Clean!

If company devices and BYOD devices have the same access to the cloud services and data, the point is kind of moot.
If the company devices are managed properly by the company, then isolating them into a "trusted" segment makes sense -- so you need to make sure /only/ those managed devices are ever allowed on it. In a traditional Windows or such environment you'd most easily do it with certificates, but without servers I'm not sure. MAC addresses are easy to spoof though.

In general, I would absolutely segregate IoT devices to an untrusted network, because they're crap at security -- and typically, don't need remotely the same access as humans.

What's perhaps more important is the control between these segments and between the segments and the Internet. I would focus on making sure everything has

1. Proper backups
2. Proper patching
3. Antimalware / antivirus in a way that's centrally monitored, preferably something like Crowdstrike
4. Only allow access to the Internet via a proxy device or service of some sort which does inspection and protection. This makes it a lot harder for run-of-the-mill ransomware and malware to be downloaded in the first place, and for them to reach C&C.
5. And/or in addition to 4) enforce that all DNS is also inspected by a product or service. Basically same point as 4), any "known bad" or suspicious domains get blocked before the device ever gets to them.
6. A service to scrub any links and inspect attachments in email.
7. All the user anti-phishing education, including fake phishing campaigns to educate users.

The problem is that security is hard and expensive, and a lot of best practice stuff probably isn't feasible for small and medium sized companies.

• Invest in a good EDR solution.
• Backups!
• Look in to SASE, or QASB at the very least since all your data/workloads are in the cloud.
• Make sure all insecure protocols are disabled.
• Make sure console connectivity is protected on your devices.
• Implement 802.1x or a NAC solution to make sure unused ports are not able to be used unless authorized.
• If you can't do the above, make sure BPDU guard and DHCP snooping are enabled on your switches.

But probably the most important and most commonly overlooked.... TRAIN YOUR USERS! Spend once or twice a year going over cyber security basics. Teach your users what to look for in phishing and social engineering attacks. Don't just focus on looking for suspicious emails. Teach them what to look for with Vishing. Teach them to verify any non employee that comes to the site. Don't just let some guy in because he has a clipboard (a social engineers best tool). Perform regular phishing tests on your users. Instruct them NOT to forward emails they think are suspect to IT... report the email, but don't forward it.

First suggestion. Don’t over complicate things.

I don’t see a reason to separate cameras and door access. On their own vlan is a best practice.

I would treat your internal network as byod. Look at ways to secure the end points themselves. Firewall for each should be on. Look into endpoint protection options to step it up another level.

I usually have the employee byod devices (mobile phones) connect to the guest network and isolate the guest devices from each other.

Since your printer is your only really shared resource, you don’t need to get too crazy. I would probably leave it as PSK in this small network.

Total novice here but also test your backups! Ensure how long to recover is OK per your SLA. Inform the brass of ETA restore for a machine. (reimage, reinstall and data restore) add headroom as need based on your test. 1.5 time or 3 times your ETA is good.

You should have a reporting system tied into your email system that has a report button that scrapes the important information for reporting purposes but also quarrantines the email or deletes it.

Normally I’d agree with you. However, Unifi protect is a bit different than most camera systems. There is no option to stream directly from the cameras. You must go through protect. Protect needs to communicate with the cameras, the end users do not.

Ubiquiti will not really offer much in terms of security. The built-in IDS has really generic signatures that are not well maintained and is more for show than anything. If it presents performance issues for you disabling it won't really make your security posture any worse realistically. I see a lot of people install Ubiquiti and not keep it up-to-date because with Ubiquiti the updates often break things. Don't fall into the trap of running old firmware in your Ubiquiti environment. For a business a solution like Cisco Meraki would be a much better bet IMHO (though expensive I know).

In terms of security if you're not running any local servers and everything is in the cloud then the benefit of segmentation won't be as impactful on your overall security posture. Keep in mind the point of having separate VLANs is to establish boundaries where security policy (e.g. firewall rules) can be implemented. If you're just creating VLANs but not filtering traffic between them the benefit is almost non-existent. With that in mind for your setup I would suggest:

• Separate Wireless Network for Staff and Guests (with Guest network firewalled from accessing any internal network)
• Ideally wire up any devices that are stationary if possible (printers... cameras... door locks... etc) these devices generally have low-end wireless chipsets that will bring down performance for others. If you do need to connect them using Wi-Fi and if they don't encrypt data at the application layer you might consider using a separate SSID with a dedicated PSK that is not shared with client systems or staff.
• Encourage staff to use work-provided systems for work and BYOD systems on the guest network for personal stuff. Create a culture where personal use is OK but ideally not shared with work devices. Not being overly aggressive on guest network filtering or throttling will help. Not being overly restrictive on work systems will also help avoid them going the other direction and using their personal device for work.
• For networks that have non-client devices (printers... cameras... door locks... etc) you can use a separate network and filter their access to the Internet to only what is necessary (often the answer here is no need for access). This will prevent vulnerable devices from being able to call back to the web to get a payload or establish a command and control path. Also lock down access to these devices to only what is necessary. A printer only needs a handful of ports to function same with a camera. They only need access from the staff network. Cameras and door locks might be something you only allow access from a wired network that you place your workstation on etc.

