How do I protect myself from other computers on my local network?
Hi, everyone. Leo Notenboom here for Askleo.com.
Let's dive right into the question.
"We're a family where the adults use
the Internet for serious reasons, but we can't take a chance on having our
children screw things up intentionally or by accident.
How should we set up our home network?"
This is actually a very, very good question.
It's something that I think a lot
of people don't think about and perhaps take for granted kids these days.
Right.
On one hand, you can't necessarily trust them always.
On the other hand,
they're the ones you might end up going to for technical help when you need it.
In this case, however, this honestly applies to way,
way more than just the kids you have in your house.
It applies to any of the devices or
visitors you have in your house that you might not trust.
So let's take a look at what it means
to trust something we're going to group our technology into.
I'll call it three buckets.
The first, of course, areof the computers you trust.
These are the ones that you either have control over.
You know, the security is set up properly
and of course, you yourself use in a secure fashion.
It would also include the computers
of others in your household who you feel also fall into that same category.
They keep their machines up to date.
They know how to use things safely and so on.
They are not the individuals that would concern you about potentially doing
something wrong and putting your entire local network at risk.
There's computers you don't trust,
those are the computers of in the question, of course, the kids,
but it actually also includes the computers of any of your guests
that you may not really know what their technological savvy is.
It would be nice if there were a way
that you would not have to make any assumptions about their ability to stay
safe and rather be able to easily protect yourself from them.
The third bucket is, I think, a new one.
It's the devices that you're unsure of.
In recent years, we've all been adding
a lot of what have been called Internet of Things to our local networks.
I have doorbell's, I have power switches, I have smart speakers.
All of those things connect to the Internet
and there's questions about just how much you should trust them.
A lot of people feel strongly that bottom line is you shouldn't.
So what do we do?
Well, there are a couple of ways, depending on the hardware you have
available to you and just how smart that hardware is.
The first and honestly,
the one that I recommend as your go to solution, if you do nothing else,
is a router that supports what is referred to as guest access.
Now, we start, of course,
with a standard network where there's a barrier between the trusted computers
on one side and the untrusted computers on the other, which typically,
if all you're using is a simple router and nothing else,
then it's the Internet that's untrusted and all of your machines are trusted.
When we introduce this guest network,
what we're actually doing is splitting the trusted side in half yet again.
On one side are the computers you trust, the ones you use,
and the ones used by those trusted individuals I talked about earlier.
On the other side is this guest network that is automatically created by your
router, but isolated from the devices on your trusted network.
Now, the downside here, besides requiring a router that supports
this, is that guest networks are typically wireless only.
So if you have wired devices that you don't trust, this may not be a solution.
But it's perfect when the kids have Wi-Fi
or your guests are coming over and simply ask to use your Wi-Fi.
In fact, you could even leave that guest network on password protected if you're so
inclined, depending on your situation, just to make it easier for them to connect
and potentially choose that over your more secure network.
But that's actually a really good base level of security that protects what you
have from everything else that might not be quite as trusted yet.
Still wants to share your Internet connection.
Now.
The other, approach that requires the cooperation of your ISP,
is to get two networks. That could be as simple as getting two IP addresses
from your ISP across the one connection you have, and then using a switch
to connect two separate routers to two separate networks in your house.
One network would be the fully trusted network and the other network would be
the untrusted or less trusted network that could be wired.
It could be wireless and it could provide you with all of the same security we
talked about in that guest network scenario.
The two networks do not see each other.
They simply don't.
They are completely isolated from one
another and therefore protected from one another.
Now, getting to IP addresses or even
getting a second Internet connection, of course, requires additional expense.
It requires the cooperation of your ISP.
Sometimes it's simply not reasonable.
Another approach, yet another approach is to use a second router.
This gets a little bit more complicated.
But as you'll see in the diagram, what we're doing is we're connecting one
router directly to the Internet and it provides a what we'll call less
trusted network to which your guests and your kids can connect.
You then use a second router connected to that first router that further isolates
you from everything that is, quote unquote, upstream.
So the pieces you have in your trusted
network at the bottom are isolated from the PCs or whatever's
happening on those PCs in that less trusted network in the middle.
And of course, everybody's protected
from all the havoc that's happening over on the Internet.
Now,
that is probably I don't want to say the most pragmatic solution,
but it is a solution that a lot of people gravitate towards because they often have
a second router and the other solutions of getting a new
router that supports guest access to the degree they need it supported or
coordinating something with their ISP is just out of the question.
Now, I do have to talk a little bit about
the Internet of Things, all those devices that I talk about
that we really just don't know how secure they are.
We'd love to be able to assume that they're secure.
But in recent months, recent years,
we've learned that that ain't necessarily the case.
The recommendation for most security
experts is that you separate them out on their own network.
That can be a guest network.
It can be an untrusted network, as we've set up already.
And honestly,
do you really need them?
I don't necessarily mean
the things you actually use, I use my smart speakers,
I use my smart doorbell's, I use the smart light switches I have
installed, but I have them on the less trusted network.
What I mean by do you really need them?
Is smart TVs.
My smart TVs could be connected to the Internet.
They're not
there's no reason for me to have them connected to the Internet because I don't
use any Internet enabled features on those devices.
Why connect them if that connection isn't going to be used?
In fact, why connect them if that connection could be misused somehow?
So think carefully about what devices you have that connect to the Internet.
Think about whether they need to be connected to the Internet.
If they do,
consider whether connecting them to an untrusted network would be
sufficient, because if it is, it's much safer.
And absolutely think twice about
connecting them to your trusted network if you have to.
For some reason, you may need to take some
additional steps, like making sure your own computers firewall is up to snuff.
For more on this topic,
for more background information, for the diagrams that you've been seeing,
for updates, for related information, for comments and more, visit Askleo.com/3505.
I'm Leo Notenboom.
This is Askleo.com.Thanks for watching.