Network security has a reputation for being complicated and expensive. In reality, the controls that prevent the overwhelming majority of real-world incidents at hotels, offices and institutions are neither. They are basics - done consistently. Before anyone talks to you about advanced threat detection, make sure these fundamentals are actually in place.
Segmentation: keep traffic in its lane
The most important security control on any shared-use network is separation. Guest devices, staff laptops, payment terminals, cameras and door controllers should each live in their own VLAN with firewall rules between them. The test is simple: from a guest device, can you ping a printer at reception, see a camera, or reach the PMS server? If yes, one compromised phone in the lobby is one step away from your most sensitive systems.
- Guest network: internet-only, client isolation on, no path to anything internal.
- Payment/POS: its own segment with an explicit allow-list - nothing else talks to it.
- IoT and cameras: quarantined; these devices are patched rarely and trusted never.
- Staff and back-office: separated from each other where roles differ.
RADIUS: know who is on your network
A shared Wi-Fi password written on a whiteboard is not access control - it is a rumor. Once it leaks (and it always leaks), you cannot revoke it without re-keying every device. RADIUS-backed authentication (WPA2/WPA3-Enterprise) gives every user or device its own credential. When an employee leaves, you disable one account. When a device misbehaves, the logs tell you exactly which one, on which AP, at what time. For properties, the same RADIUS layer powers per-room and per-conference access with individual limits.
A firewall policy you can explain
Most firewalls we audit have accumulated years of rules nobody remembers adding. Rules like "temporary - allow all, added 2021" are how breaches happen. A healthy policy has three properties:
- Default deny. Everything is blocked unless explicitly allowed.
- Every rule has an owner and a reason. If nobody can explain a rule, it gets removed.
- It fits on a page. If your rule set needs a scroll bar measured in minutes, it needs a cleanup, not a bigger firewall.
If you cannot explain your firewall policy in five minutes, you do not have a policy - you have an archive.
Close the doors nobody watches
Beyond the big three, a handful of quiet wins dramatically shrink your exposure:
- Change default credentials on every switch, AP, camera and controller. Default passwords are the first thing any attacker tries.
- Disable unused switch ports, especially ones in public areas - an open wall port is an open invitation.
- Patch network gear on a schedule, not only when something breaks.
- Back up configurations so recovery after a failure or mistake takes minutes, not days.
Logs you will actually read
When something goes wrong, the first question is always "what happened, and when?" Without centralized logging, the answer is guesswork. Ship logs from your firewall, controllers and RADIUS server to one place, keep at least 90 days, and set up a small number of alerts that matter: new admin logins, VPN connections from unexpected countries, and devices joining restricted segments. Ten meaningful alerts beat ten thousand ignored ones.
Where to start
If none of this is in place, don't try to do it all at once. Segment first, fix authentication second, clean the firewall third. Each step independently reduces risk, and the order matters: segmentation limits the damage of everything you haven't fixed yet.
Want a clear picture of where your network stands? Book a security review with Orbit - we'll map your current exposure and give you a prioritized, practical plan.
