Your company's local network has become the heart of almost everything you do.Access to applications, shared files, cloud services, video calls, printers, IoT, IP cameras…and, of course, Windows as the dominant operating system on computers. The problem is that this same LAN is now a tempting target for any even slightly savvy attacker.
It's not enough to just "install an antivirus and that's it"Improving your company's security using Windows LANs involves combining good network design practices, access controls, perimeter protection, proper configuration of Microsoft Entra services (formerly Azure AD), and—something we often forget—discipline with backup and credential management. Let's see, step by step, how to truly secure a modern corporate LAN without losing your mind in the process.
What is a LAN network in a modern Windows business?
A LAN (Local Area Network) is the network that connects the devices in your office or across multiple floors/nearby buildings, allowing the sharing of data, applications, printers, internet access, and cloud services. A typical Windows environment includes PCs, servers, network printers, VoIP phones, Wi-Fi access points, IP cameras, and an increasing number of IoT devices.
Most current enterprise LANs use Ethernet as their core technologycombining copper or fiber optic cabling and, in many cases, Wi-Fi (WLAN). When devices connect wirelessly, we still refer to it as a local area network, but under the IEEE 802.11 standard, with all the added risks of wireless connectivity.
In medium and large companies, it is common for the LAN not to be a single "flat soup"
Several subnets and VLANs are deployed to separate departments, critical services (servers, domain controllers, cameras, IP telephony…) and guest zones, and managed routers and switches are used to control traffic flow and enforce security policies.
Key components of a LAN and how they influence security
The security of your LAN in Windows depends on both the hardware and the configurationThese are the basic elements that you must have under control and well configured to avoid leaving doors open to internal or external attackers.
- Cables and physical mediumOlder cabling (Category 5/5e for long distances) not only limits speed but can also cause transmission errors and link drops that mask security issues or hinder monitoring. Migrating to Cat6, Cat6A, or higher improves performance and stability and reduces bottlenecks in critical segments.
- SwitchesThese are the devices that connect all the equipment on the LAN. A well-configured managed switch allows you to create VLANs, apply QoS, limit ports, detect loops, enable 802.1X authentication, and more. A cheap, unmanaged switch means less control over what connects and what traffic flows through it.
- Routers and firewallsThe router is usually the gateway to the internet and often includes firewall functions. For a business, the ideal solution is to have a dedicated firewall (physical or virtual) that clearly separates the internal LAN from the internet, defines which ports are exposed, and applies traffic inspection and content filtering.
- Wi-Fi Access Points (WAP)These are the entry point for mobile phones, laptops, and IoT devices. They should be configured with robust encryption (WPA2-Enterprise or WPA3), centralized authentication, separate guest networks, and, if possible, integration with your Microsoft Entra Conditional Access policies.
- Bridges and repeatersBridges, Wi-Fi extenders, and signal repeaters extend network range, but if misconfigured, they can create uncontrolled and unmonitored "ghost" segments. It is critical that they respect segmentation and inherit the same security policies as the rest of the LAN.
- Windows Servers and Domain ControllersThe file server and, especially, Active Directory domain controllers concentrate credentials, group policies, and sensitive data. If someone gains RDP access to a domain controller with weak credentials, they can literally take control of the entire organization.
- Client computers with WindowsThey are the link where technical and human factors are most combined. Outdated systemsOld drivers, outdated antivirus software, or users with local administrator privileges are the perfect recipe for any malware to turn a minor incident into a disaster.
Common types of attacks against corporate LANs
A corporate LAN running Windows can suffer from anything from very noisy attacks to stealthy intrusions. that go undetected for months. Understanding the most common vectors is key to designing effective defenses.
- Scanning and reconnaissance attacksThe attacker explores which devices are on the network, which ports are open, and which services are exposed. They may use TCP scans, port sweeps, and packet fragmentation techniques to try to bypass some filters. Although these attacks seem "harmless" at first, they are the preliminary phase to actual exploitation.
- Traffic sniffing and snoopingWith a device connected to a misconfigured switch port, or by exploiting an open or poorly secured Wi-Fi network, an attacker can capture LAN traffic, observe plaintext credentials (if TLS is not used), sessions, internal addresses, and behavioral patterns. In "snooping" mode, they can also manipulate or extract data for later exploitation.
