A network usually grows the same way. A few PCs, then a printer, then a camera system installed by a different vendor, then guest Wi-Fi shared with visitors, then a machine on the shop floor. Everything ends up on one network because that is what works on the day.
What goes wrong on a flat network
- A camera recorder with a default password sits on the same network as your accounts server
- Guest phones consume bandwidth and, if something is infected, can probe internal systems
- Broadcast traffic from dozens of devices slows everything down
- One faulty device can disrupt the whole network, and finding it means unplugging things
- Anyone who gets onto the Wi-Fi is effectively inside the office network
What segmentation looks like
- InternetISP lines
- FirewallRules between segments
- Core switchManaged, VLAN aware
- StaffPCs, printers
- ServersERP, files, backup
- CCTVCameras, recorder
- GuestVisitors, phones
Each group gets its own VLAN. The firewall decides what may cross between them: staff PCs reach the server, the CCTV segment reaches nothing except its recorder, guests reach the Internet and nothing else.
Wi-Fi fits the same model. One access point can broadcast a staff network and a guest network, each mapped to its own VLAN, so a visitor's laptop is on a different network from the accounts PC even though both are using the same hardware. Cameras are the other common case: camera systems are rarely updated, often ship with weak default credentials, and have no business reaching anything except their recorder.
What segmentation does not do
It is not a substitute for endpoint protection, updates or backups. A staff PC that opens an infected attachment is still inside the staff segment, where the file server lives. What segmentation buys you is a smaller blast radius and a much better chance of containing a problem — which, combined with backups you can restore, is what recovery actually depends on.
The everyday benefits
- Faults are easier to isolate, because problems stay in one segment.
- A compromised device has far less to reach.
- Guest Wi-Fi can be offered without thinking twice.
- Traffic-heavy devices such as cameras stop affecting office work.
- Adding a new site or a new class of device becomes a plan rather than an improvisation.
What it takes
- Managed switches — the main hardware requirement, and not an expensive one at office scale
- A firewall that can route and filter between segments
- A short survey of what is currently plugged in where
- A cut-over window, since addressing changes for most devices
- Documentation, so the design survives staff changes
Common mistakes
- Creating VLANs but allowing everything to route freely between them
- Leaving the CCTV recorder on the staff network because it was easier
- Guest Wi-Fi with the same password for three years, shared with everyone who ever visited
- No documentation, so the next change undoes the design