106 Digital Life Security #10: Network Segmentation — Why Everything Should Not Be on the Same Network

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

Imagine building a large house with no interior walls.

The kitchen, bedrooms, workshop, office, utility room, and storage areas are all one enormous open space.

You can walk anywhere without passing through a door.

That might be convenient.

But it would not provide much separation.

Computer networks can be designed the same way.

We can connect every computer, phone, printer, television, smart device, camera, and guest device to one large network.

Everything may work.

But from a security standpoint, we should ask:

Does everything really need to be in the same room?

The Traditional Home Network

A simple home network often looks something like this:

Internet → Router → Everything

The router may provide several Ethernet ports and Wi-Fi.

Perhaps another switch is connected for additional wired devices.

Everything receives an address from the same network.

For example:

192.168.1.10 — desktop computer

192.168.1.11 — laptop

192.168.1.12 — printer

192.168.1.13 — television

192.168.1.14 — thermostat

192.168.1.15 — camera

192.168.1.16 — guest's phone

Simple.

Convenient.

But perhaps more trusting than necessary.

What Happens If One Device Is Compromised?

Suppose the smart television has a vulnerability.

Or an inexpensive IoT device stops receiving security updates.

Or a guest's laptop arrives already infected with malware.

That device is now inside the local network.

If the network provides unrestricted communication among local devices, the compromised system may be able to discover and communicate with other devices.

That might include:

Our Internet firewall may have done its job perfectly.

The problem is already inside.

The Firewall Around the Property Is Not Enough

Think about physical security.

You might have a locked exterior door.

But that does not mean every person who enters the building should automatically have access to every office, cabinet, computer, safe, and utility room.

Internal boundaries still matter.

The same idea applies to networking.

Instead of building only one boundary:

Internet | Firewall | Everything

we can create additional boundaries inside the network.

This Is Network Segmentation

Network segmentation means dividing a larger network environment into smaller networks or security zones.

For example:

Trusted Network
Personal computers, phones, and other trusted devices.

Guest Network
Devices belonging to visitors.

IoT Network
Televisions, smart switches, thermostats, appliances, and similar equipment.

Camera Network
Security cameras and perhaps a recording system.

Management Network
Networking equipment and administrative interfaces.

These networks do not automatically need unrestricted access to one another.

Segmentation Creates Boundaries

Once devices are separated into networks, the router or firewall can control communication between them.

For example:

Trusted → Internet: Allow

Guest → Internet: Allow

Guest → Trusted: Block

IoT → Trusted: Block

Camera → Trusted: Block unless specifically needed

Trusted → Camera: Allow selected management or viewing access

Now we are not simply connecting devices.

We are deciding which relationships should exist.

Notice the Direction

This is an important point.

Communication rules can have direction.

Perhaps your trusted computer needs to initiate a connection to a camera.

That does not necessarily mean the camera needs permission to initiate connections to every trusted computer.

We might want:

Trusted computer → Camera: allowed

while:

Camera → Trusted computers: blocked

A stateful firewall can allow response traffic associated with the connection initiated by the trusted computer without granting the camera unrestricted ability to initiate unrelated connections back into the trusted network.

This is where our earlier lesson about stateful firewalls becomes extremely useful.

Segmentation Helps Limit Lateral Movement

In the previous topic, we introduced lateral movement.

An attacker may compromise one device and then attempt to move from that device to others.

Segmentation can place barriers in that path.

Suppose a vulnerable IoT device becomes compromised.

If it sits on an unrestricted network beside your computers and servers, the attacker may have many additional systems to investigate.

If the IoT device is isolated and firewall rules prevent it from initiating connections toward the trusted network, the attacker's options may be significantly reduced.

We are trying to contain the failure.

Defense in Depth Again

This is another example of defense in depth.

We hope the IoT device never becomes compromised.

We keep its firmware updated.

We use strong authentication.

We disable unnecessary services.

But we also ask:

What if all of that fails?

Segmentation gives us another layer.

Good security architecture assumes that eventually something may go wrong.

Then it attempts to limit the consequences.

So What Is a VLAN?

This brings us to a term that can initially sound intimidating:

VLAN.

VLAN stands for Virtual Local Area Network.

A VLAN allows networking equipment to create separate logical networks while sharing physical networking infrastructure.

This is extremely useful.

Remember the Cat 6 cable?

The cable is simply carrying Ethernet traffic.

With appropriately configured equipment, that same physical infrastructure can support multiple logically separated networks.

