How to secure your corporate network: four basics
The question of how to secure a corporate network is not answered in one purchase, but in four things done in the right order: know what is on the network, divide it, organise administrative access and update devices. This article describes each of them, points out what they don't do, and says directly which of them require constant supervision.
Why the network layer?
A conversation about security in a company usually starts with computers, i.e. antivirus, passwords and backups, which is right, but incomplete because it ignores the layer in which these computers talk to each other.
The network determines something that the protection of a single station does not cover: how far the impact of one incident reaches. An infected laptop on an all-sees-everything network has access to the file server, cameras, printers, and accounting computer, while the same laptop on a split network sees a fraction of that.
This is where the difference lies and why it's worth starting with the four basics described below. Each of them is a one-time job with a lasting effect, but three of the four require regular maintenance, which I mention separately for each one, because it is the most often overlooked part of this conversation.
Basic 1: Know what's on the network
You can't secure something you don't know, which sounds trivial until someone makes a list and it turns out that there is equipment on the network that no one remembered about: an old printer with its own server, a previous monitoring recorder or a device left by a former supplier.
The minimum list should include what is connected wired and wirelessly, what it is for and who is responsible for it, whether it can be managed and whether anyone has access to it, and whether the device still receives updates from the manufacturer.
This last point can be unpleasant because network equipment that is no longer supported will no longer receive security bug fixes, even though it works and does not bother anyone.
Does it require supervision: yes, because the list remains current exactly until your next purchase.
Base 2: divide the network
Segmentation involves dividing the network into separate parts and describing what is allowed between them, which is usually done by VLANs, i.e. logical networks separated on the same cabling.
The division that works in most companies is as follows:
| Segment | What's in it | Can it see the rest? |
|---|---|---|
| Corporate | employee computers, servers, printers | yes, to the extent needed for operation |
| Guest | guest and customer devices | no, internet only |
| Devices and cameras | IP cameras, IoT equipment, air conditioning, controllers | no, beyond the specified save point |
| Management | network device panels | for administrators only |
A sensible implementation sequence leads from separating the guest network, through cameras and devices, to the rest, because the first two steps provide the greatest effect with the least risk of disruption.
The distribution of the network into zones is also described in the article about Wi-Fi networks in the office.
Does it require supervision: moderately, because once the division works, each new device must be assigned to the appropriate segment, without which, after two years, half of the equipment ends up in the corporate segment, "because it worked there immediately."
Basic 3: organise administrative accesses
This is the most overlooked base, probably because it doesn't require any purchase.
The company should be able to answer who has administrative access to network devices, whether they have full rights to these devices or rather depend on the contractor's account, whether default passwords have been changed, whether access has been revoked after the end of cooperation with anyone, and where this data is saved and who has access to it except one person.
A network to which the company does not have full administrative rights is a network dependent on one person or one supplier, and this risk is revealed at the worst possible moment, i.e. during a failure or when the contractor is changed.
How to do it properly when changing suppliers is described in the article about changing the IT company and taking over the administration.
Does it require supervision: yes, because the accesses diverge with each personnel change.
Basic 4: Update network devices
The software of switches, access points and gateways receives patches, including security bug fixes, while the typical situation in a small company remains the equipment running on the version from the day of installation because no one has agreed who will deal with it.
However, updating a network device requires a reboot, and a reboot means a break, so it's not an on-the-go activity, but a planned activity, with a fixed out-of-hours service window, a sequence from edge to backbone to access, a check after each step to make sure everything is back, and a written plan to revert to the previous version in case something goes wrong.
Network management platforms show versions on all devices simultaneously and allow you to schedule updates at a specific time, which is one of the features that make it worth having managed hardware at all.
Does it require supervision: definitely yes, as it is the only one of the four bases that is a cyclic activity rather than a state.
Guest networking is borderline, not polite
It is worth naming it separately because it is sometimes treated as a gesture towards customers.
The guest network has one task, that is, to provide access to the Internet without access to anything else, which means its own segment, lack of visibility of company resources and most often also isolation of guest devices among themselves.
The first common mistake is to create a separate network name and password while keeping the same segment, resulting in the "guest network" being merely a second password for the same network and not providing any boundary. The second is that employees start using the guest network because the password is shorter, and after a few months it becomes the company's main network, but without security.
What these four basics don't do
Let's say it straight, because it's very easy to promise too much.
These basics do not protect computers, because segmentation limits the scope of the incident, but it will not stop malware on the workstation, which is part of endpoint protection. They do not protect accounts or email, because corporate email password phishing takes place outside the local network and is prevented by multi-factor authentication and account ordering. Do not replace backups, because no network division will restore the data, which is what a backup with tested restoration is for. They are also not regulatory compliance: segmentation is sometimes one of the elements invoked in GDPR or NIS2, but it does not in itself make a company compliant with anything, and compliance assessment is the responsibility of a lawyer or data protection officer, not a network engineer.
I make this clear: this article is not legal advice and describes only the technical layer.
How to secure your corporate network: the order we recommend
- List of what's online.
- Changing default passwords and organising administrative access.
- Guest network separation.
- Separation of cameras and devices.
- Determine who updates network devices and when.
- Rest of the network division.
Points 1 and 2 cost nothing more than time, giving the most, so a company that will do just these two, will be in a clearly better place than before the change.
Who does it
We're getting to the point, because three of the four basics require constant attention.
We can do it once, performing a review, division design, implementation and documentation, and transferring full administrative rights, which leaves a document describing what is where and why, also useful when the company has its own IT specialist.
We can also provide the environment with constant care, taking over supervision of these four basics: monitoring the condition of devices, updates in agreed service windows, assigning new devices to the appropriate segments, reviewing access in the event of personnel changes and maintaining documentation in a state consistent with reality, while the scope and response times are recorded in the contract.
There is no third way, because the basics implemented once and left unattended fall apart at the pace of changes in the company, not at the pace of changes in technology.
The network layer is part of a larger whole: protecting computers, email and accounts is part of cybersecurity for businesses, and if the network needs tidying up first, we start with building and maintaining corporate networks.
Book a free IT review And let's start with the first point, which is to figure out what's actually on your network.