A resilient SME network starts with clear segmentation: isolate critical systems, separate user groups, and constrain east‑west movement inside your LAN. This baseline applies VLANs, firewall zones, and guest Wi‑Fi isolation, with a lightweight DoS preparedness layer, aligned to UK guidance on network security and resilient networks. This can be included in an Independent IT audit for your organisation [ncsc.gov.uk], [security.gov.uk]
Why segmentation matters (in plain English)
- The UK 10 Steps highlight network security as a core control: defend boundaries, filter unauthorised content, and monitor — because poorly segmented networks increase the risk of exploitation, data compromise, malware spread, and denial‑of‑service (DoS) impact. [ncsc.gov.uk]
- The B5 Resilient Networks principle explicitly recommends segmentation to reduce attack surface and limit user access only where needed, and points to DoS guidance for rapid mitigations when under load. [security.gov.uk]
- Preventing Lateral Movement guidance stresses internal controls: segment systems so attackers can’t freely traverse once inside. [ncsc.gov.uk]
The baseline: four segmentation layers
- User access vs. critical services
- Create separate VLANs for general users, privileged IT/admin, and critical services (e.g., identity/DNS/AD, finance/ERP). Route traffic via firewalls so policies apply between groups—default deny; then allow by least privilege. This directly supports B5’s aim to minimise attack surface and preserve essential functions. [security.gov.uk]
- North–south and east–west controls
- North–south: enforce boundary filtering and TLS inspection (where lawful/appropriate).
- East–west: apply inter‑VLAN firewall rules and logging to spot unexpected lateral movement (for example, guest VLANs shouldn’t initiate SMB/RDP to server VLANs). This mirrors NCSC advice to detect and block lateral movement early. [ncsc.gov.uk]
- Guest & IoT isolation
- Put guest Wi‑Fi and untrusted devices (IoT/printers/cameras) in their own VLANs, NAT‑only to the internet, no LAN reach‑back. Restrict management interfaces to an admin VLAN and apply ACLs. This aligns with the 10 Steps’ emphasis on stopping malware import/export and reducing exposure. [ncsc.gov.uk]
- Critical service enclave
- Place domain controllers, DNS/DHCP, certificate services and core databases in a high‑trust zone. Restrict admin paths, enforce multi‑factor for management, and log all admin protocol use. This is consistent with B5 resilience: protect administration devices and interfaces that are frequently targeted. [ncsc.gov.uk]
Minimal firewall policy set (starter)
- Default deny between VLANs, explicit allow by application (DNS, HTTPS, NTP).
- Block legacy protocols not required (e.g., SMB from user VLANs to non‑file servers).
- Limit admin protocols (RDP/SSH/WinRM) to the admin VLAN and jump hosts.
These controls help reduce the blast‑radius and impede lateral movement post‑breach. [ncsc.gov.uk]
DoS preparedness (lightweight)
- Document critical external services and their normal traffic patterns; understand defences (upstream filtering/CDN, rate‑limits).
- Keep a minimal response plan: how to confirm an event, which mitigations to invoke, and how to communicate.
- Test: a short tabletop drill and logging checks to ensure visibility during load.
This mirrors NCSC’s DoS collection (understand the service, defences, response plan, and testing). [ncsc.gov.uk]
Size‑based variants (micro → 250+)
- Micro (<10):
- Two VLANs + guest Wi‑Fi: Users, Servers, Guest. One firewall/UTM, simple rules, logging.
- Keep admin access separate and use a managed router/AP with VLAN support.
Supports 10 Steps’ basic boundary and filtering needs without over‑engineering. [ncsc.gov.uk]
- Small (10–50):
- Add IoT/Printers VLAN; implement east‑west policies; enable basic flow/log reviews.
- Critical services moved to a protected enclave; admin via jump host.
Aligns with B5’s recommendation to secure admin paths and segment systems that don’t need to communicate. [security.gov.uk]
- Medium (50–250+):
- Tier user groups (office vs. remote/contractor), split servers by function, and enforce strict inter‑VLAN rules.
- Prepare DoS playbooks and contacts; run annual scenario testing.
Combines segmentation + resilience and incident readiness per B5 and DoS guidance. [ncsc.gov.uk], [ncsc.gov.uk]
Evidence that segmentation works
- Maintain network maps (VLANs, zones, flows), policy lists, and logs showing blocked east‑west attempts.
- Run a quarterly lateral‑movement detection drill (simulate an unauthorised east‑west connection, verify alerts).
Both support UK guidance on designing for resilience and testing plans. [security.gov.uk]
What Brimbor Consulting delivers
- A concise segmentation assessment: current VLANs/zones and high‑value targets.
- A policy baseline (default‑deny, essential allows, guest isolation).
- A 90‑day plan to implement rules, documentation, and a simple DoS response run‑through—vendor‑neutral.