- Malware and modification or damage attacksRansomware, Trojans, and worms exploit outdated Windows systems, accounts with excessive privileges, and a lack of segmentation to encrypt files, steal data, or manipulate critical information. Attacks such as tampering or data diddling allow attackers to alter accounting records, databases, or payrolls without immediate detection.
- Password theft (password cracking)If domain passwords are weak or reused across systems, brute-force or dictionary attacks can quickly crack them. Attackers also search for password hashes on domain controllers or compromised workstations to perform pass-the-hash attacks. Use password managers such as password managers to reduce reuse and facilitate unique credentials per service.
- DNS spoofing and malicious redirectsPoisoning internal or external DNS allows you to redirect users to fake websites even if they type the correct URL. This can be used to capture credentials, spread malware, or impersonate corporate applications.
Basic best practices for securing a Windows LAN
The starting point for securing your LAN is to implement very clear digital hygiene measures. that affect passwords, updates, network segmentation, and physical and logical access control to equipment.
- Strong password policyThis policy requires the use of long passwords (minimum 12 characters) with uppercase and lowercase letters, numbers, and symbols, avoids the use of obvious personal information, and configures a reasonable periodic expiration. In Windows environments, this is easily implemented through Group Policy Objects (GPOs) on the domain. Complement this policy with password managers such as [insert password manager name here]. KeepassXC.
- Strong authentication and identity verificationIt combines username and password with multiple authentication factors (MFA) and, where appropriate, biometrics (fingerprint, facial recognition) integrated into Windows Hello for Business. The harder it is to impersonate a user, the fewer options an attacker has to steal login credentials.
- Updated SystemsKeeping Windows, network drivers, firmware for switches, routers, and access points, as well as server software, up to date is critical. Many attacks still exploit old vulnerabilities for which patches have been available for months or years. It's advisable to take advantage of providers that offer patches and audits.
- LAN SegmentationIt's not a good idea to have the entire company on a single subnet. Use VLANs to separate users, servers, VoIP, cameras, IoT devices, guests, and test environments. This makes it harder for an attacker who has compromised a single machine to move laterally.
- Encryption of sensitive trafficIt enforces the use of TLS in internal and external applications (HTTPS, SMTPS, LDAPS, etc.), protects remote connections with robust VPNs, and uses secure protocols for device management (e.g., SSH instead of Telnet). This prevents a sniffer on the LAN from "seeing" credentials or plaintext data.
Zero Trust Security: Protect network access with Microsoft Entra and Global Secure Access
The Zero Trust philosophy is based on a very simple idea.Do not automatically trust any device, user, or location, even if it is "inside" the LAN. Microsoft has embodied this approach in its Secure Future Initiative, specifically in the "Secure Networks" pillar.
For businesses using Windows and Microsoft services, Entra (formerly Azure AD)This translates into adding several layers of network and access protection: continuous session monitoring, control over where the user connects from, which network route they use, and what type of traffic they generate. This is where features like Global Secure Access, Microsoft Login Private Access, and Conditional Access policies come into play.
Configure named locations in Microsoft Login ID It allows you to specify which corporate networks, branches, and regions are legitimate and trusted. Without these definitions, location-based risk detections perform significantly worse and increase false positives, making it difficult to distinguish a normal office login from a suspicious attempt originating from an anonymous VPN or a country where your company doesn't even operate.
Tenant Restrictions v2 (TRv2) They are another key pillar: they prevent unauthorized users on your LAN and corporate devices from authenticating to external Microsoft Entra tenants. Without them, someone with stolen credentials could connect to a tenant under their control and leak data through external OneDrive, SharePoint, or Teams without your traditional DLP tools detecting it.
Universal Continuous Access Evaluation and granular session control
In Windows environments integrated with Microsoft Entra, it is essential to control the lifespan of access tokens.With Universal Access Continuous Assessment (Universal CAE), every network connection protected by Global Secure Access is dynamically revalidated based on critical events.
If Universal CAE is not enabledA stolen token can remain valid for 60 to 90 minutes even after the user has changed their password, their account has been disabled, or a high risk has been detected. This gives attackers time to move around the network, connect to internal applications, and exfiltrate data.
