Why Flat Networks Make Breaches Worse

A flat network can look simple on a diagram: one switching environment, a broad shared address range and few meaningful barriers between devices. It may even appear to work well—until something goes wrong. When an attacker compromises one laptop, a contractor plugs in an unknown device, or a misconfigured switch creates an unexpected connection, that simplicity can turn a small incident into a business-wide problem.

The issue is not merely that a flat network has too many devices. It is that those devices can often communicate with one another with little restriction. That makes network containment harder, increases exposure to unwanted east-west traffic, and can give an intruder more opportunities to move from an initial foothold to valuable systems.

After more than a decade working across office fit-outs, corporate IT, operational technology (OT) and incident response, I have seen security plans undermined by very ordinary things: a switch nobody knew was there, a patch-panel port with no label, or a cable path that did not match the documentation. Physical infrastructure is not separate from cybersecurity. It is part of the system the security controls rely on.

What is a flat network?

A network is often described as “flat” when many devices share the same, or very broadly connected, network segment without effective controls between groups. They may be in one large broadcast domain, or spread across several VLANs that are not meaningfully isolated because routing rules allow almost everything through.

A broadcast domain is the part of a network in which a broadcast message can be heard by participating devices. Large broadcast domains can add noise and operational complexity, but the bigger security concern is often the lack of well-designed boundaries around who can communicate with whom. A VLAN label alone does not create security: the design also needs capable switching, controlled routing and rules that match the organisation’s requirements.

In a well-segmented environment, a standard user workstation should not automatically be able to reach every server, building-management controller, printer and production device. In a flat environment, it may be able to try.

Why a breach spreads further on a flat network

One compromised device can become a launchpad

Attackers commonly begin with a single point of access: a stolen password, a compromised endpoint, a malicious attachment or an exposed remote-access service. What happens next depends partly on the controls around that foothold. If the device can freely reach other systems, the attacker may be able to probe for services, discover hosts, exploit weak configurations or attempt to reuse credentials elsewhere.

This is where uncontrolled east-west traffic matters. “East-west” describes communication between systems inside an organisation’s network, rather than traffic entering or leaving it. Perimeter firewalls can help manage north-south traffic, but they cannot, by themselves, contain movement between internal devices if those devices are broadly reachable.

Network containment means limiting the spread and impact of an incident. Segmentation helps achieve that by restricting pathways, so that a compromised workstation does not have unrestricted routes to administrative systems, sensitive databases or OT equipment. It does not prevent every breach. It can, however, make lateral movement more difficult, reduce the number of exposed systems and give responders more options.

Detection becomes noisier and less reliable

Endpoint detection platforms provide valuable visibility into activity on managed endpoints. They can alert on suspicious behaviour and help investigators understand what a device did. But endpoint monitoring is not a replacement for network design. Some https://www.cyberdaily.au/strategy/14271-why-physical-network-infrastructure-is-the-overlooked-foundation-of-your-cybersecurity-strategy devices cannot run an agent; others may be unmanaged, out of support or outside the IT team’s control. A noisy, poorly understood network can also make unusual activity harder to distinguish from routine traffic.

In a flat network, there may be many legitimate-looking paths between devices. That makes it harder to define what “normal” means, and harder to spot when a printer, user laptop or engineering workstation starts communicating with systems it has no operational reason to contact. Visibility tools are most useful when the network is documented and expected communication patterns are reasonably clear.

Containment can disrupt more than the incident

During an incident, responders may need to isolate a device or restrict a network segment. If everything shares a broad environment, isolating one affected area may also interrupt unrelated teams or critical services. That creates a difficult choice: act quickly and risk a wider outage, or delay containment while investigating dependencies.

Segmentation makes the options more precise. Responders can potentially quarantine a workstation group, restrict access to a particular server tier or isolate a site without cutting off the whole organisation. What happens at 2am when this fails? If the only containment plan is to unplug a switch and hope for the best, the architecture has not given the response team enough safe choices.

The physical layer is part of cybersecurity

Logical controls depend on the physical network beneath them. Switches, patch panels, fibre links, cabinets and wireless access points determine how devices are connected and where traffic can flow. Treating cabling as “just plumbing” misses the security implications of the infrastructure carrying every connection.

Physical-layer faults can create both outages and security blind spots. A mispatched cable could connect a device to the wrong network. An unapproved desktop switch could bridge several endpoints into a part of the network the design did not anticipate. A failed fibre link might cause traffic to take a different path, or prompt someone to make an emergency change that is never properly recorded. An unknown device in a comms cabinet can be both an operational risk and an access point.

