Networks are the plumbing of modern digital life — they carry every piece of data between your devices and the internet, between office computers and the cloud, between smart home devices and their cloud services. Understanding network security basics isn’t a specialist skill reserved for IT professionals. It’s the foundational knowledge that lets anyone make informed decisions about how their home or small business network is configured, what devices are connected to it, and what threats they face. You’ll find the complete rundown in our Complete Guide to Online Security and Privacy.
The principles apply at every scale — from a single-person home network to a small office with a dozen workstations. Implementation scales with the number of devices and the sensitivity of the data; the underlying controls are the same.
Understanding what you’re protecting
Most home networks consist of an ISP-provided modem/router combination (or a separate modem plus consumer router), wireless access points, and the devices connected through wired ethernet or WiFi. The router is the gateway between the local network and the internet — the most security-critical piece of infrastructure, and therefore the first focus of any network security review.
Every device on the network has an IP address and can potentially communicate with every other device on the same network. A compromised smart TV can attempt to access a network-attached storage drive; a compromised laptop can attempt to access other computers. Network segmentation — separating devices into different segments that cannot directly communicate — is the control that limits this lateral movement.
ISP-provided modems/routers often have weaker security defaults than consumer routers purchased independently — default credentials shared across hundreds of thousands of deployed units, less reliable firmware updates, and sometimes remote access backdoors for the ISP’s management use. For users with ISP-provided equipment: check whether the device can be set to “bridge mode” (handing routing to a separate consumer router). Our guide on securing your home WiFi network covers the router-level configuration in detail.
The step-by-step network audit
- Identify every device on the network. Log into the router admin panel (typically at 192.168.1.1 or 192.168.0.1) → review the connected devices list. Every device should be identifiable. Unknown devices could be neighbours using your WiFi (password too weak), forgotten devices, or in rare cases intruders. This inventory is the foundation that all subsequent checks build on — run it annually and after any new device is added.
- Change the router admin credentials. The admin panel defaults to “admin/admin” or “admin/password” on most devices. Any device on the local network can attempt to log into the admin panel. Change the admin password to a strong unique password stored in the password manager before any other configuration.
- Verify WiFi encryption is WPA3 or WPA2-AES. Router admin → Wireless settings → Security mode. WPA3 is the current standard; WPA2-AES is acceptable with a strong password. WPA2-TKIP and WEP are insecure and breakable with widely available tools — replace them immediately.
- Update router firmware. Router admin → Advanced → Firmware update → check for updates. Install any available updates. Firmware patches known vulnerabilities that attackers actively scan for on routers that haven’t been updated in years.
- Disable UPnP. Universal Plug and Play allows devices to automatically open ports on the router — a feature repeatedly exploited to expose internal services to the internet without the user’s knowledge. Disable it unless a specific application genuinely requires it. Most consumer applications work correctly without it.
- Create a guest network for IoT devices and visitors. Isolates IoT devices and guest users from primary network devices. This is a standard configuration, not an advanced option.
- Disable remote management. Router admin → Advanced → Remote Management → Off. When enabled, the admin panel is exposed to the internet. Disable unless you specifically need external access.
Encryption and DNS protection
Beyond the router configuration, three controls at the traffic layer address the most common passive surveillance and interception risks:
HTTPS protects web traffic content between the browser and web server. Network security basics include ensuring the browser has HTTPS-only or HTTPS-everywhere settings enabled — this upgrades connections to encrypted form automatically. An ISP or network operator can see which domains are accessed (through DNS queries and SNI data in TLS handshakes) but cannot read encrypted HTTPS content. Our guide on securing your browser covers the specific browser settings.
DNS over HTTPS (DoH) encrypts DNS queries — the lookups that resolve domain names to IP addresses. Without DoH, every domain the network visits is visible to the ISP in DNS query logs. Enable DoH in the browser (Chrome: Settings → Privacy → Security → Use Secure DNS → Cloudflare or NextDNS) or at the router level for routers that support it (Eero, some OpenWrt-based routers).
VPN at the device level or router level encrypts all traffic between the device and the VPN server — providing network-level privacy beyond what HTTPS and DoH address on their own. Most relevant on untrusted networks (public WiFi) rather than at home where the router controls the network perimeter.
Network monitoring — intrusion detection basics
| Monitoring approach | What it detects | Complexity | Suitable for |
| Router admin panel — connected devices | Unknown devices joining the network | Low — built-in to any router | All home and small office networks |
| Router traffic graphs | Unusual bandwidth spikes suggesting data exfiltration or botnet activity | Low — built-in on most modern routers | Home users wanting basic visibility |
| Pi-hole with query logs | DNS queries to unusual domains from any network device | Medium — requires Raspberry Pi setup | Technically inclined home users |
| Dedicated IDS (Suricata, Snort) | Known attack signatures in network traffic | High — requires dedicated hardware and expertise | Small businesses with IT resources |
| Cloud-managed router (Eero, Orbi, Ubiquiti) | Anomaly detection through vendor threat intelligence | Low — managed by vendor | Home users wanting built-in monitoring without DIY |
For most home networks: reviewing the connected devices list monthly and checking the router’s traffic graphs occasionally is adequate baseline monitoring. A bandwidth spike when no obvious activity is occurring warrants investigation — check which device is generating the traffic through the router’s per-device statistics if available, or disconnect devices one at a time to identify the source.
