Network segmentation splits one office LAN into isolated zones so a compromised laptop, camera, or guest phone cannot walk sideways into payroll, file shares, or domain controllers. A flat network treats every jack the same. A segmented network does not.
This is a brief, not another network-security overview. For the broader control stack, see network security for business. For the full build sequence, see how to build a secure IT infrastructure. This page is the labeled zone map those articles point to.
What Network Segmentation Does
Most small offices still run a single VLAN: workstations, printers, guest Wi-Fi, security cameras, and servers share one broadcast domain. When ransomware lands on one PC, east-west traffic is already allowed. Segmentation puts a policy boundary between those groups.
- Contain the blast radius. A guest phone that picks up malware cannot reach accounting.
- Give cameras their own lane. Surveillance traffic stays off the employee LAN, which is both a security and a bandwidth decision.
- Make the firewall the choke point. North-south internet filtering is not enough. East-west rules decide which zones may talk, and which may not.
The mechanism is usually VLANs plus firewall (or layer-3 switch) policy. The design question is the zone map, not the brand of switch.
A Labeled Four-Zone Map
Four zones cover most 20 to 200-person Arizona offices. Manufacturers add an OT/IT split on top of this. The diagram is conceptual: labels are the design, not a drop-in config.
Solid lime lines: Employee and Servers may talk through the firewall. Dashed lines: Guest Wi-Fi and IoT / Cameras are denied a path to Servers.
What Belongs in Each Zone
- Guest Wi-Fi. Visitors get internet. They do not get printers, file shares, or the camera NVR. Captive portal or a pre-shared guest SSID is enough; the isolation is the VLAN, not the password.
- IoT / Cameras. Cameras, badge readers, thermostats, and other appliances that cannot run endpoint agents. They talk to their recorder or controller, not to employee PCs. See our video surveillance notes on putting cameras on their own LAN.
- Employee. Workstations, identity, printers, and the line-of-business apps people use all day. This zone authenticates to Servers. It does not share a VLAN with guests or cameras.
- Servers. Directory, file, accounting, and backup systems. Inbound access is least privilege from the Employee zone, plus the management path your MSP uses. Guest and IoT stay out.
Manufacturers and mines add a fifth boundary: OT stays off IT. Plant-floor controllers do not sit on the same LAN as office email. That split is covered on our manufacturing page.
How Unió Digital Builds This
The zone map is the design. The work is VLANs, switch trunks, firewall rules, wireless SSIDs, and a change process so the next camera install does not land back on the employee LAN.
- Managed network services design and operate the VLANs, routing, and wireless.
- Managed cybersecurity watches the traffic that still crosses a boundary.
- The free IT security assessment grades whether you are still running a flat network.
- Structured cabling is the physical layer those zones ride on.
If the question is "what is network security," start with network security for business. If the question is "how do we build the whole stack," start with how to build a secure IT infrastructure. If the question is "how do we stop one infected device from reaching everything," this map is the answer.
Frequently Asked Questions
What is network segmentation?
Network segmentation divides a business LAN into isolated zones, typically Guest Wi-Fi, IoT / Cameras, Employee, and Servers, so a compromise in one zone cannot reach the others without passing a firewall policy.
Why not put everything on one VLAN?
A single VLAN is a flat network. Every device can already talk to every other device, so ransomware or a guest-phone infection has a clear path to servers. Segmentation removes that path by default.
Do security cameras need their own segment?
Yes. Cameras are IoT: they rarely run endpoint agents, they generate constant traffic, and they should not sit on the employee or server LAN. Put them on an IoT / Cameras VLAN that can reach the NVR and nothing else.
Is a firewall enough without VLANs?
A perimeter firewall filters north-south internet traffic. Segmentation is east-west policy between internal zones. You need both: VLANs to create the zones, and firewall (or layer-3) rules to decide which zones may talk.
Still on a Flat Network?
Take the free IT Security Assessment. It flags missing segmentation alongside the rest of the control stack.
Take Free Assessment
