Network Segmentation Anti-Patterns: Practical Checks for Australian SMEs

Many small businesses believe they have a segmented network because they use separate Wi-Fi names or place devices on different shelves. A real security boundary is more than a label. It should limit which systems can communicate, who can administer them and what happens when one device is compromised.

Anti-pattern 1: one flat network

If customer devices, staff computers, printers, cameras and operational equipment share the same network, an attacker who reaches one device may find a path to everything else. Start by listing the systems that need to talk to each other, then remove connections that are not required.

Anti-pattern 2: segmentation without testing

A rule can look correct in a diagram while an old firewall exception, shared administrator account or remote-management service quietly bypasses it. Test from each zone. Confirm that customer-facing systems cannot reach staff administration tools, and that operational devices cannot reach sensitive business records unless there is a documented reason.

Anti-pattern 3: treating suppliers as trusted by default

Vendors may need remote access for support, but permanent access is difficult to monitor. Use named accounts, multi-factor authentication, time-limited approval and logs. Close the access when the work is complete and review supplier connections regularly.

Anti-pattern 4: forgetting the recovery path

Segmentation should not prevent the business from recovering. Document how critical systems are restored, where management access is held and how staff can operate manually if a network zone or cloud service is unavailable. Keep backups and management interfaces protected from ordinary user networks.

A practical SME review

• Draw the current zones and list every connection between them.
• Remove unused rules, shared accounts and permanent vendor access.
• Test both allowed and blocked traffic from each zone.
• Record an owner and review date for each exception.
• Repeat the test after major software, supplier or office changes.

Good segmentation is a business-control decision, not only a networking project. A smaller, well-understood network is easier to monitor, recover and explain than a complex design that nobody tests.

Sources

• business.gov.au: Cyber security checklist
• business.gov.au: Create a cyber security policy
• OAIC: Chapter 11, security of personal information