Physical security — the layer most guides overlook
A router physically accessible to guests, household members, or cleaning staff can be reset to factory defaults by pressing the reset button — erasing all security configuration and returning to factory credentials in seconds. Placing the router in a less-accessible location prevents casual physical tampering.
Ethernet ports also represent physical access points. Plugging a device into an ethernet port typically grants the same local network access as a WiFi connection, without requiring the WiFi password. In shared environments (offices, coworking spaces): disable unused ethernet ports in the router or switch configuration. Port access control (802.1X authentication) prevents unauthorised devices from gaining network access through physical ethernet ports. For home users: the simpler consideration is router placement reasonably secure from casual access by guests or children who might accidentally reset it.
Defence in depth — the principle behind the controls
The correct network security posture combines multiple independent layers: router-level controls (WPA3, strong admin credentials, UPnP disabled, guest network), device-level controls (individual device firewalls, automatic updates, screen locks), application-level controls (HTTPS, DNS over HTTPS), and monitoring (device inventory, traffic graphs, breach monitoring).
Each layer addresses threats the others don’t. Router hardening stops network-level attacks. Device updates stop vulnerability exploitation. HTTPS stops traffic interception. Monitoring detects failures in the other layers. No single control should be the sole barrier against any threat — that’s the principle. The goal isn’t an impenetrable network; it’s a network where compromising it requires bypassing multiple independent controls rather than exploiting one misconfiguration.
For CISA’s network security guidance for home users and small businesses, CISA’s home network security resources cover the foundational controls with specific configuration guidance across common router brands. Our guide on the digital security checklist includes network review as part of its quarterly maintenance schedule.
Small business network security considerations
Small businesses have the same foundational controls as homes but with additional requirements:
- Separate network for payment processing: PCI DSS compliance (required for card payment acceptance) includes network segmentation requirements. Payment terminals and the systems they connect to should be on a separate network segment from general office computing.
- Managed switches with VLAN support: provide the network segmentation that consumer routers can only partially achieve through guest networks. VLANs allow fine-grained control over which devices can communicate with which others.
- Centralised logging: small businesses benefit from router or firewall logs being retained and reviewed periodically. Many small business-grade routers (Ubiquiti UniFi, Cisco Meraki, Fortinet FortiGate) include built-in centralised logging.
- Guest WiFi for customers/visitors: completely isolated from internal network resources — not just a separate SSID on the same router, but ideally a separate physical access point or VLAN that has no routing to internal systems.
- Documented network map: knowing what’s connected and where is the prerequisite for everything else. A simple diagram of network zones, key devices, and connectivity is worth maintaining and updating when changes are made.
Network security basics, consistently applied, produce a network that’s substantially more resilient than the factory-default configuration on any consumer router — without requiring specialist knowledge or enterprise tools. The controls in this guide address the majority of practical threats that home and small business networks actually face.
Wireless network security — beyond the password
WiFi security involves more than just the password. Several additional controls reduce the attack surface:
- SSID visibility: hiding the network SSID (not broadcasting the network name) adds minimal security — determined attackers can find hidden SSIDs trivially — but reduces visibility to casual passersby. More relevant for networks in high-density environments (apartment buildings, coworking spaces) where reducing the network’s prominence has some value.
- 2.4 GHz vs 5 GHz security: 2.4 GHz has longer range (it reaches further outside the building) while 5 GHz has shorter range (stays closer to the router). If both bands use the same security settings, the 2.4 GHz band creates more external exposure. Some users configure 5 GHz for sensitive devices and 2.4 GHz for IoT devices on the guest network — the 5 GHz band’s limited range contains IoT devices more physically to the property.
- WiFi 6 and WPA3: WiFi 6 (802.11ax) devices are required to support WPA3 certification since 2021. If the router and all connecting devices support WiFi 6, WPA3 is available without any compatibility concern. Older WiFi 5 (802.11ac) devices may not support WPA3 — a reason to keep WPA2-AES as the fallback mode rather than requiring WPA3-only, which would break older device connections.
- Maximum WiFi transmit power: most routers allow adjusting the transmit power. Reducing from 100% to 50–70% keeps the signal strong inside the building while reducing its reach into public spaces. A narrower signal footprint is a smaller attack surface for wardriving attempts.
Network security for remote workers
Remote workers whose home network connects to corporate systems face a dual responsibility: keeping their home network secure enough that it doesn’t become an entry point for attacks on corporate infrastructure. Corporate security policies often specify minimum home network security requirements — review any policy documentation from the employer’s IT team.
The most relevant additional control for remote work home networks: ensuring the corporate VPN is active before accessing any corporate systems. The corporate VPN encrypts traffic between the home network and the corporate network, making the home network’s security posture less critical for corporate data in transit. But a compromised device on the home network can still interfere with the VPN connection or attempt to intercept credentials entered before the VPN is active — which is why the home network security baseline still matters for remote workers. You might also run into Remote Work Security.
Network security basics form the foundation that everything else builds on. A properly configured router with strong credentials, WPA3/WPA2-AES encryption, firmware updates, network segmentation, and basic monitoring provides a network perimeter that effectively addresses the most common network-level attacks — while remaining straightforward enough to implement and maintain without dedicated IT resources. Related: Secure Home Office Setup.