Activating Universal CAE in strict enforcement modeAny session revocation, high-risk signal, or change in user status forces almost immediate reauthentication. Furthermore, token reuse attempts from different IPs are more effectively blocked, eliminating a common attack vector in Windows LANs.
It is important to review all conditional access policies to ensure they are not disabling CAE on certain workloads. Some companies, for compatibility reasons, create exceptions that then become permanent loopholes.
Global Secure Access Client: Bringing a secure LAN to all Windows computers
For Zero Trust network protection to be effective, all managed devices must use the Global Secure Access client.If a corporate Windows PC does not have this client installed, its traffic can go directly to the Internet or internal resources without going through perimeter controls or compliance checks.
Without the client deployed on all managed endpoints Attackers can exploit these "off-hook" devices to gain initial access, move laterally across the LAN, or extract information. Furthermore, these devices do not benefit from network checks in conditional access policies, source IP restoration, or tenant restrictions.
With the client active, Windows devices can connect securely. Access to both SaaS applications and internal resources is provided through Microsoft Entra Private Access, always applying the same identity and network policies. The Global Secure Access dashboard allows you to monitor client status, verify connectivity, and take corrective action if issues are detected.
Another key point is the Global Secure Access licensesTo use Microsoft Entra Internet Access and Microsoft Entra Private Access, a Microsoft Entra ID P1 is required. If your tenant does not have the appropriate licenses or they have not been assigned to users, their traffic will not be routed through Global Secure Access and will remain unprotected. It is advisable to use group-based licensing and monitor expirations to avoid inadvertently losing coverage.
Traffic forwarding profiles and control of what goes in and out of your LAN
Traffic forwarding is the mechanism that ensures LAN traffic passes through the security layers from Global Secure Access and does not "escape" directly through the Internet door.
Microsoft defines three types of forwarding profiles: one for Microsoft traffic (M365, Microsoft Entra ID, Graph, SharePoint, Exchange…), another for Private Access (internal resources) and another for General Internet Access (public web, non-Microsoft SaaS, etc.).
If these profiles are not enabledSecurity policies, content filtering, threat protection, and CAE cannot be applied. Any cybercriminal with valid credentials can connect to your resources from any network, without going through your modern perimeter.
It is also important to clearly define the scope of each profileIf you assign forwarding to "all users" without first testing it with pilot groups, a configuration error could leave the entire company offline. Conversely, if you define too narrow a scope, you'll have users operating outside of protections without anyone noticing.
Finally, verify that Microsoft 365 traffic is actively flowing through Global Secure Access.If some of that traffic is left out (due to old clients, manual configurations, or clientless devices), you lose visibility into the workloads most critical to productivity and collaboration, and it becomes more difficult to correlate real IPs with logins and alerts.
Secure Web Gateway, content filtering and TLS in Windows environments
A secure Windows corporate LAN is not just about blocking ports in the firewall.It is also vital to inspect outgoing HTTP/HTTPS traffic, as most modern threats travel encrypted.
The Internet Access forwarding profile This profile forces your users' web requests to pass through Global Secure Access's Secure Web Gateway (SWG). If this profile is not enabled, users can browse directly and download malware, connect to command and control domains, or exfiltrate data without any centralized filtering.
Web content filtering directives are the basis of this controlWithout them, access to any category of site (malicious, phishing, pirated software, inappropriate content, etc.) is open. The most effective approach is to use rules based on categories (malware, fraud, piracy, criminal activity, etc.), rather than relying solely on lists of specific URLs, which quickly become outdated.
These directives must be linked to security profilesIf these features are created but not associated with any profile or the reference profile, they are not applied at all and generate a false sense of security. Furthermore, integration with Conditional Access allows for stricter filtering when a higher risk is detected (for example, if the device is non-compliant or the user logs in from an unusual location).
A critical component is TLS inspectionSince almost all web traffic is encrypted, if HTTPS sessions aren't decrypted at a control point, many filtering, DLP, and threat detection features will stop working. This is achieved using an intermediate CA certificate that dynamically generates certificates for the sites your Windows computers connect to.
Be careful with TLS exceptions and certificate management
TLS inspection is not a "set it once and forget it" situation.There are two particularly sensitive points: the bypass rules and the expiry of the inspection certificate.
