The Firewall That Was Never Plugged In

A local government came to Tech Dynamix as a new client, and the engagement started the way all of ours do. Before changing anything, we document what exists and what depends on it, which is the methodical onboarding we use for every new client. That inventory turned up a real firewall, installed in the rack and not plugged in.

Nobody had ever put the story together in one place, and it was simple. Whenever the firewall was connected the network went down, so at some point somebody unplugged it to keep the office working, and it stayed unplugged. The device had never been configured correctly, and nobody went back to fix it.

The previous IT arrangement reported that a firewall was in place. That was true only in the narrowest sense, because one had been bought and mounted.

Every year the office renewed its cyber insurance, and every year somebody answered the questionnaire's firewall question with yes. They answered in good faith, because that's what they'd been told, and meanwhile nothing was doing the job the firewall was bought for.

The insurance answer mattered most, and the client had no idea. A false answer on a cyber insurance application, however innocently given, is the kind of thing a carrier can point to when deciding whether to pay a claim. The office could have learned that its policy wasn't what it believed at the worst possible time, during a claim after an incident.

Nobody in this story deserves blame. A firewall that takes the network down when it's plugged in has a configuration problem, and configuring one correctly around a working office's applications and traffic is specialist work. What went wrong was that the gap between "we bought one" and "we have one" went unmeasured for years, and the insurance answers kept coming out of that gap.

The fix was ordinary. Tech Dynamix replaced the aging unit with a current firewall and configured it for the office's real traffic, deciding what should pass and what should be blocked or watched. Ongoing firewall management keeps those rules current.

It went in as part of onboarding. When the firewall came online, nothing visible happened: the network stayed up and everyone kept working. From that day, the insurance answer was true.

The office has been a managed client for several years, and its cyber insurance just renewed again on answers that describe the network as it is. The network stayed up the day the firewall came online, and it has stayed up since.

• A configured firewall doing its job, monitored as part of the managed agreement and our cybersecurity services
• An insurance questionnaire answered from documentation, not from inherited assurances

For local governments the stakes have gone up since then. Public offices hold the data attackers want, and insurers have responded with harder questions and closer checks on answers after incidents. An answer that can't be traced to something real is a liability sitting inside the policy.

The wider lesson applies to any organization that has answered a security questionnaire with what it was told instead of what it verified. Documentation is the difference, and it's why our engagements begin with an inventory before any proposal. We go through the common questions in what your cyber insurance application is really asking.