Guide / Santa Barbara County
Network segmentation for small business: keeping devices away from your data
Most small offices run everything on one network: computers, printers, cameras, door controllers, and the guest Wi-Fi. This guide explains why that is a problem and what separating them involves, and it is written from the point of view of someone who installs cameras and door hardware.
What a flat network looks like, and why it is a problem
Picture a small office with a front desk, a back office, and a shared closet with the router. A laptop with the accounting files, a printer, four cameras, a door controller, and the guest Wi-Fi all connect through the same box. Every one of those devices can see every other one. That is a flat network.
It works fine until one device is compromised. A camera with a default password or old software is a small thing on its own. On a flat network it becomes a foothold, because from that camera an attacker can look for the accounting laptop, the file share, and the backup drive without crossing any barrier.
Segmentation adds the barriers. Think of it as interior walls and locked doors inside the building, rather than one open room with a lock on the front entrance.
The devices that usually let attackers in
The weak points are rarely the computers. Computers get updates, antivirus, and some attention. Cameras, recorders, door controllers, doorbells, printers, and smart gadgets are installed once and forgotten. They often run old software, keep factory passwords, and have no way to tell you they have been tampered with.
Guest wireless is the other common gap. A guest, a vendor, or a customer's phone joining the same network as your staff computers means you are trusting devices you have never seen. Some of those are infected without the owner knowing.
These devices are exactly what a physical security installer puts on your network. That is why we treat the network as part of the install, not a separate project someone else might do later.
Separate networks for cameras, doors, guests, and staff
The layout we use is simple to describe. Staff computers and business data sit on one network. Cameras and the recorder sit on a second. Door controllers sit on a third, or share with cameras if the site is small and the rules between them are tight. Guest wireless sits on its own network that can reach the internet and nothing else.
Each network can only talk to the others where there is a real reason. The recorder needs to hear from the cameras. A manager's phone may need to view video. Nothing needs a camera to reach the accounting laptop, so that path is simply closed.
This is also why a recorder on your own hardware matters. Video stays on your side of the wall instead of passing through someone else's servers. The tradeoffs are covered in local recording vs cloud security cameras.
Firewall and intrusion prevention between them
Separate networks only help if something enforces the separation. That job belongs to a firewall, which checks every connection between networks against a short list of allowed paths and drops the rest. Without it, the networks are labels, not walls.
We use a firewall with intrusion detection and prevention. Detection notices patterns that look like scanning, guessing passwords, or a device suddenly talking to places it never has. Prevention blocks that traffic instead of only logging it.
The rules are kept short on purpose. A short rule set is easier to explain, easier to audit, and harder to leave a forgotten hole in.
Remote access without open ports
Many people want to check cameras from a phone. The quick way is to open a port on the router so the internet can reach the recorder directly. It works, and it also puts the recorder where automated scanners can find it, with whatever password and software it happens to have.
The safer way is hardened remote access. Instead of leaving a door open to the whole internet, you connect through an encrypted, authenticated path, and the recorder is never directly exposed. You still get the app on your phone. The difference is that strangers cannot knock on it.
The recorder also keeps recording when the internet is down, so remote viewing is a convenience layer and not something the system depends on. Our security camera installation work sets this up from the start.
A ten minute self-check for your office
You can run most of this today without special tools. Write down what you find, since the list is useful even if you never hire anyone.
First, list every device that connects to your network: computers, phones, printers, cameras, recorders, door controllers, doorbells, smart TVs. If you cannot account for one, that is the first finding. Second, check whether cameras and staff computers share the same network or the same Wi-Fi name. Third, look at the guest Wi-Fi settings and confirm it is isolated, not just a second name for the same network.
Fourth, log into the router and look for port forwarding rules. Any rule pointing at a camera or recorder is an open door. Fifth, check whether any device still uses its factory username and password, and whether the router and recorder have been updated recently. Sixth, ask whoever installed your cameras whether anyone else can reach them from outside, and get the answer in writing.
When to bring in a full assessment
The self-check finds obvious problems. It does not tell you what an attacker would actually do, which data matters most, or what you would do at two in the morning if something went wrong. That is the work of a risk assessment against a recognized framework, with NIST as the default reference.
If you hold customer records, payment details, health information, or anything you could not afford to lose, a full assessment is worth doing. The network security service page covers assessment, vulnerability management, and incident response planning, and it can be done remotely anywhere.
If you are a business in Lompoc or nearby, the commercial security page shows how this fits with cameras and door access on one property.
Questions
Common questions.
Should my security cameras be on a separate network?
Yes. Cameras are the devices most likely to run old software and weak passwords, so they should not be able to reach your computers or data. Putting them on their own network, with a firewall controlling what crosses, limits the damage if one is compromised. We do this on every camera install.
Is guest Wi-Fi enough to protect my business network?
Only if it is truly isolated. A guest network that can still reach your printers or computers is just a second name for the same network. Proper guest wireless gets internet access only and cannot see anything else, and the firewall enforces that.
What is wrong with opening ports to view cameras remotely?
An open port makes the recorder reachable by anyone on the internet, and automated scanners find them quickly. If the recorder has a weak password or unpatched software, it becomes an entry point. Hardened remote access gives you the same phone viewing without exposing the device directly.
Can segmentation be added to an existing camera system?
Usually, yes. It means moving the cameras and recorder onto their own network and placing a firewall between them and the rest of the office. Some older equipment may need settings changed, and we check that on the walkthrough or in a remote review.
Can you review our network remotely?
Yes. A standalone review is part of our Technical and Cyber work, and it can be done remotely anywhere. For a first look, the free walkthrough guide explains what happens on site, and a call to (805) 800-8163 is a good place to start.
Related guides
Ask us to look at your network.
Free walkthrough, written coverage plan, fixed price. Nothing is locked in until you have seen the plan and the number.