Network segmentation

Network segmentation divides a computer network into separate zones so that devices in one zone cannot freely reach devices in another without passing through security controls.

Instead of one flat network where every device can talk to every other device, segmentation creates separate areas, often using VLANs and firewall rules. Common examples include keeping guest Wi-Fi apart from staff computers, isolating payment terminals, and placing security cameras, printers and building controls on their own network.

If an attacker or piece of malware gets onto one device, a flat network lets it spread quickly to servers and backups. Segmentation limits that spread and reduces the damage from a single mistake. It is also required for businesses that handle card payments under PCI DSS rules, and is common in Alberta industrial and oil and gas settings where office systems must stay separate from operational equipment.

Practical tip: start simple. At minimum, put guest Wi-Fi and smart devices on networks that cannot reach your business computers, and make sure backup systems are not reachable from ordinary workstations.