The real question is not whether someone gets in, but how far they can go once inside. Network topology answers that question.
Done Dynamics runs network security engagements: VLAN segmentation, cutting off lateral movement, content filtering, intrusion detection, access control and the isolation of devices that cannot be patched. For offices, hotels, factories and multi-site businesses — on site around Alanya and Antalya, remotely across Turkey.
The most common thing we still find in the field is a single flat network: the accounting workstation, the production controller, the camera recorder, a guest phone and the backup server all in the same address range, all able to see each other. In that setup the first device compromised becomes the key to the whole organisation. Segmentation is not an expensive investment — it is usually a capability the existing switches already have and nobody uses. Our job is to plan that capability against the actual data flow, enable it in stages, then test and document the result.
The perimeter side is covered on its own page: firewall installation and rule management. In most organisations the two run as a single project.
The layers do not substitute for each other. Each answers a different question, and a missing layer leaves the answer incomplete.
The organisation as seen from outside: the firewall, exposed services, remote access and outbound traffic. Most scanning and automated attack attempts stop here. What it cannot stop is what walks in by invitation — an attachment that was opened, a link that was followed.
The walls inside the organisation. This layer determines how far the damage spreads once a device is compromised. Perimeter defence answers "did they get in"; segmentation answers "how far can they go once inside". The second question is almost always the more decisive one.
Protection on computers, servers and mobile devices: malware detection, disk encryption, patch state. Segmentation stops damage from spreading; endpoint protection makes the initial damage harder to cause. The three layers do not substitute for each other.
The ring that runs horizontally across the layers. Who can reach which resource, who holds administrator rights, what the password policy is, where multi-factor authentication is mandatory. However well the network side is built, one shared administrator account invalidates the whole plan.
This alone determines how far damage spreads once a device is compromised. The place an attacker first lands is almost never the target; they walk to the target from inside. Segmentation is the wall that interrupts that walk.
The eight points below are what we work through, in order, during a segmentation engagement.
Filtering is not only an access policy; it is also the cheapest way to cut off an infected machine from whoever it is trying to reach.
Most malware tries to call home after it lands. Blocking known command-and-control addresses at name resolution turns an incident into an alert. Blocked requests are recorded, and the device they came from is immediately visible.
Closing categories such as gambling, adult content and known fraud sites. Policy can vary by user group and working hours; exception requests are handled in writing and opened for a fixed period.
Guest traffic never sees the corporate network and goes straight to the internet. Bandwidth limits, session duration and client isolation are defined — two guest devices on the same network not being able to see each other is the detail most deployments skip.
Most traffic is encrypted, so how deep filtering goes is a choice. If decryption is used, which categories are excluded (banking, health) and how staff are informed are part of the deployment.
What counts as abnormal differs from network to network, so thresholds do not arrive preset — they are derived from that network own normal.
A device probing other devices on the network in sequence is not normal user behaviour. It is usually the first sign of the reconnaissance phase and comes before lateral movement. Thresholds are tuned and management and monitoring systems are added to the exception list.
Large uploads at midnight, hundreds of sessions opened at an unusual hour, an odd density of requests from a single device. The measure is not a fixed number but that network own normal — which is why a reference period is measured first.
Recognising attempts against published vulnerabilities. Signature sets are kept current, and which signature blocks versus which only alerts is tuned; a false positive can stop a production line.
Repeated failed logins, attempts against usernames that do not exist, the same account appearing from different places within minutes. These alerts become meaningful when combined with network-side data.
A device never seen before joining the network is an event worth knowing about. It is compared against the inventory; an unexpected device lands in the quarantine segment.
A system that reports everything gets muted quickly. Thresholds are tuned together over the first months; the goal is that every alert that arrives is worth looking at.
Where anyone who can enter the building can also enter the network, outside defences matter less. Access control closes that gap, and it can usually be done with existing hardware.
The oldest software on the network usually runs not on the computers but on the devices nobody looks at.
Cameras, printers, access control panels, air-conditioning controllers, smart televisions and production automation devices often cannot be updated. Vendor support has ended, the firmware has been the same for years, or updating risks stopping production. These cannot be ignored, but they can be isolated.
A camera network does not have to reach the internet; if remote viewing is needed, it goes over VPN. A recorder with a port exposed to the outside is the single riskiest configuration we see in the field.
A printer that emails scanned documents holds account credentials and usually still runs with its default administrator password. Separate segment, changed defaults, and only the required ports open.
On these devices an update decision is a maintenance window question and is taken with the vendor. The interim answer is isolation: the device talks only to the system it must talk to and never reaches the rest of the network.
Before separating, you have to know what is there. We produce a list of devices on the network with vendor, firmware version and the person responsible. The inventory exercise itself produces the first findings in most organisations — devices nobody remembers.
Isolation buys time; it is not a permanent answer. A replacement schedule for devices that cannot be patched is planned together with the budget and refreshed at every periodic review.
Businesses providing public internet access in Turkey — hotels, cafes, restaurants, shopping centres, hospital waiting areas — must retain access records for a defined period and preserve their integrity. An office serving only its own employees is assessed differently. The technical side looks simple, but two details are regularly missed: keeping records on a separate collector rather than the device disk, and maintaining time synchronisation. Records that drift make the sequence of an incident unreadable.