Physical Network Versus Logical Network

Imagine one Ethernet switch.

Ports 1 through 8 might be assigned to trusted devices.

Ports 9 through 12 might be assigned to cameras.

Ports 13 through 16 might be assigned to IoT devices.

Physically, everything plugs into the same switch.

Logically, those devices can belong to different VLANs.

The switch helps keep traffic associated with those logical networks separated according to its configuration.

This is one of the great advantages of managed networking equipment.

A VLAN Is Not a Firewall

This distinction is extremely important.

A VLAN can separate network traffic into different logical networks.

But we still need to decide what communication should be permitted between those networks.

That job is typically performed by a router, firewall, or Layer 3 networking device.

So think of it this way:

VLANs create the rooms.

Firewall rules control the doors between the rooms.

Creating rooms without deciding who may pass through the doors is not a complete security design.

What Is a Managed Switch?

A basic unmanaged Ethernet switch is designed primarily to connect devices.

You plug things in and the switch begins forwarding traffic.

A managed switch provides configuration and monitoring capabilities.

Depending on the model, these may include:

Managed switches give the network administrator much more control over how the physical Ethernet infrastructure is used.

Access Ports

Let's introduce two useful VLAN terms.

An access port commonly connects an ordinary endpoint to one particular VLAN.

For example, suppose switch port 8 is assigned to the camera VLAN.

You plug a camera into that port.

The camera does not need to understand that multiple VLANs exist elsewhere in the network.

From the camera's perspective, it is simply connected to its network.

Trunk Ports

Sometimes one physical Ethernet connection needs to carry traffic belonging to multiple VLANs.

This is commonly called a trunk.

For example, a connection between two managed switches might carry several VLANs.

Instead of installing a separate physical cable between the switches for every logical network, VLAN information can identify which traffic belongs to which network.

This makes the physical infrastructure far more flexible.

One Cat 6 Cable Can Carry Multiple Networks

This is where the idea becomes particularly interesting when designing infrastructure.

Suppose a Cat 6 cable runs from a main building to another network location.

A managed switch is installed at each end.

That link may be configured to carry multiple VLANs.

At the remote switch, individual ports can then be assigned to the appropriate networks.

One physical Ethernet pathway can therefore support multiple logical networks.

Physical infrastructure and logical architecture are separate design decisions.

Wi-Fi Can Use VLANs Too

Segmentation is not limited to Ethernet cables.

Appropriate wireless access points can associate different Wi-Fi networks, often called SSIDs, with different VLANs.

You might have:

Private Wi-Fi → Trusted VLAN

Guest Wi-Fi → Guest VLAN

IoT Wi-Fi → IoT VLAN

The same access point may provide several wireless networks while keeping their traffic logically separated.

A Guest Network Is Segmentation You May Already Use

Many consumer routers already provide a simple form of segmentation through a guest Wi-Fi network.

Guests can reach the Internet while access to devices on the private network may be restricted.

That is network segmentation.

The router is essentially saying:

You may use my Internet connection, but you do not automatically become part of my trusted network.

That is a sensible security boundary.

IoT Devices Deserve Their Own Question

IoT stands for the Internet of Things.

This broad category can include:

These devices may contain small computers running firmware.

Some are well supported for years.

Others may receive limited security support.

We should ask:

Does this device need to share the same trusted network as my computers?

Often, the answer may be no.

Now Think About Cameras

Security cameras are IoT devices too, but they deserve special attention.

A network camera may contain:

It is simultaneously a security device and a network computer that must itself be secured.

That is an interesting contradiction.

The device intended to improve physical security can create a cybersecurity risk if poorly designed or configured.

A Camera Network

Imagine placing the cameras on their own VLAN.

Perhaps we call it:

Camera VLAN

The cameras can communicate with a local recording system if necessary.

Trusted administrative computers can be permitted to reach the cameras.

But the cameras may not need permission to initiate connections to every personal computer, printer, server, or other device.

Depending on the system, they may not even need unrestricted Internet access.

Now we are designing according to what the devices actually need.

What About a Recorder?

Many camera systems use an NVR, or Network Video Recorder.

The NVR receives and stores video from network cameras.

This raises interesting architectural questions.

Should the cameras communicate only with the NVR?

Should the NVR have Internet access?

Should trusted computers be able to reach the NVR?

Should the cameras themselves have Internet access?

How should remote viewing work?

These questions do not have one universal answer.

