How network segmentation protects business systems and cameras.

Ask what network a facility’s CCTV cameras sit on, and a surprising number of the time the honest answer is “the same one as everything else.” That single fact is one of the most common findings in any basic security review.

What “flat” actually means

A flat network is one where every device — laptops, servers, printers, CCTV cameras, guest devices — can potentially reach every other device, because there is no segmentation stopping them. It’s the easiest network to build and the easiest one to compromise: a single vulnerable device anywhere on it becomes a foothold to everything else.

What segmentation actually does

Segmentation divides a network into zones — typically implemented with VLANs and enforced with firewall policy — so that traffic between zones is deliberate and controlled, not automatic. A practical starting split for most sites looks like:

• Core business systems — servers, finance, admin devices.
• User/staff devices — general workstations and laptops.
• CCTV and building systems — cameras, VMS, access control, intercom.
• Guest Wi-Fi — visitor internet access, with no path to internal systems.
• OT/industrial systems, where relevant — kept isolated from general IT entirely.

Each zone gets a firewall policy defining exactly what it’s allowed to reach. CCTV cameras, for example, typically need to reach the recording server and nothing else — they have no legitimate reason to talk to finance workstations or guest devices.

Why cameras specifically matter here

IP cameras are a common target precisely because they’re often overlooked in security planning — treated as “just a camera” rather than as a network-connected computer with its own firmware, default credentials and potential vulnerabilities. A compromised camera on a flat network is a foothold into everything else on that network. On a segmented network, it’s contained to a zone that was never given a path to anything sensitive in the first place.

The practical benefit

Segmentation doesn’t just limit damage from a compromise — it also makes normal operations easier to reason about: a network engineer troubleshooting guest Wi-Fi complaints doesn’t need to worry about accidentally exposing finance systems, because the two were never on the same zone to begin with.

Segmentation is not a single product to buy — it’s a design decision made when a network is built or reviewed, implemented through VLANs, switch configuration and firewall policy working together. It’s also one of the highest-value items in any network or firewall review, because a flat network is both common and quietly high-risk.