Network Security and Segmentation
Reduce exposure across enterprise connectivity.
Segmentation, secure remote access, perimeter controls, monitoring and remediation for commercial environments.
Discuss this requirement →Start with the environment, risk and required outcome.
Segmentation, secure remote access, perimeter controls, monitoring and remediation for commercial environments. Namandla Consultants begins with evidence and recommends a proportionate engagement rather than a generic technology package.
Connected expertise for the wider environment.
Clear steps. Visible decisions.
Segmentation, the work that changes the most
A flat network is one in which every device can reach every other device. It is the default state of any network that grew rather than being designed, and it is where most mid-market environments sit.
The consequence is simple. Anything that gains a foothold on one device has a network path to everything else, and there is nothing in the way to slow it down or make it visible.
What segments should exist
| Segment | Contains | Should reach |
|---|---|---|
| Servers | Application, database, file, print | Defined services only, from defined sources |
| Users | Staff workstations and laptops | Published applications, internet, not each other |
| Guests | Visitor devices | Internet only |
| Voice | Handsets and voice gateways | Voice platform and carrier only |
| Cameras | IP cameras and recorders | The recorder. Nothing else |
| Physical security | Access controllers and readers | Their management server only |
| Building systems | HVAC, lifts, metering | Their management platform only |
| Operational technology | Production and plant equipment | Tightly defined, usually nothing outbound |
| Management | Switch, firewall and hypervisor interfaces | Reachable only from an administrative source |
Client isolation on the user segment is worth calling out because it is cheap and rarely enabled. Workstations very rarely need to reach each other directly. Preventing it removes a lateral path with no operational cost.
The camera and access control segments are the ones organisations forget, and they are typically the weakest devices on the network. Embedded systems, long patch cycles, default credentials and a vendor who will not support a firmware update. They belong behind a boundary.
Operational technology on industrial sites is the highest-consequence version of this. Production equipment frequently cannot be patched because the vendor certified a specific configuration. That makes isolation the compensating control rather than an optimisation.
Doing it without a forklift
Segmentation reads as a rebuild and it usually is not. Most environments already have managed switches and a capable firewall. The work is VLAN design, addressing, moving devices to their segment and writing the rules, phased so that each segment moves separately with a fallback.
The part that takes the time is not configuration. It is discovering what actually talks to what, because the traffic that nobody documented is the traffic that breaks when you put a boundary in front of it.
Firewalls
Rule review
Firewall rule bases grow monotonically. A rule is added for a project, the project ends and the rule stays because nobody can prove it is unused. After some years the rule base is long, partly redundant and understood by nobody.
A review establishes: which rules have not matched traffic in ninety days, which are shadowed by rules above them, which permit broader access than their description suggests, which reference objects that no longer exist, and which have no documented owner or purpose.
Most reviews remove a substantial share of the rule base and tighten several more. It is a few days of work and it is the highest-value firewall activity available, ahead of any feature purchase.
Configuration hygiene
Management interfaces reachable only from an administrative segment, never from the internet. Administrative access with named accounts and multi-factor authentication rather than a shared credential. Configuration backed up and compared against a baseline. Firmware current, on a schedule, with a rollback plan. Logging exported off the device, because logs held only on the firewall are lost with it.
Outbound rules
Inbound rules get attention. Outbound is usually permit-any, because restricting it is work.
Restricting outbound from the segments where it makes sense costs little and does a great deal. Servers rarely need arbitrary internet access. Cameras, access controllers and building systems almost never do. A default-deny outbound policy with defined exceptions on those segments is straightforward and it removes a large category of exposure.
Remote access
Site-to-site VPN for permanent links between offices. Standard, well understood and worth checking that the encryption parameters are current rather than whatever was configured at build time.
Client VPN for staff. Multi-factor authentication is not optional here. A VPN with a username and password is a single credential away from being an internal network connection.
Zero trust access as the direction of travel. Rather than placing a device on the network, publish specific applications to specific verified users on compliant devices. It removes the concept of being inside the network, which is the assumption most lateral movement depends on.
That said: for many mid-market environments, a well-configured VPN with multi-factor authentication and device compliance checking is a proportionate answer and a rebuild around zero trust would be effort out of proportion to the gain. We say which applies to you rather than defaulting to the newer architecture.
Third-party and vendor access is the one most often left open. A support account created for an integrator three years ago, still active, often with broad rights and no MFA. Time-bounded, logged, least-privilege access for vendors, reviewed on a schedule.
