Network segmentation

In a flat network, every device can talk to every other device. A compromised laptop can reach servers, backups, cameras, printers and production equipment directly. Segmentation creates boundaries, typically using VLANs and firewall rules, so that traffic between zones is limited to what is actually needed.

Common segments for an SMB include staff workstations, servers, backup infrastructure, guest Wi-Fi, voice systems, security cameras and building controls, payment terminals and operational technology such as manufacturing equipment. Each zone gets rules that permit only necessary traffic.

Segmentation slows lateral movement, contains ransomware, reduces the scope of compliance requirements like PCI DSS and protects fragile systems that cannot be patched. For a manufacturer in Ontario or Quebec with older production controllers, isolating those machines from the office network is often one of the most valuable security projects available. Start by documenting what talks to what, then introduce rules gradually, monitoring for anything that breaks.