra vs Pro comparison goes deeper on the two higher plans, and broadband for accountants and solicitors covers a sector where client data raises the stakes.

Planning broadband security with Forever Communications

When we quote, we ask what is on your network, who uses it, whether an IT provider already runs a firewall, and how your team works away from the office. From that we recommend the plan and add-ons that fit, and point out where a need goes beyond what broadband security is designed to do. After installation we can help with questions on switching on and setting up BT's controls.

Pricing is confirmed at quote. Contact us to talk about security on BT Business Broadband, or about BT Ultra Broadband if you want the managed firewall.