Walk into most large homes and you will find one network carrying everything: the family’s laptops and phones, the CCTV, the alarm panel, the lighting and heating controls, the cinema room, the guest Wi-Fi and the devices of household staff and visiting contractors.
That arrangement is convenient. It also means an attacker who compromises one device can reach all the others.
Where the risk comes from
Smart home devices often run old software that the manufacturer stops updating after a few years. Contractors connect laptops to service the audio-visual or building systems. Guests and staff bring their own phones. Each of those is a way in. On a flat network, a compromised camera sits next to the principal’s laptop, and an attacker can probe it at leisure.
What separation looks like
We divide a home network into zones, each with its own rules:
- Family: personal and work devices for the principal and family members, with the strictest controls.
- Household staff: devices used by staff, with access to what they need for their role and nothing more.
- Guests: internet access only, isolated from everything else in the house.
- Security systems: CCTV, alarms and door entry, reachable only by the security company and authorised family devices.
- Building and AV systems: lighting, heating, blinds and audio-visual, with remote access limited to the installer and switched on only when needed.
The firewall between zones blocks traffic by default and allows only the connections each system needs. With monitoring in place, unusual traffic from a camera or a thermostat raises an alert for us to investigate.
Plan it before the builders finish
Segmentation costs least when it is designed in, before the cabling and AV contracts are signed. If you are building or renovating, bring us in alongside your architect and AV installer. If your home is already finished, we can survey what is there and redesign the network with little disruption.