Why office networks should separate staff, CCTV and guest devices

Networking10 June 20262 min readBy Digbijay Paul

A network usually grows the same way. A few PCs, then a printer, then a camera system installed by a different vendor, then guest Wi-Fi shared with visitors, then a machine on the shop floor. Everything ends up on one network because that is what works on the day.

What goes wrong on a flat network

• A camera recorder with a default password sits on the same network as your accounts server
• Guest phones consume bandwidth and, if something is infected, can probe internal systems
• Broadcast traffic from dozens of devices slows everything down
• One faulty device can disrupt the whole network, and finding it means unplugging things
• Anyone who gets onto the Wi-Fi is effectively inside the office network

What segmentation looks like

Each group gets its own VLAN. The firewall decides what may cross between them: staff PCs reach the server, the CCTV segment reaches nothing except its recorder, guests reach the Internet and nothing else.

Wi-Fi fits the same model. One access point can broadcast a staff network and a guest network, each mapped to its own VLAN, so a visitor's laptop is on a different network from the accounts PC even though both are using the same hardware. Cameras are the other common case: camera systems are rarely updated, often ship with weak default credentials, and have no business reaching anything except their recorder.

What segmentation does not do

It is not a substitute for endpoint protection, updates or backups. A staff PC that opens an infected attachment is still inside the staff segment, where the file server lives. What segmentation buys you is a smaller blast radius and a much better chance of containing a problem — which, combined with backups you can restore, is what recovery actually depends on.

The everyday benefits

• Faults are easier to isolate, because problems stay in one segment.
• A compromised device has far less to reach.
• Guest Wi-Fi can be offered without thinking twice.
• Traffic-heavy devices such as cameras stop affecting office work.
• Adding a new site or a new class of device becomes a plan rather than an improvisation.

What it takes

• Managed switches — the main hardware requirement, and not an expensive one at office scale
• A firewall that can route and filter between segments
• A short survey of what is currently plugged in where
• A cut-over window, since addressing changes for most devices
• Documentation, so the design survives staff changes

Common mistakes

• Creating VLANs but allowing everything to route freely between them
• Leaving the CCTV recorder on the staff network because it was easier
• Guest Wi-Fi with the same password for three years, shared with everyone who ever visited
• No documentation, so the next change undoes the design