First published November 2021. Rewritten and last reviewed 14 August 2026.
The first version of this article was written in the middle of the shift to working from home, and it read like it. Five years on, the home office is permanent, the house has more connected devices than the office ever had, and the question has changed. It is no longer whether a property needs network security. It is whether the network was designed to be defended in the first place.
Most were not. A typical house runs everything through the router the broadband provider sent in the post: the family’s laptops, the children’s consoles, the heating, the doorbell, the television, the cleaner’s phone, the home office with the firm’s data on it, and whatever the last installer added. One flat network, one password, and every device able to see every other.
Security is a layout decision before it is a product decision
We treat the network the way an architect treats a plan. Rooms exist so that different activities can happen without interfering with one another, and doors exist so that movement between them can be controlled. A network built the same way puts different kinds of device in different segments and decides, deliberately, what is allowed to pass between them.
In a private house the segments usually look like this:
- Household. The family’s own phones, laptops and tablets.
- Home office. The machines that carry an employer’s or a business’s data, kept apart from everything else in the house and treated to the standard the business would apply in its own building.
- Audio, video and control. Processors, displays, streaming devices, lighting and blind control. These talk to each other constantly and never need to talk to the office.
- Cameras, intercom and access. On their own, with no route to anything else and no exposure to the internet. We covered why in Are your cameras keeping you safe?
- Guests and staff. Internet access and nothing more.
A compromised smart plug on the household segment is a nuisance. A compromised smart plug that can reach the home office is a data breach. The difference between the two is not the plug. It is the plan.
What sits underneath the plan
A firewall with a written policy. The router from the broadband provider is replaced, or placed behind, a firewall that enforces the segments above. Every rule that allows traffic between segments is written down, with a reason. If nobody can say why a rule exists, it is removed.
Managed switches and structured cabling. Segmentation only works if the switches can enforce it, and it only stays reliable if the cabling was installed to a standard. This is first-fix work, agreed with the architect at RIBA Stage 2 and 3 and drawn at Stage 4. It is the part of the job that cannot be added later without opening walls, and it is the part most often left to chance.
Wi-Fi that respects the segments. Separate wireless networks for household, guests and equipment, each landing in the right segment, using current encryption, with the guest network unable to see anything but the internet. Coverage is designed from a survey of the building, not from where the router happened to be put.
Nothing exposed, and remote access done properly. No forwarded ports. Remote access for the owner, and for us, is through a VPN with individual credentials that can be withdrawn. Our own access is agreed in writing.
Devices with a support life. Before anything is specified we check how long the manufacturer will provide security updates. Since 29 April 2024 UK law has required manufacturers of consumer connectable products to state that period, which makes the check simpler than it used to be. Firmware across the estate is then reviewed on a schedule under a support agreement rather than when something breaks.
Documentation the client owns. A record of every segment, every rule, every device and every credential, handed over at completion and kept current. A network nobody can describe is a network nobody can defend, and it is also a network the client cannot take to another contractor if they choose to.
The same discipline in a bar, a restaurant or an office
A hospitality venue has the same problem with higher stakes. Card terminals, the till, the booking system, background music, digital signage, CCTV, staff devices and a guest Wi-Fi network that hundreds of strangers join every week. Card terminals are placed on their own segment, kept well apart from guest Wi-Fi, which is what the card industry’s own security standard expects. Signage and music sit where a failure cannot touch the till. Guest Wi-Fi reaches the internet and nothing else. The venue’s own office is treated as an office.
None of this is exotic. It is the ordinary practice of a competent network engineer, applied to buildings where nobody thought to apply it.
Who does this work
Network and cyber security is a core discipline of the practice, led by Mark Laird, who holds master’s degrees in Network Security and in Cyber Security. The full list of qualifications, with the awarding institutions, is on his page. We also run training sessions for households and businesses that want their own people to understand what they are living with.
We normally work for the client, with the architect. If you are planning a new build or a refurbishment, the right moment to talk about the network is before the electrical drawings are finished. If you have an existing property and want to know how it is really set up, ask us to look. The network infrastructure page describes the service in full.