Home office and Wi-Fi
Your office is only as safe as the cheapest gadget on your Wi-Fi
If you work from home, your customer data and your books share the network with the kids' tablet, the games console, the doorbell and every visitor's phone. One wrong download and the door to your work is open. Luckily a few settings fix it.
What it usually looks like
One big network, or four small ones
On the left, how most homes look: everything on the same Wi-Fi. On the right, how it should be. Everyone has the internet, but the kids' tablet can't reach your books and the doorbell can't reach your laptop.
Your router
- Your work laptop
- NAS with your backups
- Printer and scanner
- Your business phone
- The kids' tablet
- Your son's gaming PC
- Your partner's laptop
- A visitor's phone
- Smart doorbell
- Smart TV
- Smart thermostat
Your router
Work
- Your work laptop
- NAS with your backups
- Printer and scanner
- Your business phone
Family
- The kids' tablet
- Your son's gaming PC
- Your partner's laptop
Guests
- A visitor's phone
Smart devices
- Smart doorbell
- Smart TV
- Smart thermostat
An evening at home
How one free cheat costs your customer money
Made up, but every step happens in real life. Read it from left to right.
- 19:40
Your son wants a free cheat for his game. The virus scanner complains, so he turns it off for a moment.
- 19:41
The cheat hides a bit of malware that pulls saved passwords out of the browser. Including your business e-mail, which you opened on that PC 'just once'.
- + 1 week
Someone logs in to your e-mail. They read along and wait patiently.
- + 3 weken
Just as your customer expects a big invoice, 'you' e-mail them: our bank account has changed.
- + 3 weken
The customer pays. The fraudster. And you look at each other.
Work on work devices, the family on the family network and two-step verification on your e-mail. Then this evening ends with nothing worse than a talking-to.
Game
Who goes where?
Put every device in the right network. After each choice you see why.
Work
Your work laptop, the printer and the NAS with your books. Only things you look after yourself.
Family
The family's phones, tablets and laptops. They can reach the internet, but not your work.
Guests
For visitors: the internet and nothing else. Handy for anything you don't know.
Smart devices
TV, doorbell, camera, thermostat. They talk to their own app and need nothing else.
Your work laptop
Show the answer
Work. Your customers, quotes and books live here. It belongs in the work network, away from anything you don't manage yourself.
NAS with your backups
Show the answer
Work. Your backups above all must stay out of reach of an infected tablet or games console. Otherwise ransomware simply encrypts them too.
Printer and scanner
Show the answer
Work. You scan invoices and ID documents with it. It belongs with your work, so only your work devices can reach it.
Your business phone
Show the answer
Work. Your business e-mail and your login codes are on it. Treat it just like your work laptop.
The kids' tablet
Show the answer
Family. Games and 'free' extras end up on here. Fine, but in the family network: there a bad download can't reach your work.
Your son's gaming PC
Show the answer
Family. Game mods and cheats are a well-known way to bring in malware. In the family network the damage stays with the games.
Your partner's laptop
Show the answer
Family. A normal, perfectly good device, but not one you manage. The family network is enough.
A visitor's phone
Show the answer
Guests. You don't know what's on it. The guest network gives internet and nothing else, and you don't have to share your own password.
Smart doorbell
Show the answer
Guests / Smart devices. It only talks to its own app. If an attacker gets in through a flaw, at least they are not sitting next to your books.
Smart TV
Show the answer
Guests / Smart devices. You have little control over a TV's software. Putting it apart costs nothing and prevents a lot.
Smart thermostat
Show the answer
Guests / Smart devices. Handy, but you can't see what's inside. Give it its own network with just the internet.
How it feels
Wednesday, 21:05
Based on a real case; names and details changed.
- Mark (freelancer, works from home)
Lotte, my bookkeeping app e-mailed me that someone logged in from abroad. I'm just sitting at home.
- Lotte (IT partner)
Not good. Who uses that computer?
- Mark (freelancer, works from home)
Me, for work. And Daan, for gaming. He downloaded a really cool Minecraft mod the other day.
- Lotte (IT partner)
From the official site?
- Mark (freelancer, works from home)
No idea. From a site with loads of mods.
- Lotte (IT partner)
There are mods going round that pull every saved password and cookie out of your browser. Your work ones too.
- Mark (freelancer, works from home)
But I've got a password, haven't I?
- Lotte (IT partner)
So have they, now. Grab your phone or another computer and change your e-mail password first, then your bookkeeping and your bank. Log out everywhere and turn on two-step verification.
- Mark (freelancer, works from home)
And the computer itself?
- Lotte (IT partner)
I'll check it tomorrow. And after that Daan gets his own gaming corner on the guest network, and your work PC is yours alone.
Sorted in an afternoon
How to make your home network safe
- Router: a new, long admin password and automatic updates on. No more updates for it? Then it's time for a new one.
- Wi-Fi: WPA3, or WPA2 with AES, and a long password. WPS and UPnP off.
- Guest network on, for visitors and for devices you don't trust.
- Work apart: a network of its own (a VLAN) for your work laptop, your printer and your NAS.
- Smart devices apart: TV, doorbell, camera and thermostat don't need to reach anything else.
- No open ports for 'working remotely for a bit': use a VPN or a secure tunnel.
- Work devices: updates, an encrypted disk and an account of their own. Not shared with the family.
A VLAN sounds complicated, but it's simply a separate network over the same cables and the same Wi-Fi point. Your work and your family share the internet, but can't see each other. Many routers can already do it; we set it up for you.
It really happened
It started at home and went wrong at work
Click for the summary and the link to the full story.
Questions
Questions about the home network
Do I need a new router for this?
Often not. Almost every router can do a guest network. For a separate work network (a VLAN) you need a router or access point that supports it; we first look at what you already have.
Isn't a guest network enough?
It's a fine start, especially for visitors and smart devices. If you work with customer data, a separate work network gives extra peace of mind.
My kids sometimes use my work laptop. Is that bad?
Better not. Give them their own account or their own device. What they download doesn't belong on the laptop with your books.
Can you set it up remotely?
Partly. For the router and the Wi-Fi we'd rather drop by; you can book it by the hour in the shop.
Press play
Work and home apart, without the hassle
We check what your router can do, separate your networks and put your NAS and backups in the right place.