A client in the waiting room asks for the Wi-Fi password. You give it gladly: it is a courtesy. But if that network is the same one used by your practice management software, the NAS holding your archive and the office computers, their phone, which may be infected without them knowing, is just a few steps away from your clients’ documents. Let’s look at why it pays to create a separate guest Wi-Fi network and, more generally, to segment your office network.
What is network segmentation?
Segmenting a network means dividing it into several zones isolated from one another, so that devices in one zone cannot communicate with those in another except through precise rules. It is like dividing a building into departments with locked doors: someone who walks into the lobby does not automatically get into the archive room.
Technically, these zones are often called VLANs (virtual local area networks): separate networks that can share the same cables and equipment but remain distinct. What is allowed to pass from one zone to another is decided by the firewall (→ why your router is not enough).
Why does it matter? The problem of the “flat network”
In most small offices the network is “flat”: everyone can see everyone. This means that:
- a PC infected with ransomware can reach the NAS and encrypt the archive (→ ransomware in small offices);
- a guest’s device can snoop around the shared folders;
- a vulnerable camera can become the entry point for an attacker who then moves on towards the computers.
Attackers call this movement lateral movement: they get in through the weakest point and move towards the most valuable one. Segmentation makes this much harder.
The problem with IoT devices
IoT (Internet of Things) refers to all the connected objects that are not computers: cameras, video intercoms, multifunction printers, NAS drives, VoIP phone systems, smart TVs in the meeting room, thermostats, alarm systems.
They are convenient, but they often:
- leave the factory with default passwords known to everyone;
- receive infrequent updates, or receive them only for a few years;
- expose services to the internet for remote access (for example the app for viewing the cameras from your phone);
- cannot run antivirus software.
For years, vulnerable IoT devices have been used en masse by criminals to build botnets, networks of infected devices used for DDoS attacks, that is, attacks that overwhelm a service with traffic. According to the Clusit Report 2026 (from Clusit, the Italian Association for Information Security), DDoS was the most frequent technique in serious incidents in Italy in 2025, accounting for 38.5% of the total.
The three networks of a small office
For an office of 5-50 people, a simple and effective layout is this:
| Network | Who is on it | What it can do | What it cannot do |
|---|---|---|---|
| Work | The office’s computers and laptops, server or NAS | Access the internet, practice management software, archive, printers | Be reached from the other networks |
| Guests | Clients’ and visitors’ smartphones and laptops, personal devices | Only browse the internet | See any of the office’s devices |
| Devices | Printers, cameras, phone system, smart TVs, building automation | Only the communications they need (e.g. receiving print jobs, downloading updates) | Browse freely or reach the computers |
Depending on the situation, a fourth network can be added for managing the equipment, accessible only to the technician.
How to do it in practice
- Take an inventory: list every connected device (you often find some that had been forgotten).
- Create a separate guest Wi-Fi network, with a different password that you change periodically and with the “client isolation” option turned on, so guests cannot even see one another.
- Move printers, cameras and smart devices onto the devices network.
- Set up the rules on the firewall: for example, computers can send print jobs to the printer, but the printer cannot open connections to the computers.
- No cameras exposed to the internet: to view them from outside, use the office VPN, not ports opened on the router.
- Document the layout: one page listing the networks, what is on each one and who has the passwords.
Segmentation requires equipment that can handle it (a firewall and access points with VLAN support) and a bit of initial work by your technician. Once it is done, though, it stays done.
8 rules for IoT devices
- Change the default password straight away, to a long and unique one (→ password guide).
- Update the firmware and turn on automatic updates if available.
- Turn off services you don’t use (remote access, UPnP, unnecessary cloud services).
- Keep them on the devices network, never on the work network.
- No ports opened on the router to reach them from outside.
- Choose products with guaranteed updates: from December 2027, under the European Cyber Resilience Act, connected products sold in the EU will have to meet security requirements and guarantee updates.
- Replace those that are no longer supported.
- Pay attention to multifunction printers: they store copies of scanned documents and often send emails; treat them like a computer.
How Strega Defence helps
The Strega Defence Box is the single point of passage between the office and the internet and, by default, closes off everything that isn’t needed. It watches the traffic and notices, for example, if a device starts talking to a suspicious server: in that case it isolates the suspicious device on its own from the rest of the network and alerts the owner on their phone, until the technician checks it. Note: a complete redesign of the network (separation into VLANs, configuration of access points and switches) is a separate job, to be entrusted to your own trusted technician or a partner. Discover Strega Defence.
For a general check of your office’s security, try the 10-question checklist.
Frequently asked questions
Why should guest Wi-Fi be kept separate?
Because visitors’ devices are not under your control and could be infected. If they share the network with the office computers, they can reach shared folders, the NAS and printers. A separate guest network only lets them browse the internet.
What is a VLAN, in simple terms?
It is a virtual network: it lets you create several separate networks using the same cables and the same equipment. Devices on one VLAN cannot communicate with those on another, except through the rules set on the firewall.
Can a printer be a security risk?
Yes. Multifunction printers are real computers: they store copies of documents, send emails, have management panels accessible over the network and are rarely updated. They need to be kept updated, protected with a password and placed on a separate network.
Can security cameras be hacked?
Yes, especially if they use default passwords, are not updated or are exposed to the internet for remote viewing. The risk is both an intrusion into privacy and the camera being used as a way into the network or as part of a botnet.
Can my internet provider’s router create a guest network?
Many routers offer a basic guest network, which is a useful first step. However, they usually do not let you create several networks with detailed rules, nor monitor the traffic between them. For a professional office, a firewall that manages segmentation is the better choice.
Sources and further reading
- Rapporto Clusit 2026 – dati principali (in Italian) — Clusit, 11 March 2026.
- Cyber Resilience Act — European Commission.
- Regulation (EU) 2024/2847 (Cyber Resilience Act) — EUR-Lex.
- Consigli utili per i professionisti IT delle PMI (PDF) (in Italian) — ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale).
- ENISA Threat Landscape 2025 — ENISA.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
