Why Network Segmentation Is the Highest-Value Security Upgrade
Flat networks let one compromised device reach everything. VLAN segmentation with firewall policy between zones contains incidents and is cheaper than most people expect.
The Problem with Flat Networks
On a flat network, the receptionist's PC, the finance server, the CCTV recorder, the VoIP system and the guest Wi-Fi all sit in the same broadcast domain. Malware on any one of them can scan and attack all the others. Most ransomware incidents spread precisely because nothing stood in the way.
What Segmentation Does
Segmentation puts each class of device in its own VLAN — users, servers, printers, CCTV, VoIP, building systems, guests — and forces traffic between VLANs through a firewall that only permits what is actually needed. A compromise in one segment is boxed in.
A Sensible Starting Point
- Separate guest Wi-Fi with internet-only access
- CCTV and VoIP on their own VLANs, no internet except for updates
- Servers in a segment reachable only on required ports
- Management interfaces on a locked-down admin VLAN
It Is Mostly Configuration
If your switches are managed and you have a capable firewall, segmentation is largely a design-and-configuration exercise, not a hardware purchase. That is what makes it the best value security work most Kenyan businesses can do this year.