These problems are not solved by buying more monitoring software. They need accurate records, controlled access to comms spaces, suitable equipment, change management and people who understand the physical layout. Unlabelled patch panels and mystery cables are security smells because they make it harder to verify what is connected, investigate an incident and change the network safely.

During a fit-out or remediation, the details matter: label both ends of cables, record switch ports, document uplinks and confirm that the installed design matches the approved one. Keep an asset inventory that includes switches and other network equipment—not just servers and laptops. A label maker is inexpensive; trying to reconstruct a patch-panel map in the middle of an incident is not.

Segmentation relies on capable switching and sound design

Good segmentation is a combination of architecture and implementation. It starts by identifying the different types of devices and the communications they genuinely need. Typical boundaries might separate user endpoints, servers, management interfaces, guest access, printers, building systems and OT. The right zones depend on the organisation; the principle is to avoid granting broad connectivity by default.

That design must be supported by equipment that can enforce it consistently. Managed switches, correctly configured VLANs, access controls and controlled routing are important building blocks. Vendors such as Cisco and MOXA serve different parts of the enterprise and industrial networking landscape; the specific product matters less than confirming that it supports the required features, is configured securely and can be maintained over its full life cycle. In environments that need ruggedised or industrial equipment, MOXA products may be one option to assess alongside the operational requirements.

Where network visibility or traffic-control options are limited, tools such as firewalls can help define permitted communication between zones. But a firewall rule set is only as good as the network paths and asset information behind it. Rules need an owner, a business purpose and regular review. “Allow any” rules left in place to make a migration easier can quietly undo the intended separation.

Network area Example boundary Security benefit User endpoints Allow access only to approved applications and services Limits direct reachability from a compromised workstation Server environment Restrict access by application role and management need Reduces unnecessary east-west traffic between servers Network management Use a dedicated, tightly controlled management path Helps protect switches and other infrastructure from ordinary user devices OT and building systems Permit only documented, required connections Reduces exposure of systems that may be sensitive to disruption

ACSC guidance starts with foundations

The Australian Cyber Security Centre (ACSC) publishes guidance to help organisations reduce cyber risk, including advice relevant to network security and system hardening. That guidance is most effective when the underlying environment is understood and controlled. You cannot reliably apply access restrictions to assets you do not know exist, or assess network exposure when the physical and logical diagrams disagree.

Foundations include maintaining an accurate inventory, limiting unnecessary access, keeping network devices securely configured and reviewing how systems communicate. Segmentation should be based on risk and operational need, not simply on a desire to create more VLANs. In OT environments, changes also require careful consideration of availability, safety and vendor support. A control that is sensible for an office laptop may be inappropriate for a controller that must remain available.

ACSC guidance should be read in its current form and applied to the organisation’s context. It is not a substitute for engineering judgement, testing or a clear understanding of what will happen if a link, switch or security control fails.

How to improve a flat network without breaking the business

Segmentation does not need to begin with a sweeping redesign. A staged approach can reduce risk while keeping changes manageable:

1. Discover what is connected. Reconcile switch data, endpoint inventories, network scans and physical inspections. Identify unmanaged switches, unknown devices and undocumented links.
2. Map essential communications. Work with application owners, facilities teams and OT engineers to record which systems need to communicate, in which direction and for what purpose.
3. Prioritise high-risk boundaries. Start with areas where unrestricted access would have the greatest impact, such as administrative interfaces, critical servers and sensitive OT systems.
4. Design and test the controls. Plan VLANs, routing and firewall policies together. Test required services and failure scenarios in a controlled way before enforcing restrictions widely.
5. Monitor and review. Use network logs and endpoint detection platforms to check that controls work as intended, investigate unexpected traffic and refine rules without creating permanent exceptions.
6. Keep the physical record current. Label cables and ports, document changes and control access to comms rooms. Make updating the diagrams part of the change process, not an optional task for later.

For each change, ask what happens at 2am when a link fails, a switch needs replacing or an application stops communicating. Ensure the on-call team can identify the affected segment, understand dependencies and use a recovery path that does not require guessing. Good network containment is not only about blocking an attacker; it is also about giving operators a safe, practical way to respond.

Security boundaries make incidents smaller

A flat network gives a foothold too many possible directions. It can turn one compromised endpoint into a route towards systems that should never have been reachable from it, while making investigation and emergency isolation more disruptive. Segmentation, sound access rules and useful monitoring help reduce that risk—but only when they match the real network.

Physical infrastructure is part of that security story. Capable switching, well-planned boundaries, documented cabling and controlled changes make it possible to know what is connected and to limit where traffic can go. Build those foundations, and firewalls and endpoint detection platforms can do their jobs with clearer context and fewer blind spots. Leave them out, and even a sophisticated security stack may be trying to protect a network nobody can accurately describe.