7 minute read
Most of the networks we take over are flat. One address range, one broadcast domain, everything able to reach everything. It works perfectly — which is exactly why nobody fixes it until something goes wrong.
The problem isn't the perimeter
Perimeter security is built on the assumption that the threat is outside and everything inside is trustworthy. That assumption fails the moment one laptop is compromised, one contractor plugs in an infected machine, or someone clicks the wrong attachment.
On a flat network, that single device can then reach the file server, the payment terminals, the cameras and the building access system. Not because anything else was breached — because nothing stopped it.
What usually shares a flat network
- IP cameras, often running firmware that hasn't been updated since installation
- Guest Wi-Fi, reachable by anyone in the car park with the password
- Payment terminals, which have their own compliance obligations
- Medical or industrial equipment on unsupported operating systems that cannot be patched
- Building systems — door access, HVAC, alarms
Cameras are the common one. They're networked computers, frequently unpatched, and physically accessible from outside the building. On a flat network, that's a route in.
Segmentation is the cheapest control you own
You already own the switches. VLANs cost configuration time, not capital. Separating cameras, guests, payments and corporate traffic — with policy between the zones — contains a compromise instead of letting it spread.
Do it carefully, though
Segmenting blind breaks applications, because dependencies are rarely documented. Map the actual traffic flows first, then stage the changes so a rollback is always available. Done properly it's invisible to users; done in a hurry it's a Monday morning outage.
