Why a camera has no business talking to the printer
A security network of any size quickly runs to hundreds of devices: cameras, card readers, door controllers, intercoms, detection panels. They are spread across a site, they are often physically reachable, and they run software that is rarely updated. That combination is exactly what makes them attractive as a starting point.
So the question is not only whether someone gets in, but how far they get once they do.
What segmentation solves
An attack on a network rarely happens in one step. It starts at the weakest device and moves from there towards something more valuable. That is lateral movement, and segmentation is the answer to it: divide the network so a device can only reach what it needs.
The question you ask per device is simple. Who does this thing have to talk to in order to do its job? A camera needs the recording server. A card reader needs the access controller. Nothing else. Certainly not each other, and definitely not the office network.
Zones and conduits
IEC 62443, the standard for cybersecurity of industrial and security systems, gives us language for this. Devices with a comparable function and a comparable risk belong in the same zone. Traffic between zones runs only through a conduit: a controlled and explicitly described connection. Anything not described in a conduit does not pass.
That sounds abstract, but it forces a practical exercise. For every zone you have to write down what traffic may leave it and where it may go. That exercise is usually the most valuable part of the whole project: more often than not it is the first time anyone has mapped out precisely what travels across that network.
VLANs are a start, not a solution
The usual first step is to put every type of device in its own VLAN. That helps, but it solves less than it appears to:
- Inside a VLAN everything is still open. A thousand cameras in one camera VLAN means one compromised camera can reach nine hundred and ninety-nine others.
- A VLAN says nothing about who is using the port. Without access control, someone can unplug a camera and connect their own device instead, landing in the same VLAN.
- The routing between them does the real work. If traffic between VLANs passes unfiltered through a router, the separation is administrative rather than actual.
That is why segmentation always comes with filtering. It is sharpest at port level, where the switch decides per connected device which address and which port it may talk to: a camera reaches the recording server on one port and nothing else, not even another camera.
The link with identity
Segmentation maintained by hand falls behind within a year. Someone moves a camera, an engineer connects a device to a different port, and the layout no longer matches reality. If the zone is assigned on the basis of what the device is - through 802.1X, or through MAB with profiling for devices that cannot manage it - the segmentation follows the device by itself.
That is why access control and segmentation are one project in practice rather than two.
Where it usually comes unstuck
Unknown traffic. There is always a connection nobody knew about: a supplier watching remotely, an old system reaching a shared folder. Measuring before you close things down, and starting in monitor mode, is not a luxury.
Management traffic. Segment a network tightly and you often lock yourself out along with everyone else. Management belongs in its own zone with its own conduits, designed deliberately rather than left open by accident.
Documentation that does not keep up. A zone description that stops being updated after handover is fiction two changes later. Who manages the network, and where is it recorded what may pass? That question belongs in the design, not in the handover.