But now we know the questions to ask.

That Is the Beginning of Security Engineering

Security engineering is not simply choosing the product advertised as being the most secure.

It involves understanding:

What does this device need to do?

What does it need to communicate with?

What does it not need to communicate with?

What happens if it is compromised?

How can we contain the damage?

Those questions help us design the architecture.

What Is a Management Network?

Networking equipment itself may have administrative interfaces.

Routers.

Switches.

Wireless access points.

Servers.

Camera systems.

In more advanced environments, administrators may place management interfaces on a dedicated network or otherwise restrict which systems can reach them.

The idea is simple:

A guest's phone does not need access to the switch administration page.

Neither does the smart television.

Administrative access should come from trusted locations and trusted accounts.

Segmentation Does Not Automatically Equal Security

This is important.

Creating five VLANs does not automatically create a secure network.

If firewall rules allow every VLAN to communicate freely with every other VLAN, we may have created organizational separation without much security separation.

Security comes from the combination of:

No single feature does everything.

Do Not Make the Network So Complicated That You Cannot Manage It

There is another side to this discussion.

We could create dozens of VLANs and hundreds of firewall rules.

That might sound extremely secure.

But complexity can create its own problems.

If nobody understands the configuration, mistakes become more likely.

Documentation becomes difficult.

Troubleshooting becomes difficult.

Old rules may remain long after they are needed.

Security architecture should be understandable and maintainable.

The goal is useful separation, not maximum complexity.

A Simple Property Network

Let's imagine a property with a main building, outbuildings, wired Ethernet, Wi-Fi, cameras, and Internet access.

A reasonable conceptual design might begin with:

Internet
↓
Router / Firewall
↓
Managed Switch Infrastructure

Then we create several logical networks:

Trusted Network
Computers, phones, and trusted personal devices.

Guest Network
Visitor devices with Internet access but little or no access to private systems.

IoT Network
Smart devices that need limited network access.

Camera Network
Cameras and related recording equipment.

Management Network
Administrative interfaces for networking equipment where appropriate.

This is not a prescription for every property.

It is a model that helps us think.

Then We Define the Relationships

After creating the networks, we ask what communication is actually required.

For example:

Trusted → Internet: Yes

Guest → Internet: Yes

Guest → Trusted: No

IoT → Trusted: Usually restricted

Camera → Trusted: Usually restricted

Trusted → Camera: Permit required viewing or administration

Camera → Recorder: Permit what the camera system requires

Management: Restrict to authorized administrative devices or users

Now the firewall rules represent the intended relationships between systems.

The Firewall Becomes a Map of Trust

This is a powerful way to think about firewall rules.

They are not merely lists of ports and addresses.

They represent decisions about trust.

Who may initiate communication?

Who may respond?

Which services are needed?

Which systems should remain isolated?

A well-designed firewall policy becomes a technical expression of the security architecture.

Document the Network

As a network becomes more sophisticated, documentation becomes increasingly valuable.

Record things such as:

Six months later, you should not have to reverse-engineer your own network.

Documentation is a security tool.

Label the Physical Infrastructure Too

When installing Ethernet cabling, label both ends.

Record where the cable goes.

Document patch-panel ports and switch ports.

Something as simple as:

Shop-01

Carport-01

Camera-East-01

can save enormous time years later.

Good network security depends partly on knowing what the network actually contains.

We Are Building Zones of Trust

That is really what segmentation is about.

We stop assuming that every device deserves the same level of trust.

A personal computer is different from a visitor's phone.

A visitor's phone is different from a thermostat.

A thermostat is different from a security camera.

A security camera is different from the router's administrative interface.

Different devices have different jobs, different risks, and different access requirements.

So we give them appropriate boundaries.

From One Big Network to Security Architecture

We began with:

Internet → Router → Everything

Now we can imagine:

Internet
↓
Firewall
↓
Trusted | Guest | IoT | Cameras | Management

And between those networks:

Explicit rules.

That is a major step forward in our understanding.

The network is no longer simply a collection of devices that happen to be connected.

It has structure.

It has boundaries.

It has trust relationships.

It has rules.

And it has a plan for what happens when one component eventually fails.

That is the difference between connecting a network and designing a secure network.

Home
Brad Zehr | Zehr.net | brad@zehr.net

About Services Why A Site Site Ideas Topics Podcast Help Contacts

Topics, Podcast & Images on this site are AI Assisted.

Search Contact Home