NexusSec.Ask most businesses whether a laptop in the accounts office can reach the server room and the answer is usually a pause. The network was built to make things work, which it does. Nobody was asked to make it also contain a failure, so it does not.
What flat actually means
A flat network is one where devices can talk to each other without anything in between deciding whether they should. In practice that means a workstation, the ERP server, the backup appliance, the CCTV recorder, the guest Wi-Fi and the printer all sit in the same space, reachable from one another.
This is not negligence. It is what happens when a network grows by addition: a switch when a line was installed, an access point to reach the far end of a shed, a supplier given access once. Each step was reasonable. The result is an estate with no internal boundaries.
Why it matters more than it used to
Ransomware operators do not encrypt the machine they land on and stop. They land, look around, move sideways to find the systems worth holding hostage, and specifically hunt for backups so recovery is not an option. A flat network makes every one of those steps easy.
The practical consequence is that the difference between an incident and a disaster is often just whether the attacker could reach the backups from the machine they first compromised. That is a design question, and it is answerable before anything happens.
The zones that matter
Segmentation gets described as though it needs a dozen zones. Most businesses need a handful, and the first two deliver most of the benefit.
- Backups. Reachable only by the systems that write to them, from nowhere else. This single boundary is what preserves your recovery option.
- Management interfaces. Firewall, switch, hypervisor and server management, reachable only from specific administrative machines. An attacker who reaches these owns everything else regardless of what you did elsewhere.
- Servers. Separated from user devices, with only the ports applications genuinely need passing between them.
- User devices. Where the compromise usually starts, so treat it as the least trusted zone with staff on it.
- Guest and visitor Wi-Fi. Internet only, no route to anything internal. Frequently the quickest fix on the list.
- Cameras, building systems and other appliances. Rarely updated, often shipped with default credentials, and almost never treated as computers. They are computers.
The objection we hear most
"We are too small for anyone to bother with." This was a reasonable position when attacks were targeted and manual. It stopped being one when the economics changed: scanning the entire internet for a known-vulnerable edge device costs almost nothing, and the operator does not need to know or care who you are before they land. Size stopped being camouflage some years ago.
The related objection is more defensible: that segmentation is a large project for a business with more urgent problems. Sometimes true, and covered further down. But the first two boundaries, backups and management interfaces, are usually a day of work rather than a project, and they prevent the outcomes that actually end businesses.
Doing it without breaking the business
The reason flat networks persist is a reasonable fear: nobody knows what depends on what, so imposing boundaries risks stopping work. That fear is addressed by sequencing rather than by avoiding the project.
The approach that works is to design the zones, then deploy the policy in monitor mode first, so you can see exactly what would have been blocked without blocking it. That surfaces the legitimate traffic nobody remembered, including the accounts package that talks to a server on an unusual port. Then enforcement goes on zone by zone, with a gap between phases, so any problem appears at small scale and can be traced immediately.
Done that way, a single-site business is usually looking at a few weeks rather than a disruptive cutover. The detail of how we approach it is on the network segmentation page, and what is network segmentation covers the concept if this is new.
Where the guidance comes from
None of this is a NexusSec invention. Network segmentation appears in the CIS Critical Security Controls as a core control, and the NIST Cybersecurity Framework treats it as part of the protect function. The CIS Benchmarks carry the device-level configuration detail for firewalls and switches, whichever vendor you run. If you want to sanity-check what we recommend against something neutral, those are the places to look.
Where this is not worth doing yet
We do segmentation work, so treat this with the appropriate scepticism: if you have fifteen staff, one server and no branch sites, the return is smaller and there are probably cheaper wins first. Multi-factor authentication on remote access, tested backups and a firewall rule review will usually reduce more risk per rupee at that size.
Segmentation earns its cost once you have multiple sites, sensitive data worth isolating, or an estate where a day of downtime has a number attached. Below that, do the simpler things properly first.
What to do this week
Answer one question honestly: from a laptop in your office, what can somebody reach? If nobody can answer, that is the finding. Then check whether your backups are reachable from an ordinary user machine, because if they are, that is the first boundary worth building and it can often be done in a day.
