Separating guest wifi from the business network: why an SME should keep visitors and devices apart

Why one wifi for everything is a risk

On a flat network, every device can in principle reach every other device. That is convenient for printing, but it also means a visitor’s phone, an old camera with outdated software or an infected personal laptop has the same route to your workstations and shared folders as your own team.

Smart devices are often the weakest point. A camera, a smart thermostat or a meeting room display rarely gets updates, sometimes still runs on the manufacturer’s default password and is watched by nobody. An attacker who takes over such a device is standing right in the middle of your office network.

On top of that comes the password itself. The office wifi password often hangs on a note by the coffee machine and has been shared over the years with interns, technicians, suppliers and former employees. Nobody knows any more who still has access.

Three networks instead of one

For most SME offices a simple split into three networks is enough, each with its own name and its own rules:

• business network: only for employees’ managed laptops, with a strong password you do not hand out and change when someone leaves;
• device network: for printers, cameras, meeting room displays and other smart devices, shielded from the laptops, with only the connections that are really needed, such as printing from the business network;
• guest network: for visitors, flexible workers and personal phones, with internet access only and no view of each other or of other devices.

The separation lives in the network equipment: the router or firewall and the access points block traffic between the networks. A second wifi name without that separation is just another label on the same network.

What to set per network

On the guest network, change the password regularly, for example every quarter, or use a sign-in page with a daily code. Put a limit on bandwidth, so a visitor downloading a large update does not slow down your team’s video calls.

On the device network, replace default passwords, switch on automatic updates where possible and keep a list of what is connected. A device nobody recognises comes off.

The business network is for laptops you manage yourself, with up-to-date software and without local admin rights for employees. Employees’ personal laptops and phones belong on the guest network; they do not need your office network for work email and files, because those live in the cloud.

What to sort out this month

Keep the first step small enough to actually carry out:

• list everything currently on the wifi: laptops, phones, printers, cameras, displays and unknown devices;
• check whether your router and access points support separate networks, or whether replacement is needed;
• create a guest network with internet access only and its own password;
• move printers and smart devices to their own network and test that printing from the laptops still works;
• then change the business network password and give it only to those who really need it.

What not to do on day one: change the business password before the guest network works. Then visitors and half of the devices suddenly have no connection.

How Floor ICT sets this up — and what you decide

Floor ICT maps what is on your network, checks whether the current equipment can handle separate networks and proposes a layout. We then set up the networks, test printing and meeting room displays and record which device belongs where. Changes and faults go through the same contact person as the rest of your IT. Wifi work is done as a project or as an agreed add-on next to the managed service package.

You decide which devices may use which network, how strict the guest network is and whether employees’ personal devices may use the business network. We advise; the trade-off between convenience and protection stays with you.