Network segmentation

The starting point is the flat network: every device sits on the same network and can reach every other device. The reception PC can then reach the accounts server, the network storage, the till, the machine controller and the cameras. Once an attacker takes over a single workstation, that entire network lies open. This is precisely the path ransomware, meaning malicious software that encrypts data and demands a ransom, uses to spread from an infected desktop to the servers.

The first dividing line is the guest Wi-Fi. Visitors, tradespeople and private mobile phones belong on a separate network that leads only to the internet. Many routers already offer this as a guest network and it merely has to be switched on. The second dividing line runs between the office and production, because machine controllers are often tied to an operating system that no longer receives updates. The third line surrounds devices such as printers, cameras and building services equipment, which are rarely maintained.

Technically these zones are created as VLANs, meaning logically separated networks over the same cabling, with the firewall deciding which connections between them are allowed. The effort stays manageable where managed switches are already installed, meaning network distributors whose ports can be configured individually. The rule between zones is easy to remember: what the work requires is permitted, and everything else stays closed.

A simple test reveals the state of your network. Connect a mobile phone to the guest Wi-Fi and see whether you can reach the network printer or the network storage from it. If you can, the network is flat. The same question applies to a machine controller: can it be reached from the same network as the accounts department's PC?

The first sensible step is a network diagram recording which devices exist, where they are connected and which connections they genuinely need to do their job. On that basis the zones can be separated step by step, beginning with the guest Wi-Fi. The IT-Check records the structure of your network on site, read-only and without interrupting operations, and the report sets out which separations are missing.

View the IT-Check · IT infrastructure