Network security
A smarter network is also a safer network.
Not every device needs to see every other device. Guests, cameras, laptops, and thermostats can share a building without sharing a single open network.
One password for everything is a single room.
When a guest phone, a smart TV, a camera, and a work laptop all sit on the same network, a problem on the least careful device has a short walk to the others. Flat networks are easy to set up. They are also easy to cross.
Segmentation is the practice of giving each group the access it needs and refusing the rest. The result is quieter daily life, not a new set of rules for the people in the house.
A practical arrangement.
Names vary by property. The separation is the point.
- Trusted network
Computers, phones, and servers. The devices that hold work and personal files.
- IoT network
Smart TVs, automation gear, thermostats, and other devices that need the internet more than they need your laptop.
- Security network
Cameras and recording equipment, reachable for viewing and management, not wandering the rest of the building.
- Guest network
Internet access for visitors, without a route to private devices, printers, or cameras.
VLANs and firewall rules, without the jargon first.
A VLAN divides one physical network into separate logical ones. The same switches and cables can carry several groups that do not automatically trust each other. Firewall rules then decide the exceptions: who may reach a printer, who may only reach the internet, who may view a camera.
You do not have to remember the acronym. You should be able to say, in a sentence, which devices are allowed to talk. The configuration is documented so that sentence remains true after the install.
Nothing here is a claim that a segmented network is immune to attack. It is a claim that unnecessary paths have been closed.
Related work
Questions worth asking
Why not put everything on one WiFi network?
A guest, a thermostat, a camera, and a work laptop do not need to see each other. One flat network is simpler to set up and easier for a problem to cross. Segmentation keeps each group on the part of the network it actually needs.
What is a VLAN, in plain language?
A VLAN is a way of dividing one physical network into separate logical networks. Devices can share switches and cabling while staying in different groups. Firewall rules then decide which groups may talk, and which may only reach the internet.
Should cameras be on the same network as our computers?
Usually they should not. Cameras and the recorder belong on their own segment, with only the access required for viewing and management. That limits how far a compromised device can reach.
Will segmentation make the network harder to use?
Day to day, it should not. Phones still join the right WiFi, guests still get internet, and cameras still record. The complexity sits in the design, not in a new chore for the people who live or work there.
Get a network assessment.
If guests, cameras, and work computers currently share one WiFi name, there is a clearer way to arrange it.