Your Office Network Is Flat. Here Is Why That Is a Problem.

Walk into most small offices and look at what is connected to the network. There is the computer at the front desk that handles invoices and customer records. There is the printer that has not received a firmware update since it came out of the box. There are two or three security cameras that were installed by whoever ran the wiring. There is a smart television in the conference room, a thermostat, maybe a badge reader. There are employee phones. There is the guest password taped to the wall or handed to every visitor who asks.

Almost always, every one of those devices sits on the same flat network. Flat means there are no internal boundaries. Every device can reach every other device. The camera can talk to the accounting computer. A visitor's laptop can talk to the printer, the server, and the point-of-sale terminal. Nothing stops any of it, because nothing was ever configured to stop it.

This is the single most common network design in small business, and it is the design attackers count on.

Attackers do not land where the valuable data is

There is a persistent assumption that an attack on a small business means someone directly targeting the machine that holds the customer records or the bank credentials. That is rarely how it happens.

Attackers land on the weakest thing you own. That is almost never the accounting workstation, which at least has antivirus software and receives operating system updates. It is the camera running firmware from 2019 with a default password that was never changed. It is the printer with an open web administration page. It is the smart device that the manufacturer stopped supporting two years ago. It is the laptop a visitor brought in, already infected before they walked through the door.

Once an attacker controls any device on the network, the next step is lateral movement: using that foothold to reach something worth stealing. On a flat network, lateral movement is trivial, because there is nothing to move through. Every destination is already reachable from every starting point. The compromised camera and the accounting computer are neighbors with no wall between them.

Segmentation changes that math. It does not make the camera secure. It accepts that the camera will never be secure and limits what the camera can reach.

What segmentation actually means

Network segmentation is the practice of dividing one network into separate zones and controlling what traffic is allowed between them. Instead of one flat space where everything is a neighbor, you create groups, and you decide deliberately which groups can talk to which.

Large organizations do this with virtual local area networks (VLANs), managed switches, and internal firewalls. That is where most small business owners stop reading, because it sounds like a project requiring equipment and a consultant.

For a small business, the useful version is much simpler, and the equipment is almost certainly already sitting in the office. Most business-class routers and many consumer routers sold in the last several years support at least a guest network, and many support multiple separate networks or basic VLAN configuration. The capability is in the box. It is turned off because nobody turned it on.

Three segments that cover most small businesses

You do not need a complex design. Three zones handle the majority of small business risk.

The guest network. Every device that does not belong to the business goes here: visitor laptops, customer phones, the contractor who needs to check email, personal devices employees bring in. Guest networks on most routers are already isolated from the main network by default, which is exactly the behavior you want. A visitor's infected laptop should be able to reach the internet and nothing else. If your office hands out the main network password to visitors, that single habit undoes every other control in the building.

The device network. This is where the cameras, printers, smart televisions, thermostats, badge readers, and any other connected equipment live. These devices share three traits: they are rarely updated, they frequently ship with weak default credentials, and they cannot run security software. They are the most likely thing on your network to be compromised and the least able to defend themselves. Put them together, and do not allow them to initiate connections to the network where your business data lives. A camera has no legitimate reason to reach the accounting workstation.

The business network. The computers that handle money, customer records, patient information, or controlled unclassified information belong here, and this segment should be the cleanest. Nothing from the guest network or the device network should be able to reach into it.

The principle underneath all three is simple. You cannot make every device on your network trustworthy. You can decide what an untrustworthy device is allowed to touch.

The practical setup

Start with what your existing equipment supports. Log in to your router's administration page and look for a guest network feature. Nearly every router has one. Turn it on, give it its own password, and confirm the setting that isolates guest clients from the main network is enabled, which is often labeled client isolation, guest isolation, or something similar. That single step, which takes about five minutes, is the highest-value change most small offices can make.

