BTnet Security: protection built into your leased line

What BTnet Security does

Every BTnet line gives you a dedicated, symmetrical connection to the internet. BTnet Security adds protection on the line's managed equipment, so threats can be filtered before they reach your office network. BT lists four parts to the service:

• Advanced malware protection: inspects traffic for known malicious files and blocks them at the edge
• Content (URL) filtering: lets you block categories of websites, or specific sites, for everyone on the network
• Intrusion detection and prevention: looks for patterns of known attacks and exploit attempts, and can stop them
• Regular security patch updates: keeps protection current against new threats without you scheduling updates

BT's BTnet Wi-Fi brochure adds that the policies span the whole network and include a firewall. Because it all runs on BT-managed Cisco Meraki equipment, you get the line and an edge security layer from one managed platform, with no separate appliance for you to patch.

How to get BTnet Security

BTnet Security is tied to the equipment you choose. BT's product page says it is available only to BTnet customers with the Cisco Meraki managed equipment option, and BT's terms make it available where the managed equipment supports it.

BT treats BTnet Security as an in-life option: you can include it in your first order, or ask for it in writing later during the contract. If you are on another plan today and want BT's security service, the route is a change to BTnet Meraki; ask us what that involves for your contract and equipment. See BTnet leased line plans for the full comparison.

A layer, not a guarantee

BTnet Security is useful protection, but it is one layer. BT's terms say plainly that BT does not guarantee the security of the BTnet service against unauthorised or unlawful access or use, and they ask customers to keep their own equipment protected against viruses and other security breaches. In practice, edge security cannot see everything:

• Laptops off site are outside the office network, so they need their own endpoint protection
• Email threats such as phishing often arrive through cloud mailboxes rather than across the edge in a way an edge device can stop
• Stolen passwords are best handled with multi-factor authentication and good identity controls
• Encrypted traffic limits what any edge device can inspect
• Ransomware recovery depends on tested backups, not only on blocking

The sensible approach is defence in depth: BTnet Security at the edge, plus endpoint, email and identity protection and reliable backups. Forever Group's cloud security site covers those other layers.

Guest Wi-Fi, filtering and your responsibilities

BTnet Security is often chosen alongside BTnet Wi-Fi, especially where guests or the public get online. BT's terms set out a few points worth knowing:

• Apply your policy to both networks. If you enable staff Wi-Fi and guest Wi-Fi on the managed equipment and have BTnet Security, BT's terms ask you to make sure your security policy is active on both.
• Guest use is your responsibility. If you give people access through Wi-Fi or guest Wi-Fi, you are responsible for misuse that breaks BT's acceptable use policy.
• Passwords are yours to set. You choose and protect Wi-Fi passwords; leaving a network open is a risk you accept.
• Cleanfeed is separate. BT applies Cleanfeed filtering (the Internet Watch Foundation list of child sexual abuse content) to BTnet traffic as standard. Content filtering in BTnet Security is a broader tool you configure for your own policies.

Schools and other organisations with safeguarding duties should treat content filtering as one part of their own filtering and monitoring arrangements; see leased lines for schools.

Card payments and regulated data

One point catches out retailers and hospitality businesses: BT's terms say BTnet is not PCI DSS compliant and must not be used to process, store or transmit cardholder data. BTnet Security does not change that. Card payment systems need their own controls and the arrangements your payment provider requires. See leased lines for retail and hospitality, and ask us before you plan payment traffic over the line.

Similarly, BTnet Security does not by itself make a network compliant with any standard. It can support your controls, alongside your own policies, records and wider security.

Who BTnet Security suits

• Businesses without a dedicated security team, who want protection applied and updated at the edge without running a separate firewall
• Sites with guest or public Wi-Fi, where content filtering and separation from business systems matter
• Branch offices that should follow the same edge policy as head office, on the same managed equipment
• Organisations replacing an ageing firewall, who would rather move edge security onto the managed line than buy and patch another appliance

It suits fewer organisations whose IT team already runs a well-managed firewall estate with its own reporting and policies. For them, BTnet wires only or the managed Cisco router with their own firewall behind it may be the cleaner design.

How Forever Communications helps

As an Authorised Supplier for BT, Forever Communications supplies BTnet with BTnet Security. We can help you decide whether it is the right edge layer for you, and how it fits with what you already have:

• Explain what BTnet Security covers and where your other protections need to take over
• Plan BTnet Meraki equipment sized for your line with security switched on
• Scope content filtering, staff and guest networks with BTnet Wi-Fi
• Check what changing plan would involve if you are on wires only or the Cisco router today

Pricing depends on your site, plan, speed and term, so ask us for a quote. Contact us to talk it through.