Wireless security
WPA3 where the estate supports it, WPA2-Enterprise where it does not, with certificate or credential authentication rather than a shared key. A shared wireless key is known by every person who has ever worked in the building.
Guest wireless on its own segment with client isolation, internet only and a captive portal if you need an acceptance record.
Corporate wireless with device certificate authentication is the arrangement that works, because it ties access to a managed device rather than to a password that travels.
What Namandla delivers
Assessment. Topology and segmentation review, firewall rule analysis, remote access review, wireless security, configuration hygiene and management exposure. Written findings ranked by consequence.
Segmentation design and implementation, phased with fallback at each stage.
Firewall rule review and rationalisation, with an owner and a purpose recorded against every rule that survives.
Remote access design, VPN or published-application, with multi-factor authentication and device compliance.
Wireless security design and deployment.
Configuration management. Backup, baseline comparison, change control and firmware currency.
Monitoring of the things that fail quietly: interface errors, tunnel state, failover link status, configuration drift.
Onsite work is Gauteng. Design, configuration and review run nationally.
Common questions about Network Security
What is network segmentation and why does it matter?
Segmentation divides a network so that devices can only reach what they need to. Servers, users, guests, voice, cameras, access control, building systems and production equipment each sit in their own segment with routing controlled at the firewall.
On a flat network anything with a foothold on one device has a path to everything. Segmentation removes that path and makes traffic visible and separable, which improves troubleshooting as much as security. It is architecture rather than a purchase, which is why it rarely appears on a shopping list despite usually being the highest-value work available.
Do we need a new firewall?
Usually not. The findings we make are almost always in the rule base and the configuration rather than in the hardware. Most firewalls in mid-market environments are capable and under-configured.
A rule review typically removes a substantial share of the rule base and tightens several more, and it takes days rather than weeks. Where the hardware genuinely is at end of support or undersized for the throughput, we will say so and quote it. We would rather fix the configuration you have.
How often should firewall rules be reviewed?
Annually as a minimum, and after any significant project. Rule bases only grow unless something forces a review.
The review looks for rules that have not matched traffic in ninety days, rules shadowed by others above them, rules permitting broader access than their description implies, references to objects that no longer exist, and rules with no recorded owner. Recording an owner and a purpose against every rule is what makes the next review quick.
Is a VPN still good enough?
For many mid-market environments, yes, provided it has multi-factor authentication and preferably a device compliance check. Multi-factor is the part that is not optional.
Zero trust access, where specific applications are published to verified users on compliant devices rather than placing the device on the network, is the stronger architecture and it is a larger change. We assess whether the gain justifies the work in your environment rather than recommending it by default.
What about our cameras and access control on the network?
They belong on their own segments, reaching only their management systems. They are usually the weakest devices present: embedded systems, long patch cycles, default credentials and vendors who will not support firmware updates.
This is one of the more common gaps and one of the easier fixes. The devices themselves rarely need to change. What changes is what they are permitted to reach, and a default-deny outbound policy on those segments removes most of the exposure at no operational cost.
Can you secure our production or plant network?
Segmentation and monitoring rather than patching. Production equipment often cannot be patched because the vendor certified a specific configuration, which makes isolation the compensating control.
The design that works is a clearly defined boundary between operational technology and business systems, with a controlled and monitored path for the data that genuinely needs to cross it. We do not touch production equipment configuration. We control what surrounds it.
How disruptive is segmentation work?
The design and discovery phases are non-disruptive. Implementation is phased, one segment at a time, in planned windows with a fallback at each stage.
The risk is not the configuration, it is the traffic nobody documented. Discovery, meaning actually observing what talks to what before putting a boundary in, is what keeps it uneventful. Rushing that step is how segmentation projects break things and acquire a reputation.
What is the first thing we should do?
An assessment, then usually the firewall rule review and client isolation on the user segment. Both are quick, neither needs a purchase and both change the position measurably.
After that, segmentation of cameras, access control and building systems is normally the next highest return, because those devices are the weakest and the segments are easy to define. Server segmentation comes later because it needs the most discovery.
When is this more than we need?
On a single-site environment of a few dozen devices with no servers, no cameras on the network and no operational technology, a well-configured firewall, WPA2-Enterprise wireless and MFA on remote access covers most realistic exposure.
Segmentation earns its cost where there are systems worth separating. If everything on your network is a laptop and a printer, there is not much to divide. We will tell you when that is where you sit rather than scoping a project around it.