Network segmentation: why small networks need VLANs too

One network for everything: the flat network

In many small offices, law firms and medical practices, every device sits on the same network: workstations, servers and backup storage, printers, phones, the camera at the entrance, the guest Wi-Fi and sometimes a member of staff’s personal phone. This is known as a flat network. Every device can reach every other device directly.

Day to day, nobody notices – everything works. It only becomes a problem once a single device has been compromised.

How attacks spread across a network

Attacks rarely start at the server. Typical entry points are:

• a PC on which someone opened the attachment of a phishing email,
• a printer or camera running outdated firmware with a default password,
• an IoT device such as a smart TV in the meeting room,
• a personal device that has joined the company Wi-Fi.

From that first device, attackers look around the network for worthwhile targets: file servers, databases, domain controllers – and the backups. This is called lateral movement. Ransomware then encrypts not just one PC but everything it can reach. Worst of all, if the backups are deleted or encrypted as well, there is no clean way back.

That is why the US Cybersecurity and Infrastructure Security Agency (CISA) explicitly recommends in its #StopRansomware Guide that you segment networks to prevent or limit lateral movement from an infected device, and keep backups offline.

What segmentation does

Network segmentation splits the network into separate zones, usually as VLANs (virtual networks running on the same switches). A firewall sits between the zones and only allows the connections that are genuinely needed. Everything else is blocked.

Think of it like fire compartments in a building: a fire can still break out, but fire doors stop it from spreading through the whole building. An infected workstation can no longer simply reach the backup storage, and the old printer has no route to the server.

Germany’s Federal Office for Information Security (BSI) sets this out as a basic requirement in its IT-Grundschutz module NET.1.1 Network architecture and design (in German): clients and servers belong in different network segments, guest access gets its own segment, and a segment should only contain devices with a similar security level.

Typical zones in a small network

How finely you separate depends on the organisation. These zones have proved their worth:

Medical practices often add a separate zone for medical devices such as ultrasound, ECG or lab equipment. These frequently run software that the manufacturer rarely updates, so they should only get exactly the connections they need to talk to the practice software. For connections such as the Austrian e-card infrastructure, the operator’s requirements apply, and the segmentation is designed around them.

For law firms, the focus is on protecting client data: servers and backups separated from workstations, and visitors in the meeting room on the guest Wi-Fi only.

Why it should be standard, even in small networks

• Little effort: Current business switches, firewalls and Wi-Fi systems support VLANs anyway. Often no new hardware is needed – just a clean configuration.
• Damage stays contained: A compromised device puts its own zone at risk, not the whole business.
• Backups stay protected: Your most important safety net cannot be reached directly from an infected workstation.
• Guests and personal devices stay out: They get internet access but no access to internal systems.
• Clarity: When you know which device sits in which zone, faults are found faster and unusual traffic is easier to spot.

NIS2 and the Austrian NISG 2026

The NIS2 Directive requires entities in scope to take appropriate risk-management measures, and the security of network and information systems is expressly part of that. In Austria, the NISG 2026 has applied since 1 October 2026 – see our article NISG 2026 in force: registration and next steps. If in doubt about whether your organisation is covered, check with your legal adviser or professional body. Either way, segmentation is a measure that is easy to document in a risk analysis.

Common objections

“We’re too small – there’s nothing to steal here.” Many attacks are automated and hit whoever is vulnerable, regardless of size.

“It makes everything complicated.” For staff, usually nothing changes day to day. Printing, phoning and accessing the server all keep working – just along clearly defined routes.

“My IT provider says we don’t need VLANs.” A flat network works – until a device is compromised. Then the attacker has access to everything. Ask specific questions: could an infected workstation reach the backup storage today? Can a guest on the Wi-Fi reach the printer or the server? If the answer is “yes” or “not sure”, it is worth taking a second look.

Checklist for your network

• List every device on the network, including printers, cameras, phones and medical devices
• Define zones and assign each device to one
• Set up firewall rules between zones on a “only what is needed” basis
• Put backup storage in its own tightly isolated zone, and keep an additional copy offline or immutable
• Separate the guest Wi-Fi from the internal network
• Allow admin access to switches, firewall and Wi-Fi only from the management network
• Document the network plan and update it with every change

How IT United helps

We set up network segmentation as standard for all our clients – including small networks. This covers planning the zones, configuring switches, Wi-Fi and firewall, and the documentation. Find out more under Network, IT security and Backup.

Would you like to know how exposed your network is today? Arrange a free initial consultation and we will look at your situation together.