blocking connections that are not initiated inside the local network

identifying and mitigating threats that originate inside the local network

using a set of rules to determine whether to allow data to enter a device

scanning devices for open ports and closing any that are left open too long