Walk into most small offices in Bengaluru and you’ll find one network. The receptionist’s
PC, the accounts machine with Tally on it, the CCTV recorder, the smart TV in the meeting
room, the guest Wi-Fi the courier guy logs into — all on 192.168.1.0/24, all able to talk
to each other, all trusting each other completely.
This is normal. It is also the single largest avoidable risk in a small business network.
Why it matters when nothing has gone wrong yet
A flat network means that compromising any device gives an attacker the whole office. The weakest device sets your security level, and the weakest device is never the one you worry about. It’s the ₹4,000 IP camera running firmware from 2019 that will never receive another update. It’s the smart TV. It’s the printer with a web admin panel on port 80 and the default password still set.
Nobody attacks the camera because they want your camera footage. They attack it because it’s reachable, unpatched, and once they’re on it, the accounts machine is one hop away with nothing in between.
The same is true of ransomware, which is the realistic threat for a small business rather than a targeted attacker. Ransomware spreads laterally. A flat network is a wide-open field for it. A segmented one turns a company-wide event into a single-department one.
What segmentation actually means
Segmentation is just this: put devices into groups by how much you trust them, give each group its own network, and make traffic between groups the exception rather than the default.
A sensible starting layout for a small office:
| Segment | What lives there | Can it reach the others? |
|---|---|---|
| Staff | Workstations, laptops, printers | Reaches servers, nothing else |
| Guest | Visitor Wi-Fi | Internet only — never internal |
| IoT / CCTV | Cameras, NVR, TVs, sensors | Nothing. Not even the internet, in many cases |
| Servers | NAS, line-of-business apps | Accepts from staff, initiates nothing |
Four VLANs, four subnets, and a default-deny policy between them. That’s the whole idea.
The important part is the last column. Segmentation isn’t the VLANs — plenty of offices
have VLANs configured and a firewall rule that permits any → any between them, which
achieves precisely nothing. The value is entirely in the policy, and the policy has to
start from “deny” and open up only what’s needed.
The objections, honestly
“Won’t this break things?” Some things, briefly. The classic casualty is network printer discovery and Chromecast-style device discovery, which rely on broadcast traffic that doesn’t cross subnets. Both are solvable — static printer IPs, mDNS reflection where it’s genuinely needed — but they need to be handled deliberately during the change rather than discovered on Monday morning.
“We’re too small for this.” The work is roughly a day for a typical small office, assuming the existing switches support VLANs. Many cheap unmanaged switches don’t, which is the real cost: sometimes segmentation means replacing a ₹1,500 switch with a ₹6,000 one. That’s the honest number, and it’s still cheaper than one incident.
“Our IT guy says the firewall handles it.” A perimeter firewall inspects traffic crossing the perimeter. Traffic between two machines on the same subnet never touches it. This is the most common misconception we run into, and it’s why “we have a good firewall” and “our internal network is segmented” are unrelated statements.
Where to start if you do nothing else
Do these two, in this order:
- Split guest Wi-Fi off completely. It’s the cheapest win available — usually a config change on equipment you already own — and it removes the most common way an untrusted device ends up inside your network.
- Isolate the cameras and the IoT. They are the devices most likely to be unpatchable, and the ones with the least legitimate reason to talk to anything.
Staff and server separation can follow later. Those two changes alone remove most of the realistic paths into a small office network, and neither requires you to redesign anything.
We do network reviews and segmentation work remotely — see Networks & Wi-Fi, or the deeper network architecture practice for larger environments.