(updated to (hopefully) be less broad)
No matter how well one secures a network there's always the chance of an attacker gaining access. In a shared home + home office network (eg. for a remote worker and their family) there is considerable risk of this from friends and family using the network insecurely or on potentially compromised devices.
For lack of better terminology I'll refer to two types of users of the network:
- Guests - (typically transient) users who only need access to WAN, not LAN.
- Privileged users/devices - those who are consistent/persistent users and need to communicate with other devices on the LAN. For example, a remote worker and their direct family.
Now, let's assume the following:
- Insiders "going rogue" isn't a concern.
- I assume that the attacker therefore would not have any prior knowledge of the network setup beyond what can be obtained prior to breaking in.
- WiFi is used both by guests and privileged users for mobile devices and laptops.
- Privileged devices on WiFi would like to be able to communicate securely with other privileged devices (both wired and wireless) and vice versa.
- Guests sometimes connect via the wired connection as well (eg. using an Ethernet port in a guest room).
- The WiFi can't be trusted to be encrypted since not all privileged users can be trusted to not inadvertently leak the password.
- The network includes some LAN services such as shared printers, a file server/NAS, etc. Assume that they have appropriate authentication/authorization enabled (passwords, SSH keys, etc.)
- The network does not include any publicly accessible services (eg. no web servers accessible from the internet).
I can see two ways for an attacker to gain access to the network:
- Via a device they have access to being added as a guest device (eg. by cracking the WiFi, or having compromised a guest's device). In this case they presumably haven't (yet) gained access to any privileged devices or passwords or secrets used by privileged devices or LAN communication.
- By compromising a privileged device. In this case they presumably now have or can gain access to any secrets used on or by the device.
What threats do these scenarios present and how can they be mitigated via network setup? (Mitigating them via antivirus etc. is a whole different can of worms)
Note: the use case I'm interested in is for remote workers running shared home + home office networks - solutions that can be implemented by someone who is proficient technically but not necessarily in networking would be preferred.