IT infrastructure

Why it matters

A growing business accumulates infrastructure the way a house accumulates extension leads: one urgent fix at a time. The result is a network nobody has mapped, devices nobody manages and backups nobody has tested. Each is survivable until the day they are not, and that day tends to arrive when a key person is on leave. Infrastructure that is documented, standardised and monitored costs little more and is the difference between an hour of disruption and a week.

What counts as infrastructure

Infrastructure is everything an application needs in order to run and be reached. For a modern small business the list is shorter than it used to be, because most servers have moved to cloud providers, but what remains matters more: a reliable internet connection, a secure and well-designed local network, devices that are kept up to date, a single way of managing who can log in, and a storage and backup arrangement that survives theft, fire and mistakes.

The shift to cloud has also moved the risk. The old threat was a server failing; the new one is an account being taken over or an unmanaged laptop carrying company data onto a café Wi-Fi network. Infrastructure thinking now has to include devices and identity, not just boxes with blinking lights.

Networks and internet

The local network starts at the internet connection. For a business, that usually means a business-grade NBN or fibre service with a service level and a support line that answers, plus a second connection, often mobile data, that takes over automatically when the first drops. Behind the connection sits a router with a firewall, which decides what traffic gets in and out, and then Wi-Fi access points and switches that connect devices.

Three design decisions make the difference between a safe network and a liability. Separate guest Wi-Fi from the business network so visitors and personal phones never touch company systems. Put point-of-sale, cameras and other smart devices on their own segment, because they are rarely updated and are a favourite way in. And use business-grade equipment that can be managed and updated centrally, rather than consumer gear that is set up once and forgotten.

Devices and identity

Every laptop, phone and tablet that touches business data should be known, encrypted, updated automatically and able to be wiped remotely if lost. For a business beyond a handful of staff, that means a device management tool rather than good intentions, and a policy on personal devices: either they are enrolled in management, or they do not hold company data.

Identity is the layer that has replaced the office wall as the boundary of the business. One business account per person, used to sign in to every application, with multi-factor authentication required, gives you a single place to grant access when someone starts and remove it when they leave. Administrator rights should be held by named people with separate admin accounts, and the owner should always be able to recover access without depending on a supplier.

Storage, backup and recovery

Data now lives in several places: cloud applications, shared cloud drives, a few local machines and perhaps a remaining server. Backup has to cover all of them, and it has to be independent of the thing it protects. A copy of your files that sits in the same cloud account as the originals is not a backup if that account is compromised.

The traditional rule is three copies of anything important, on two different kinds of storage, with one off-site. In cloud terms: the live data, an automated backup to a different provider or account, and ideally a periodic offline copy. Just as important is a written recovery plan that says how long the business can be without each system, who does what when it fails, and how recently the restore was tested.

How to bring infrastructure up to standard

1. Map what exists Draw the network, list every device and connection, and record who manages each. Expect surprises.
2. Fix the connection Move to a business-grade internet service and add an automatic fallback.
3. Segment the network Separate staff, guest and device networks; replace consumer equipment that cannot be managed.
4. Standardise devices Choose a small set of models, enrol them in device management, and set a replacement cycle.
5. Centralise identity One business login per person across all applications, with multi-factor authentication required.
6. Build independent backup Back up cloud and local data to a separate provider; schedule quarterly restore tests.
7. Write the recovery plan For each system: how long you can be without it, who restores it and from where.
8. Monitor and review Have someone, in-house or a provider, watching uptime, updates and alerts, and review the map twice a year.

Real-world example

A Bendigo manufacturer outgrows its network

Goldfields Joinery has grown from eight staff to thirty across a factory and a showroom. The network is a consumer router, three Wi-Fi extenders, a server bought in 2017 running the quoting software, and a tangle of cables nobody will touch. Staff share a "factory" login. One afternoon the internet drops, the quoting server cannot be reached from the showroom and two days of orders are taken on paper.

The owner brings in a managed service provider to map the setup. They install business-grade internet with a mobile fallback, a managed firewall, proper access points and separate networks for office, factory machines and visitors. The quoting software moves to its vendor’s cloud version, the old server is retired, every laptop and tablet is enrolled in device management, and each staff member gets their own login with multi-factor authentication. A cloud backup service holds independent copies, and a restore test becomes part of the quarterly routine. The project costs roughly what the next server replacement would have, and the business can now open a second showroom without rebuilding anything.

Common mistakes

• Consumer equipment in a business network Home routers and extenders cannot be segmented, monitored or managed remotely. They are fine until the day you need to know what happened.
• One internet connection A cloud-based business with a single connection has a single point of failure. A mobile fallback is cheap insurance.
• Unmanaged personal devices A staff member’s own laptop with company files and no encryption is a breach waiting for a lost bag.
• Backups that share the same account If one compromised login can delete both the data and its copy, you do not have a backup.
• No map, no owner Infrastructure that lives in one person’s memory cannot be supported, insured or handed over.

KPIs to track

• Unplanned downtime per quarter Hours staff could not work due to network, device or system failure. Track by cause and aim for a steady fall.
• Devices compliant with policy Share of devices encrypted, updated and enrolled in management. Target 100 per cent.
• Time since last tested restore Days since a file or system was successfully recovered from backup. Keep it under 90.
• Patch age Days since the oldest critical update was applied to routers, firewalls and devices. Shorter is safer.
• Recovery time achieved versus target When something fails, how long recovery took compared with the plan. Review every incident.

Frequently asked questions

Do I still need a server?

Most small businesses no longer do. Email, files and most applications run better as cloud services. Exceptions include some manufacturing, point-of-sale and legacy software; if you keep a server, back it up to the cloud and plan its retirement.

What is the difference between a router, a firewall and a switch?

The router connects your network to the internet, the firewall decides what traffic is allowed through, and switches connect wired devices to each other. In small business equipment the router and firewall are often one box.

How often should devices be replaced?

Typically every three to five years for laptops, sooner for phones. The real trigger is when the manufacturer stops providing security updates; an unsupported device should not hold business data.

Should staff use their own phones for work?

It can work if the phone is enrolled in device management so work data can be protected and wiped separately from personal data. Without that, keep business data on business devices.

Key takeaways

• Infrastructure is the layer under everything; document it before you need to fix it.
• Business-grade internet with a fallback and a segmented network prevent most outages and intrusions.
• Manage every device and give every person their own identity with multi-factor authentication.
• Backups must be independent of the systems they protect and tested regularly.
• Write a recovery plan with named owners and target times, then rehearse it.