Network administration

The network is the substrate everything else assumes works. It gets attention when it fails and is otherwise expected to be invisible, which is why its design debts persist for years.

Segment by trust, and mean it

A flat network means one compromised laptop reaches the finance server. Segmentation is the highest- value structural control available and the most commonly deferred.

Separate at minimum: user devices, servers, management interfaces, guest, and anything unmanaged — printers, cameras, building systems, contractor equipment. That last category is the recurring entry point, because it is rarely patched and rarely owned.

Default deny between segments, and permit specific flows. Rules that accumulate without review become an allow-all with extra steps; review them on a cadence and remove what no longer has a reason.

Remote access