Keep the guest Wi-Fi away from the business

The problem with one network

A home router makes one network. Everything that joins it, the owner's laptop, the front desk computer, the printer, a patient's phone, the cameras, can see everything else. A guest device carrying malware is on the same wire as your files. A camera with an old firmware bug is a door into the office.

What separation means

Business-grade network gear can run several networks over the same cables and access points, kept apart from each other. The usual set for a small office is four. Staff computers. Guests. Cameras and door readers. Payment terminals. A guest can reach the internet and nothing else. A camera can reach the recorder and nothing else. The computers never share a network with any of them.

Who asks about it

• Cyber insurance applications ask whether guest Wi-Fi is segregated from the business network.
• Card processors expect payment terminals on a network separate from guests and office computers, which keeps the rest of the network out of PCI DSS scope.
• HIPAA risk analyses for a practice should show that patient Wi-Fi cannot reach the computers that hold records.

How it is done

A UniFi gateway, switches, and access points run the separate networks with rules between them. The guest network gets a friendly name and a password you can change any time. The camera network is invisible to guests. The payment terminals get a port on the switch that reaches the processor and nothing else. All of it is visible from one app, so you can see what is connected to which network at any moment.

Signs your office is not separated

• Guests use the same Wi-Fi password as staff.
• The router came from the internet provider or a big box store.
• The cameras join the same Wi-Fi as the laptops.
• Nobody can say what is connected right now.

Our Wi-Fi and network project sets up the separate networks on gear you own, from $2,500 plus hardware at our cost.