Solved Your manager asks you to set up a secure network | the kind of task that arrives as one sentence in an email and hides a week of decisions. A small office of ten to fifty people needs the same structural elements as a corporate campus, only scaled: a router that does real firewall work, separated network segments, Wi-Fi that does not leak keys, and updates that happen without anyone remembering them. This guide walks the build in the order you would actually execute it.

Start from the threat model, not the gear list

For a small office the realistic threats are boring and consistent: phishing against staff, an unpatched device becoming an entry point, a guest plugging a laptop into the corporate segment, and a router still wearing its factory password. A secure network design answers each of those with structure rather than heroics. Write the four threats on the whiteboard; every later decision maps back to one of them.

The output of this stage is a one-page plan: which segments exist, who administers what, and what happens when a device is compromised. The plan is also what your manager wants to see, because it converts an IT task into a business document.

Segmentation: the decision that matters most

A flat network means one compromised device can reach every other device. VLAN segmentation fixes this cheaply on any managed switch. The minimum useful split is three networks: corporate for work machines and servers, guest for visitors and personal phones, and IoT for printers, cameras, thermostats and anything with a radio you do not control. IoT and guest segments get no route into corporate; that single rule stops most lateral movement.

The router enforces the boundaries with firewall rules between segments. Default-deny inbound to corporate from guest and IoT, allow outbound so devices still reach the internet, and log what is blocked for the first month. The logs will surprise you, usually with a smart TV probing the whole address space.

Wi-Fi without footguns

Wi-Fi settings carry more mistakes per minute than any other stage. Use WPA3 where devices support it and WPA2-AES as the compatibility floor; never WEP, never TKIP. The corporate SSID gets a long passphrase or, better, per-user credentials via WPA2-Enterprise on a RADIUS-capable access point, so one departure does not force a rekey of the whole office. The guest SSID is separate, isolated from the LAN, with client isolation on, and a password that can rotate freely.

Disable WPS on every access point, it is a well-known bypass, and turn off remote administration on the router and APs so management only works from inside the corporate segment or a VPN.

The device layer: patching and access

Network security decays into theatre if endpoints rot. Enforce automatic operating-system updates on every work machine, enable full-disk encryption, and require screen locks. Multi-factor authentication on email and any admin console is the single highest-value control available to a small office, because credential theft against cloud mail is the most common intrusion route.

Password policy should be length over complexity: passphrases of several random words beat short strings of symbols, and a password manager removes the temptation to reuse. Admin accounts stay separate from daily-driver accounts, so a phishing hit on the normal account does not hand over the keys.

Remote access done properly

Working from home means a path back in. Do not port-forward RDP or any service straight to the internet; the scanning is constant and automated. Run a VPN on the router or a small appliance, require MFA on it, and make remote users traverse the same firewall rules as office devices. Modern alternatives such as WireGuard-based setups or identity-aware proxies reduce the attack surface further by never exposing a listening service at all.

• VPN concentrator on the edge device, MFA enforced, strong cipher suites only.
• No published internal services: everything arrives through the tunnel.
• Split-tunnel off for corporate traffic, so remote sessions follow office policy.
• Revoke access the day someone leaves; the revocation step belongs in the offboarding checklist.

Monitoring you can actually keep up with

A fifty-person office cannot run a security operations centre, but it can keep three habits: centralise router and server logs to one machine, review weekly; keep an asset inventory of every device allowed on corporate, and notice newcomers; and test backups quarterly by restoring a file. Backups are the control that survives everything else failing, including ransomware, which is why they belong in a network security guide.

Handing the result back to your manager

Finish with documentation: the network diagram with segments, the device inventory, the admin account list, the update schedule and the incident steps in plain language. That document is the difference between a personal setup and an institutional one, and it is what gets read when you are on holiday. Vendor subscriptions and support terms change, so note where to check the current terms of every service the design depends on. For the hardware side of a small-office rebuild, the SSD upgrade guide and the Personal Computer section cover the machine layer that sits behind this network.

Bottom line

A secure small network is structure plus hygiene: three segments with deny-by-default between them, strong modern Wi-Fi split into corporate and guest, MFA and patching on every endpoint, VPN-only remote access, and backups that have been tested. None of it needs an enterprise budget; all of it needs the one-page plan you wrote before buying anything.