TLS Bypass Rules They allow you to exclude certain domains or applications that don't support inspection (for example, services with certificate pinning or mutual TLS). The problem arises when these exceptions accumulate over time, stop being checked, and become blind spots that attackers deliberately seek out to tunnel their command and control communications.
It is advisable to periodically review the bypass rules and remove any that are redundant or duplicate destinations already on the system's skip list. Global Secure Access limits the number of rules and destinations per tenant, so keeping the configuration clean and secure makes administration easier.
Regarding the TLS inspection certificateWhen it expires, TLS termination immediately stops working. You lose URL filtering, threat detection, and any control over HTTPS traffic. It's not uncommon for attackers to try to time their campaigns with periods when they know some organizations relax their controls during certificate renewals.
Ideally, maintain a window of at least 90 days before expiration.Use certificates with a minimum validity of six months and plan for renewal using your PKI infrastructure (ADCS, OpenSSL, etc.). Additionally, monitor the TLS inspection error rate and keep it below 1%, as higher rates often indicate systemic trust issues, incompatibilities, or even deliberate attempts to cause inspection failures.
Threat intelligence, cloud firewall, and branch office protection
Beyond filtering by categories, the use of threat intelligence Dynamic lists of known malicious domains and URLs are essential for blocking connections to active attack infrastructure. If you don't enable this filtering in Global Secure Access, devices can continue communicating with command and control servers even after being detected at other layers.
The Global Secure Access baseline security profile It offers generic protection for the entire tenant, but it's a good idea to create custom profiles linked to Conditional Access policies to take context into account (who the user is, what device they are connecting from, where they are connecting from, etc.).
For branches connected via IPsec tunnelsGlobal Secure Access's cloud firewall is responsible for controlling outbound traffic to the internet. If you don't configure firewall policies for these remote networks, all their outbound traffic will pass through without any network layer filtering, allowing an attacker who compromises a branch office workstation to connect to any external destination without restriction.
Defining a "deny by default" stance And then opening only the necessary traffic from branches significantly reduces the chances of exfiltration and lateral movement to other environments, such as the cloud.
Data loss prevention, file transfer, and generative AI protection
One of the easiest ways to extract information from a LAN It involves leveraging legitimate file transfer services, cloud storage, or even generative AI applications to upload sensitive documents.
Network content filtering policies in Global Secure Access allow monitoring and control file transfers through browsers, applications, and APIs. Without these policies, a malicious user or a compromised account could upload confidential documents, credentials, or intellectual property to external services with virtually no trace on your endpoint systems.
In the field of AI, AI Gateway and its Prompt Shield protection They add another layer: they prevent enterprise AI applications from suffering command injection attacks (prompt jailbreaks, malicious instructions hidden in external content, etc.) that could cause the model to ignore internal policies, reveal internal data, or generate phishing content.
Implement these controls at the network level instead of app by app It ensures a consistent stance: you don't depend on each development team to independently implement security measures against prompt injection and data loss in their AI solutions.
Global Secure Access network-based conditional access and signaling
Microsoft's Conditional Access policies They are the glue between identity and network. For a company that wants to get the most out of its Windows LAN, it is key to require that users only authenticate to corporate resources if their traffic passes through Global Secure Access.
The “compatible network” controls in Conditional Access They allow precisely that: verifying that authentication comes from Microsoft's security service and not from any internet IP address. Without these controls, an attacker who steals credentials can connect from anywhere, bypassing your content filters, threat intelligence, or CAE.
Global Secure Access signage for Conditional Access This solves another problem: when traffic passes through the proxy, the source IP address seen by Microsoft Entra ID is usually the proxy's, not the user's actual IP address. Enabling this signaling allows additional information to be injected into the request so that location-based policies and risk detections (impossible journeys, anonymous IPs, unknown login properties) continue to function correctly.
If this signaling is not activatedLogin logs will only show outgoing proxy IPs, complicating any forensic investigation or incident response, and reducing the accuracy of automated risk detections.
Microsoft Private Access: Enter: Zero Trust for Internal Resources
Many companies still rely on traditional VPNs to access internal resources (file servers, ERPs, internal applications). Microsoft's private access Entra seeks to replace that model with a Zero Trust model, in which each request is authenticated and authorized granularly.