Next, look for support for additional networks or VLANs. Business-class routers from vendors such as Ubiquiti, Cisco, TP-Link Omada, and similar product lines support multiple networks with rules controlling traffic between them. If your router supports it, create a second network for the device category and move the cameras, printers, and smart devices onto it. If your router does not support it, the guest network can serve double duty as a device network in a pinch: putting the cameras and printers on the guest network is not ideal, because employees who need to print will have to reach across, but it is better than leaving them alongside the accounting computer.

If your printers must be reachable from employee computers, that is a legitimate exception, and it is why the exercise matters. Segmentation is not about blocking everything. It is about deciding deliberately what is allowed, writing it down, and blocking the rest by default. A printer that accepts print jobs from the business network but cannot initiate connections back into it is a reasonable, defensible configuration.

One caution: if a managed service provider runs your network, or you have a server handling internal name resolution or authentication, coordinate before making changes. Segmentation done without coordination can break shared drives, printing, or line-of-business applications. If you manage your own small network, the changes are within reach of a careful owner in an afternoon.

Where this maps for defense contractors and regulated businesses

For businesses working toward Cybersecurity Maturity Model Certification (CMMC) or maintaining National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 compliance, segmentation is not optional housekeeping. It is a control expectation, and it also reduces the cost of everything else.

Under System and Communications Protection, the requirement to monitor, control, and protect communications at external boundaries and key internal boundaries (Security Requirement 3.13.1) is directly about this. The word internal is the part small businesses skip. The requirement to implement subnetworks for publicly accessible components that are physically or logically separated from internal networks (3.13.5) is segmentation stated explicitly. Under Access Control, the requirement to control the flow of controlled unclassified information in accordance with approved authorizations (3.1.3) is difficult to claim honestly on a flat network, because a flat network does not control flow at all.

There is a second benefit that matters more than the control mapping. Segmentation shrinks your assessment scope. If controlled unclassified information lives on a defined, separated segment rather than spread across a flat network that includes cameras and guest devices, the boundary of your assessment is smaller, the System Security Plan is easier to write, and the evidence is easier to produce. Scope reduction is one of the few moves that lowers both risk and compliance cost at the same time.

For a medical or dental practice under the Health Insurance Portability and Accountability Act (HIPAA), the same logic applies to electronic protected health information. A waiting room television and a visitor's phone should not be on the same network segment as the workstation that displays patient records.

What segmentation does not do

Segmentation limits lateral movement. It does not stop the initial compromise. If an employee on the business segment opens a malicious attachment and enters credentials on a fake login page, segmentation does not prevent that. It also does not help against attacks that arrive through legitimate cloud services rather than the local network, and it does not protect data that is already exposed through a misconfigured cloud share.

What it does is contain the damage. A compromise on a segmented network affects one zone instead of the entire business. That difference is often the difference between an incident and a catastrophe, between cleaning one machine and rebuilding everything.

What to do this week

Three steps, in order.

One. Inventory what is actually connected. Log in to your router and look at the list of connected devices. Most small business owners find equipment they had forgotten about, and occasionally something they cannot identify at all. You cannot segment a network you have not inventoried.

Two. Turn on the guest network and start using it for every visitor, contractor, and personal device. Stop giving out the main network password. This one change, by itself, removes an entire category of risk.

Three. Move the cameras, printers, and smart devices off the network where your business data lives. If your equipment supports a second network or VLAN, use it. If it does not, this is the rare case where replacing a consumer router with a business-class model is worth the few hundred dollars, because the capability you are buying protects everything else.

Then write it down. One page describing which segments exist, what belongs on each, and what traffic is allowed between them. That page is your network documentation, and it is what turns a configuration into a control you can show an assessor, a prime contractor, or a cyber insurance underwriter.

The equipment is usually already in the office. The capability is usually already paid for. What is missing is the decision to use it.

Adams Cloud and Cybersecurity provides cybersecurity readiness consulting for small businesses and defense contractors.