Ultra Broadband Security: The Cisco Meraki Package

How security works on Ultra

On the other BT Business Broadband plans, security is a set of controls: Content Controls and Web Protect at network level on every plan, and Wi-Fi Security Controls in the BT Business app on Pro. On BT Ultra Broadband, BT puts a dedicated security appliance from Cisco Meraki in place of the Smart Hub, and the Cisco Meraki security package takes the place of Wi-Fi Security Controls.

The appliance does two jobs. It is the router that connects your premises to the internet, and it is the firewall that inspects traffic going in and out. Because every device on the network, wired or wireless, reaches the internet through it, the protection covers the whole site rather than one device at a time.

BT's material groups the package into four parts:

• Next-generation layer 7 firewall: controls which traffic is allowed in and out, down to the application level
• Advanced URL content filtering: blocks categories of website and individual sites
• Malware protection: blocks known malicious files and sites, backed by Cisco's threat intelligence
• Intrusion detection and prevention: inspects traffic for known attack patterns and blocks it

The cloud dashboard then shows what is happening on the network, and BT's specialists make changes to the configuration when you ask.

Next-generation layer 7 firewall

A firewall is the barrier between your internal network and untrusted networks such as the internet. A basic router firewall mostly decides by address and port. A layer 7 firewall can also recognise traffic by application, which is what "next-generation" refers to.

In BT's Ultra briefing, the Ultra firewall is described as able to control traffic and block specific websites and applications. In practice that means rules such as:

• Blocking inbound connections that nobody inside the business started
• Allowing or blocking specific applications and websites at the edge of the network, as BT's briefing describes
• Prioritising voice and video traffic, which BT lists as a feature of the appliance
• Keeping the guest network separate from business devices

You do not write the rules yourself. You tell BT what you need, using BT's online change request form linked from its help pages, and BT's team makes the change. If you want a Meraki firewall that your own IT team or a specialist manages directly, that is a different product: Forever Group supplies Meraki firewall deployments separately.

URL content filtering

Content filtering stops people on the network reaching categories of website you do not want used at work, and helps keep staff away from sites known to be risky.

On Ultra, BT's material says:

• More than 70 website categories can be blocked
• A default template is applied as standard, so filtering works from day one without you choosing categories
• Categories can be customised on request, for example to allow a category the template blocks
• Individual websites can be allowed or blocked, so a supplier portal that falls into a blocked category still works, or a single site can be stopped
• Social media access can be controlled

One limit to know: BT's Ultra terms say the content filter does not let you block apps. It works on websites. If controlling particular apps matters to you, raise it when we quote, because it changes what you should expect from the package.

Malware protection and threat intelligence

The malware protection on the appliance inspects files and connections passing through it and blocks those identified as malicious. BT's briefing says it is designed to stop viruses, malware, spyware, adware and ransomware reaching the network.

It is backed by Cisco's threat intelligence, which BT's material credits to Cisco Talos, Cisco's security research team. The practical benefit for a small business is that protection updates automatically as new threats are identified, without anyone downloading signature files.

It is a network control, not antivirus on each laptop. It protects traffic that passes through the appliance on your premises, so a laptop on a home network or a hotel Wi-Fi is outside it. Device-level protection, backups and staff awareness still matter; our broadband security guide sets out the options across BT's plans.

Intrusion detection and prevention

Intrusion detection and prevention (IDS/IPS) looks inside network traffic for the signatures of known attacks, such as attempts to exploit a vulnerable service, and blocks matching traffic automatically.

BT's briefing says the Ultra appliance uses Cisco's Snort signature database for this. Snort is the open-source intrusion prevention engine that Cisco maintains. The signatures update as new attack patterns are published, so the appliance can recognise threats that did not exist when it was installed.

Intrusion prevention is one of the features that separates Ultra from the other BT plans: BT lists intrusion detection and prevention for Ultra only. Content Controls, Web Protect and Wi-Fi Security Controls are described in terms of websites and devices instead.

How Ultra compares with security on other BT plans

The two are different tools rather than a simple ladder. Wi-Fi Security Controls is about devices: who joins, when they are paused and what each group can browse, all changed by you in the BT Business app. The Ultra package is about the network edge: a firewall and intrusion prevention for everything behind it, managed by BT. Our Wi-Fi Security Controls page covers the Pro side, and Ultra vs Pro compares the two plans in full.

Visibility: the Meraki cloud dashboard

Ultra includes the Cisco Meraki cloud dashboard. BT's material lists what it shows:

• Device statistics for the devices using the network
• Application use, so you can see which applications take the bandwidth
• Network and service usage over time
• Security statistics, such as threats and content the package has blocked

The dashboard is for visibility and decisions. If what you see suggests a change, for example blocking a category or prioritising an application, you request it from BT. Bear in mind BT's own note that Ultra is not a proactively monitored service: the dashboard shows you the picture, but nobody is watching it for you.

What the package does not replace

A security appliance at the edge of your network is a strong baseline, but it is one layer. It does not cover:

• Laptops and phones when they are away from the office
• Email security, such as phishing filtering on your mailboxes
• Backups of your files and cloud data
• Staff awareness training and access controls such as multi-factor authentication
• Compliance work such as Cyber Essentials

Forever Group provides cyber security services for these wider needs, so the network protection on Ultra can sit inside a fuller plan.

Getting Ultra security through us

Before we recommend Ultra for its security, we check what you have today: any existing firewall and who runs it, whether anything depends on a static IP, and whether you are comfortable with BT making changes rather than managing the firewall yourself. If Ultra fits, we place the order and help you plan the filtering and guest network before the Expert Setup visit. If it does not, we tell you, and point you to Pro or a separately managed option.

Contact us to talk through Ultra Broadband security.