Private network connectors are the "brokers" that connect your LAN to Global Secure AccessIf they are inactive or outdated, users may be tempted to resort to less secure alternative access methods, or you will be forced to expose services directly to the Internet.
Each group of connectors should ideally have at least two active instances up to date.To avoid single points of failure, a single connector in a group means that a software problem, an unfortunate update, or even a local malicious action could leave all private applications that depend on that group without access.
Application segmentation in Private Access This is another critical point. If you define overly broad segments (huge IP ranges, multiple unfiltered ports, indiscriminate use of Quick Access), you're essentially replicating the permissive model of traditional VPNs. The recommended approach is to segment by application, using FQDNs or specific IPs and ports, and associate each segment with Conditional Access policies based on risk and resource type.
Private DNS, internal traffic, and performance in remote access
Internal name resolution is vital for Private Access to function properly.If you don't configure a proper private DNS, remote users won't be able to resolve internal FQDNs through the secure tunnel, and their Windows machines will fall back to public DNS servers, where those names simply don't exist.
When the Private Access profile is enabled but DNS ports are not published (53 UDP/TCP) on the appropriate segments, or if private DNS suffixes are not defined, the Global Secure Access client cannot route internal DNS queries. This causes FQDN-based segments to not apply, and the user ends up connecting directly, outside of network policies.
To improve performance without sacrificing safetyFeatures such as Intelligent Local Access (ILA) allow private traffic to be routed locally when the user is physically on the corporate network, avoiding unnecessary trips to the cloud while maintaining conditional access controls.
Quick Access, for its part, must be properly linked to groups of active connectors Conditional Access policies are already in place. Otherwise, users will either be unable to access internal resources when they need them, or worse, they will be able to do so without any additional MFA, device compliance, or location checks.
Domain controllers, RDP, and security sensors in the Windows environment
In a Windows-based LAN, domain controllers are the ultimate goal.Whoever controls the domain controls the accounts, policies, groups, and, in practice, the entire network.
When administrators access domain controllers via RDP Using Microsoft Private Sign-In, they must do so with phishing-resistant authentication: for example, FIDO2 security keys, Windows Hello for Business with strong backing, or equivalent methods that require cryptographic proof of ownership.
Without these resistant methodsAn attacker who manages to steal credentials or hijack session tokens could replay them to establish RDP sessions to the domain controller, execute DCSync attacks to extract hashes of all accounts, create Kerberos golden tickets and maintain long-term persistence, or modify GPOs to deploy massive malware.
Private Access sensors deployed on domain controllers They allow strict policies to be applied to Kerberos requests originating from the local network. Without these sensors, any device with access to the LAN can request service tickets for privileged resources without MFA controls, compliance, or context, perpetuating the implicit trust model based solely on being "inside" the network.
LAN backups, maintenance, and operational management
LAN security is not limited to preventing unauthorized access.It also means being able to recover if something goes wrong. A fire in the data center, ransomware that encrypts the file server, or a hardware failure can paralyze the company if there are no well-designed backups.
It is recommended to centralize business data on a file server. or on secure storage services with a clear backup policy, including off-site backups (outside the office or in another region) for extreme disaster scenarios. Consult a Comparison of backup methods to choose the best strategy.
A well-managed Windows domain It simplifies permission assignment, password policy enforcement, software deployment, and update management. It ensures that all computers on the network use professional versions of Windows that can be properly integrated into Active Directory or Microsoft Entra.
In addition to updated antivirus software on all PCs and serversIt's advisable to establish regular maintenance: reviewing logs, checking the status of backups, applying critical patches, inventorying licenses, and tracking incidents. Assigning this responsibility to an internal person or an external provider helps prevent problems from being swept under the rug.
Finally, never underestimate the human factorFiltering MAC addresses, disabling unused Ethernet ports, restricting software installation, and segmenting by VLAN reduces the damage that can be caused by both an employee error and a deliberate action by a disgruntled person within the organization.
A well-designed and managed LAN network in a Windows environment, enhanced with Microsoft Entra capabilities, Global Secure Access, segmentation, web filtering, and threat intelligenceIt becomes much more robust than a simple set of cables and switches: it becomes a secure platform on which your company can continue to grow, incorporating IoT, cloud services and even generative AI without unnecessarily exposing itself to the cyberattacks that are unfortunately commonplace today.
