Network Segmentation for Small Businesses

A flat network is one where all devices — workstations, servers, printers, IoT devices, guest WiFi — share the same network segment with unrestricted communication between them. In a flat network, an attacker who compromises any single device can immediately see and attack every other device. This is how ransomware spreads so quickly: once inside, it scans the local network for other vulnerable systems and spreads laterally, encrypting everything it can reach. In a flat network, that's everything. Real-world consequences: - A compromised IoT device (security camera, smart thermostat) becomes a pivot point to attack servers - A phished employee's workstation gives direct access to file servers and databases - Guest WiFi users can access internal resources - A single ransomware infection can encrypt your entire network in minutes Network segmentation breaks your network into isolated zones, limiting what an attacker can reach from any single compromised device. Compliance frameworks (NIST CSF, CIS Controls, PCI DSS) and cyber insurance carriers increasingly require segmentation as a baseline security control.

VLANs (Virtual Local Area Networks) are the most practical way for small businesses to implement network segmentation using existing network equipment: Recommended segments for SMBs: 1. Corporate workstations — Employee computers and laptops 2. Servers — File servers, application servers, domain controllers 3. Guest/BYOD — Guest WiFi and personal devices 4. IoT/OT — Printers, cameras, smart devices, HVAC systems 5. VoIP — Phone systems (if applicable) 6. Management — Network equipment management interfaces Implementation steps: 1. Audit your network — Inventory all devices and classify them by function and sensitivity. 2. Plan your VLAN scheme — Assign each category to a VLAN with its own IP subnet. 3. Configure your switch — Create VLANs on managed switches and assign ports. Unmanaged switches cannot do VLANs — this is a reason to upgrade. 4. Set up a firewall between VLANs — Use your firewall or router to control traffic between VLANs. Default deny, then explicitly allow only required communication. 5. Configure WiFi SSIDs — Map separate WiFi networks to different VLANs (corporate vs. guest). Cost: Most managed switches support VLANs. If you're already using a business-grade firewall (SonicWall, Fortinet, Meraki), you likely have the capability today.

Beyond VLANs, advanced segmentation approaches provide even stronger protection: Micro-segmentation applies firewall rules at the individual workload or application level, rather than just the network level. Instead of segmenting by VLAN, micro-segmentation controls which specific applications and services can communicate with each other. Zero trust network principles: 1. Never trust, always verify — No device or user is trusted by default, even inside the network 2. Least privilege access — Users and devices only get access to the specific resources they need 3. Assume breach — Design your network as if an attacker is already inside 4. Continuous verification — Authentication and authorization happen continuously, not just at login Practical zero trust steps for SMBs: - Implement identity-aware access (conditional access policies in M365/Google Workspace) - Use MFA for all access, especially remote and privileged - Deploy endpoint compliance checks (device health, patching status) before granting access - Segment your network so compromise of one zone doesn't affect others - Monitor east-west (internal) traffic for anomalies, not just north-south (perimeter) Zero trust is a journey, not a product. Start with network segmentation (VLANs), add identity-aware access (MFA + conditional access), and progressively tighten controls.