Office network and Wi-Fi: why one flat network is a risk

In many small and medium offices the network grew over the years: a router from the provider, a few switches, a Wi-Fi access point, then cameras, printers and a server. Everything ends up in one flat network where any device can talk to any other. It works — until a single infected laptop or a vulnerable camera gives an attacker a path to the most important systems.

What segmentation means

Segmentation divides the network into separate zones (VLANs) with rules between them, controlled by a firewall. A typical office needs at least these zones:

• Employees — workstations and laptops.
• Servers — 1C, file server, domain controller, backups. Only the necessary ports are allowed from other zones.
• Guests — internet only, no access to the internal network.
• Devices (IoT) — cameras, printers, access control, smart TVs. They are often rarely updated, so they must be isolated.
• Management — interfaces of switches, firewalls and access points, available only to administrators.

Secure Wi-Fi

1. Use WPA3 or at least WPA2 with a strong, unique key; disable WPS.
2. Give guests a separate network with client isolation and, if possible, a key that changes regularly.
3. For employees, consider WPA2/WPA3-Enterprise so each person logs in with their own account and access can be removed individually.
4. Update the firmware of access points and the router and change default administrator passwords.

Rules and visibility

By default, deny traffic between zones and allow only what is needed. Turn off remote management of the router from the internet. Collect firewall logs and review alerts — a printer suddenly scanning the network is a clear sign that something is wrong.

Segmentation does not prevent every incident, but it turns a company-wide disaster into a contained problem.

CySec designs and builds office networks: VLAN segmentation, next-generation firewalls, secure Wi-Fi and network monitoring — with minimal downtime for your team.

All articles