This is where data protection law meets the obligation: the access records themselves are personal data. So retention is not kept longer than required, who may read the records is defined, and a privacy notice for guests sits on the network landing page. We write these three as a single policy rather than separately, and deliver it as part of the deployment. We do not give legal advice; we make sure the technical build fits the applicable rules. For hotels and cafes with heavy guest traffic we combine this work with hotspot deployment.
The value of an incident plan is not having to think during the incident. The steps are written in advance and rehearsed.
Who receives the alert, who looks at it outside working hours, and how long it takes to notice a monitoring system that has gone quiet. The first item of an incident plan is not technical: whose phone rings.
Disconnecting the affected device, isolating the relevant segment and stopping the spread. Disconnect rather than power off; evidence held in memory disappears with the power.
Freezing the records, imaging the affected system, building the timeline. Rushed here, both the question of cause and any later legal process are left unanswered.
Which segments were reached, which accounts were used, whether data left the building. If personal data is involved, notification duties are assessed against the output of this step.
Restoring from a clean backup, resetting passwords, closing the gap. The closing report states what worked and which control was missing, and becomes an input to the next review.
Discovery and inventory is fixed-price and can be bought on its own; the output is a report covering the current segment structure, the devices found, open ports and findings in priority order. Implementation is priced against that report — segment count, device count and maintenance window constraints are the main variables. Periodic review and monitoring then run as a monthly service. Taking the report and implementing it with your own team is entirely possible; the document is written for that use. Where hardware is required, it is passed through at cost with no margin added.
Segmentation is about what you would lose, not about headcount. Separating the backup server from the user network in a twenty-person accounting office does the same job as separating the camera network from the staff network in a thirty-camera hotel. Small organisations usually need three or four segments, and existing switches often already support it — an improvement that needs no new hardware. We set the scope together during discovery.
Yes, when it is done in stages. Trying to separate everything at once is risky, so we begin with the most critical separation — usually moving server and backup traffic off the user network. Each step runs in its own maintenance window with a rollback plan, and reachability is tested afterwards. What users notice is usually nothing at all; where something is noticed, the cause is almost always an old application dependency nobody knew about, and those surface during discovery.
Removing an unpatched device from the network is rarely possible; what you can do is place it in a segment where it only talks to the system it must talk to. A camera recorder does not need to reach the internet — remote viewing can go over VPN. A printer default administrator password is changed and only the required ports stay open. These are not stopgaps, but they are not permanent either: a replacement schedule for these devices is planned together with the budget.
With three separations. First, guest traffic never sees the corporate network — its own segment, straight out to the internet. Second, guest devices cannot see each other either; two phones on the same network being unable to reach one another is skipped in most deployments. Third, bandwidth and session duration are limited. If you offer public access, the record-keeping obligation is handled as part of the same deployment; in hotels, cafes and shopping centres we combine this with a dedicated hotspot setup.
Businesses that provide public internet access fall within scope in Turkey — hotels, cafes, restaurants, shopping centres and hospital waiting areas are typical examples. An office that only serves its own employees is assessed differently. Where the obligation applies, access records must be retained for a defined period and their integrity preserved. This intersects with data protection law: the records themselves are personal data, so retention period, access rights and the privacy notice are defined together. We write them as one policy rather than three. We do not give legal advice; we build the technical side so it fits the applicable rules.
It will if it is left untuned, and then nobody looks at it — which is the situation we most often find. So we tune thresholds together over the first months: management and monitoring systems go on the exception list, which signature blocks versus which only alerts is decided, and the network own normal is measured over a reference period. The goal is that every alert that arrives is worth looking at. A falling alert count is reported as a success measure.
Do not power the device off; disconnect it from the network. Powering off a computer destroys the evidence held in memory and makes it much harder to understand how the incident developed. The second step is isolating the relevant segment, the third is freezing the records. For organisations under contract with us, the monitoring alert reaches us directly and we run these steps. Without a contract we can still provide response support, but preserving records in the first hours is critical — on most systems older records are overwritten automatically.
Discovery and inventory takes anywhere from a few days to two weeks depending on the size of the organisation. The output is a report: the current segment structure, the devices found, open ports, the list of devices that cannot be patched, and findings in priority order. Implementation is planned against that report and usually runs in stages — four to ten weeks is a typical range, though maintenance window constraints in production environments can extend it. Periodic review then runs as an ongoing service.
Different but intertwined. Firewall installation and rule management inspects traffic at the perimeter; network security work limits spread on the inside. The same device can do both, but the disciplines differ: one is about the quality of the rule base, the other about network topology. In most organisations the two run as a single project; we describe the detail on both pages.
Related services
Rule set authoring, rule hygiene, taking over undocumented rule bases and change management.
Network design, router and switch configuration, site-to-site VPN, wireless infrastructure and monitoring.
Guest networks, landing pages and record-keeping setups for hotels, cafes and shopping centres.
An independent assessment of whether the segmentation actually holds, with retesting after remediation.
Book a free 30-minute discovery call with our team.
Our network and cyber security work is carried out by a team holding internationally recognised Cisco certification.
Issued by Cisco · Holder: Devrim Tunçer
A certification covering security operations centre (SOC) competency: security monitoring, incident response and analysis of network attacks. It is the foundation we rely on for intrusion detection, log correlation and post-incident response work.
Cisco training certificate · completed January 2023
Covers networking fundamentals: routing, switching, IP addressing and network security. The knowledge base we draw on for enterprise network setup and segmentation.