Network Segmentation: Why It's a Design Choice, Not a Product

The back door security camera reboots itself at 2:14 a.m. and phones home for a firmware update. The update server has been quietly hostile for the last six months. Nobody at the office notices, because the camera lives on the same flat network as the accounting workstations, the badge reader at the front door, and the copier that has kept a digital carbon of every scanned invoice for the last two years.

The camera does not need to be sophisticated. It just needs to be reachable.

This is how most small and mid-sized organizations are built. One network. One trust boundary. Everything inside is treated the same. The workstations get patched, the servers get hardened, the firewall gets tuned. Meanwhile the VOIP phones, the printers, the cameras, the badge readers, the thermostats, and the vendor laptops all sit quietly on the same wire, trusted by default, updated when someone remembers.

The Assumption That Flat Is Fine

Flat networks made sense when networks were small and the things on them were dumb. A printer was a printer. A phone was a phone. A camera stored to a local disk. None of these devices had much to say to the outside world, and none of them ran their own operating system.

That is no longer the situation.

A modern IP camera runs Linux. A VOIP handset runs a full network stack, calls a vendor cloud, and pulls updates on its own schedule. A networked printer stores scanned documents, remembers credentials, and speaks a dozen protocols most IT teams have never inventoried. A badge reader on the shop floor and a PLC on the production line are, from the network's perspective, indistinguishable from any other Linux host.

Every device you plug in is another network, with its own trust posture, its own update cadence, and its own opinion about who it will talk to.

What Often Goes Wrong

The failure mode is rarely dramatic. It is quiet, and it is lateral.

• A device with an old vulnerability gets discovered. Usually the guest wireless bridge, an IP camera, a VOIP phone, or a machine that has not been touched since the vendor installed it. The device is not the target. It is the doorway.

• The attacker sees the network the way that device sees it. On a flat network, that view includes file shares, workstations, the copier with saved credentials, the domain controller, and any manufacturing systems that share the same broadcast domain.

• The attacker moves toward what is valuable. They stop caring about the camera the moment they can reach a workstation with saved credentials, a printer with cached documents, or an HMI that never got a patch.

• Detection lags. Endpoint tools do not run on the camera, the printer, the phone, or the PLC. The one device you cannot see is the one being used to reach everything else.

None of this requires a sophisticated adversary. It requires a device you forgot you owned and a network that trusts everything it can reach.

Patching Alone Does Not Close the Door

The obvious answer to a vulnerable device is to patch it. That works when a patch exists, when the vendor releases it quickly, and when someone applies it.

None of those conditions are reliable.

Zero-day exploits, by definition, are used before a patch exists. Segmentation does not stop them from being used. It stops them from becoming a tour of your network.

Vendor patching timelines vary from days to never. Some vendors release fixes quickly after a disclosed vulnerability. Others let months pass. Some products reach end of support with known unfixed issues still on the release notes.

Most non-workstation devices do not auto-update. Someone has to know a patch exists, decide when to apply it, and deal with what happens if the update fails. That someone is usually the same overloaded IT team that is already patching workstations, servers, and firewalls.

Patching is worth doing. It is not a substitute for a network that limits what any single unpatched device can reach.

Segmentation Is Not Disconnection

The historical answer to this problem was air-gapping: unplug the sensitive equipment and pretend the rest does not exist. On a manufacturing floor, that meant a controls network that did not touch the office. In a smaller office, it usually meant "we do not have this problem because we are small."

Neither of those answers survives contact with modern equipment. The camera vendor wants remote access. The VOIP phones need internet. The PLC vendor pushes firmware updates from a laptop that was on hotel Wi-Fi last night. Disconnection is not available. Trust by default is not survivable.

Segmentation is the design between those two options. It is not a product. It is a set of decisions about what each device is allowed to reach, and what is allowed to reach it.

Protection through design, not disconnection.

A well-segmented environment does not stop devices from being useful. It stops one compromised device from becoming access to everything.

What Segmentation Actually Looks Like

At the office level:

• Guest wireless cannot see the internal network. Not through a shared switch, not through a shared subnet, not through a shared DNS server.
• VOIP phones and their management interface live on their own VLAN, with defined paths out to the vendor and no path to file shares.
• Cameras, badge readers, and building systems live on an isolated network. They talk to their controller and to nothing else.
• Networked printers cannot initiate connections to workstations. They receive print jobs. They do not scan the network.
• Vendor access, when required, is time-bounded, logged, and scoped to one destination.

At the plant level, the same principle carries over with different names:

• The controls network is separated from the office network by more than a switch port. There is a defined boundary, defined traffic, and defined exceptions.
• HMIs, PLCs, and engineering workstations sit in their own zones, with the Purdue model as a reference rather than an ornament.
• Vendor laptops connect through a jump host, not directly to the equipment they are servicing.
• Serial-to-Ethernet gateways and legacy protocols are contained, not exposed.

The details differ. The design principle is the same. Every device sits inside a boundary that reflects how much it should be trusted and how much of the network it should see.

How InsITe Approaches This

Segmentation is one of the first things we look at when we take over a small or mid-sized environment, and one of the first things we redesign in a manufacturer's IT/OT convergence work. We do not sell segmentation as a product; we treat it as a design decision that shapes every other security investment. When the network is designed for blast radius, the endpoint tools, the identity controls, and the backups all become more effective. When it is not, none of them fully compensate.

The Question to Sit With

If a camera in the lobby reboots at 2:14 a.m. and phones home for an update, how much of your network can it see? If the VOIP vendor's laptop connects tonight to push a patch, what can it reach beyond the phones? If a vendor plugs into the plant network to service a machine, is that a scoped session or an all-access pass?

Segmentation is not a firewall rule. It is a design that decides, in advance, what any single compromised device is allowed to become.

The network you already have was designed by someone. If it was not designed for blast radius, it was designed against you.