NexusSec.Why flat networks are dangerous
In a flat network, every device shares one broadcast domain and can reach every other device. A guest phone on Wi-Fi can, at a network level, attempt to connect to your accounting server. A compromised reception PC can reach the backup appliance.
This is consistently the issue we find most often in assessments. The initial compromise is usually mundane — a phishing email, an unpatched service — but on a flat network the attacker moves from that foothold to domain controllers and backups within hours. Segmentation is what turns a serious incident into a contained one.
How segmentation works
Two mechanisms do the work:
- VLANs divide one physical switch infrastructure into multiple logical networks. Devices in different VLANs cannot communicate directly at layer 2.
- Firewall policy between VLANs controls what traffic may pass, and is where the security actually happens. VLANs without inter-VLAN policy simply create separate networks that route freely to each other.
A sensible starting segmentation
| Zone | What lives there | Typical policy |
|---|---|---|
| Users | Staff laptops and desktops | Access to specific server services only, not whole subnets |
| Servers | Applications, file, database | No direct internet browsing; tight inbound rules |
| Management | Switch, firewall, iDRAC/iLO, hypervisor interfaces | Reachable only from named admin hosts |
| Guest Wi-Fi | Visitor devices | Internet only; fully isolated from internal networks |
| IoT / OT | Cameras, printers, sensors, building systems | Heavily restricted; usually no internet and no internal access |
| Backup | Backup appliances and repositories | Most restricted zone in the network |
Even this basic six-zone model eliminates the majority of easy lateral movement.
Segmentation and micro-segmentation
Traditional segmentation separates zones. Micro-segmentation goes further, applying policy between individual workloads — so two servers in the same tier cannot talk unless explicitly permitted. It is powerful in virtualised and cloud environments, and closely associated with zero-trust architecture. Most businesses should get zone-level segmentation right first.
Practical guidance
- Start with the highest-value targets. Isolate backups and management interfaces first — these are what ransomware operators hunt for.
- Get IoT off the main network. Cameras and printers are rarely patched and frequently exposed.
- Separate guest Wi-Fi properly. Client isolation plus a route to the internet only.
- Write policy by service, not by subnet. "Users may reach the file server on SMB" is useful; "Users may reach the server VLAN" is barely segmentation.
- Log inter-zone denials — they are an excellent early indicator of compromise.
- Phase it. Segmenting a live network in one weekend causes outages. Move zone by zone, monitoring in permissive mode before enforcing.
The bottom line
Segmentation accepts that a breach will happen and ensures it stays small. If you do only one architectural improvement this year, isolating backups and management interfaces from user devices delivers more risk reduction per rupee than almost any product purchase.