Walk into most small offices and every single thing that plugs in shares one network. Laptops, the payment terminal, the security cameras, the smart thermostat, the guest wifi, the accounting computer, and the lobby TV somebody set up years ago and nobody has updated since. All of it, in one room together.
That is called a flat network, and it is the default because it is the path of least resistance. It also means the cheapest device on your network and the most sensitive one are neighbors with no wall between them. The fix has a technical sounding name, VLANs, but the idea behind it is something you already understand from any apartment building you have been in.
The Apartment Building Analogy
A flat network is a warehouse where everybody sleeps on the floor. One open space, everyone’s belongings within reach of everyone else, and a stranger who gets in the front door has the run of the place.
A segmented network is an apartment building. Same structure, same plumbing, same front door, but now there are units with their own locks. A visitor in unit 3 cannot wander into unit 7. If something goes wrong in one unit, it stays there instead of spreading through the whole floor.
VLAN stands for virtual local area network, and that is what it builds: interior walls made of configuration rather than drywall. Ubiquiti’s documentation describes VLANs as a way to segment networks to improve performance, security, and traffic management, noting they help isolate devices and users, reduce the risk of unauthorized access, and limit the spread of potential threats within a network. That last phrase is the whole point.
What Actually Happens on a Flat Network
Here is what turns this from theory into a real concern. On a flat network, once something malicious lands on any device, it can see and reach every other device.
The entry point is rarely the computer you would guess. It is usually the thing nobody thinks of as a computer. A camera recorder running firmware that no longer gets updates. A smart TV. A network printer with the factory password still on it. A vendor’s remote access box for the HVAC system. None of those are valuable targets themselves. They are useful because of what they can reach from where they sit.
On a flat network, looking around means seeing the file server, the accounting workstation, the backup device, and every laptop. In the apartment analogy, the intruder came in through an unlocked storage shed and found that the shed opens directly into every bedroom.
Segmentation does not stop the shed from being unlocked. It stops the shed from connecting to the bedrooms. That is why segmentation shows up in serious security guidance instead of being treated as a nice extra, and it is part of what we mean when we say basic security is no longer optional.
The Segments Most Small Businesses Should Have
You do not need twelve. Four or five covers almost every small business we work with. The logic is grouping things by how much you trust them and how much they need to talk to each other.
- Staff and workstations. Employee computers and the business systems they use. This segment needs the most access, so keep everything else out of it rather than locking it down from the inside.
- Guests. Customers, vendors, and personal phones. NIST guidance for small businesses, published in 2016 by the National Institute of Standards and Technology, is direct: if your business provides wireless internet access to customers, ensure that it is separated from your business network. Guests reach the internet and nothing else.
- Cameras and building devices. Security cameras, recorders, door controllers, thermostats, and anything else that quietly runs old software forever. These need their own controller and almost nothing else. Ubiquiti’s documentation lists IoT devices, security cameras, printers, workstations, and servers as the kinds of devices that benefit from consistent VLAN assignment.
- Payment terminals. If you take cards, your processor or your card industry obligations likely already expect separation here. Even if nobody is asking, do it. Payment systems should be the most boring, most isolated segment you own.
- Sensitive back office. Accounting, payroll, HR records, and customer data you would hate to lose. Smallest segment, tightest rules, fewest devices allowed to reach it.
Segmenting also exposes the devices nobody claims. When every single thing has to be assigned to a group, you find the box under a desk that nobody can identify, a close cousin of the shadow IT problem.
This Is Configuration, Not Construction
The most common objection we hear is that this sounds like ripping open walls and running new cable. Usually it is not.
The whole reason VLANs exist is that they create separate logical networks over the same physical wiring. Ubiquiti’s documentation describes VLANs being assigned directly to switch ports, so that any device connected to a specific port is placed on the designated VLAN, and separately describes each wireless network name being mapped to a VLAN. In plain terms: the cable in the wall stays put, and the port it plugs into decides which segment that device belongs to. A wireless network name does the same job over the air.
What you do need is capable equipment: a managed switch rather than the unmanaged one from an office supply store, access points that support multiple network names mapped to different segments, and a firewall or gateway that can enforce rules between them. If you already have business grade gear, you may have paid for this capability and never switched it on.
Walls alone are not the finish line either. The rules between segments matter, and Ubiquiti’s documentation notes that network isolation automatically configures the necessary firewall rules to block traffic between VLANs, calling it the most common way to restrict that traffic. It also describes client isolation, which blocks communication between devices even within the same network, a setting worth using on guest wireless so visiting devices cannot see each other.
How to Plan It Without Breaking the Printer
Segmentation projects fail in one predictable way. Somebody builds beautiful walls, then discovers half the office needs something on the other side of one. Usually the printer. Always the printer.
- Inventory everything first. Every device with a network connection, including the ones nobody remembers. You cannot segment what you cannot list, and the list itself is usually eye opening.
- Map who talks to whom. For each device, write down what it must reach. Workstations print. The recorder talks to cameras. The card terminal talks to the processor. This becomes your rule set later.
- Start with guests. Easiest segment to separate, lowest risk if you get it slightly wrong, and immediate real benefit. Build confidence here.
- Move one group at a time, after hours. Cameras next, then payment, then back office. Between moves, run the business normally for a few days.
- Solve printing deliberately. Decide up front whether printers live in the staff segment or in their own with a rule allowing staff in. Deciding beats discovering.
- Write down what you built. Which segment is which, what rules exist between them, and why. A year from now, when someone adds a device, that document is the difference between five minutes and an afternoon.
The Bottom Line
Your network does not need to be a warehouse where everyone sleeps on the floor. Sensible interior walls cost configuration time rather than construction, and they change the worst day from “everything is compromised” to “one segment is compromised.”
Start with guest wifi, which almost everyone can do this month. Then work toward cameras and payment. Vendor interfaces, setting names, and capabilities change over time, so confirm the current options for your equipment rather than assuming settings are where they used to be.
If you want a second set of eyes on your network, or help planning a segmentation that will not take the printer down on a Monday morning, that is work we do regularly for businesses in Denton County. Contact us today.
Sources:
Comments are closed