Some non/less-networking things I would look at:

• Invest in Cisco Umbrella for protecting devices. It's a low friction solution that provides good results in terms of mitigation of known threats and with the roaming client it can follow users home on work devices without being dependent on any on-premise networking so it doesn't introduce a bottleneck or single point of failure. Umbrella's DNS-based threat intelligence is very good.
• Have everyone run an ad blocker like uBlock Origin. The majority of browser-based threats are served up through ad networks which don't really restrict much of anything on the content side.
• Invest in a password manager like 1Password (my choice) and teach everyone how to embrace password managers and never use the same password across different applications. 1Password can support TOTP 2FA tokens (like Google Authenticator) which makes adoption of 2FA a lot easier for people. I recommend not running/installing any browser extensions for password managers and teaching users to depend on the native app when possible. For solutions like LastPass that require the browser for some functions I recommend having users leverage whatever browser they don't routinely use for that. Convenience features like form auto-fill are the biggest attack surface for password managers. Even though exploitation is relatively rare and quickly patched simply not using those features can limit the attack surface significantly.
• Use strong passwords. Keep things patched and up-to-date. Show users https://haveibeenpwned.com/ and explain how password reuse across applications leads to their passwords ending up in dumps. Show them examples of phishing and what to look for.

With the size of your company and the way most things are in the cloud you will get much more value out of the second list than the first. You're already in a good place by splitting guest and staff networking. Just make sure you have filtering in place that doesn't let the guest network access anything internal. The rest is a game of balancing risk vs. the extra staff time and complexity needed to maintain the network. You can build an empire but that time investment might be better spent elsewhere (such as teaching users how to use a password manager).

Finally don't forget that disaster recovery is part of security. Make sure you're investing in a backup solution like Backblaze if appropriate. A bit less critical if everything is in Google Drive but with Windows you likely will run into some sort of ransomware and some level of data that was locally on someone's laptop and not backed up anywhere.

I have a few different soft light sources that make my home office cozy. Also a rug made a big difference. To stay focused, noise canceling headphones and a daily log of the work I’ve done. The list helps me build momentum and stay focused on adding to the list of things I’ve completed. 

A really comfy swirly office chair with a nice design that I like, a large sit stand office table, a table lamp with good lighting and some micro curtains to separate spaces/block some light providing a protected nook feel. And some plants. And defs next to a large window preferably facing nature. Oh and a foot rest for when I want to put up my feet along with a small soft carpet especially for those cold winters.

I keep my setup simple but functional. A good chair with lumbar support, a proper desk height, and a laptop stand to bring my screen to eye level, these are the essentials. I also take breaks by doing stretches or a quick walk around the block. Having a designated ‘work zone’ helps me mentally separate work from relaxation.

I swapped my old chair for an ergonomic one, and it’s made a huge difference. No more back pain!

Chair and ac

You say the users are using their own (personal, non-company issued or controlled?) laptops. That's always kind of a security nightmare, especially if your company is dealing with sensitive data. I would consider upping the budget and getting them company owned devices.

need to make a guest network

So there are least 4 VLANs. Also any accounting and servers and customer data should be separate also. Even if you are small you need to protect stuff like this from anything that can happen. Someone gets ransomware software on their computer and everything on that network segment is at risk. So segmentation is super important even in a very small business network. Your servers/ data needs to have a completely separate connection on your firewall so everything connecting to it must go through the firewall.

Backups are super important and you should have local copies and an off-site backup for all data and equipment configurations.

Small office

Get crowdstrike: https://www.crowdstrike.com/products/

You can offer employees vpn connectivity options via that fortinet while they are away from office. Probably setup dynamic DNS would be easiest. you should invest in end point security product of some sort. and even if the end machines are personal property of the workers - enforce they install and run it. av is a start, but nowhere near enough these days. Look into valid security license and subscription for the firewall.

As for IoT and Guest, park them in their own zones with internet only. Use a different zone on the fortinet for corporate aka in office network for file servers, vpn users, and whatever ssid they use for internal traffic. Do not allow traffic between the zones except allowing corp to egress Internet via a NAT and policy.

Decide if you want to tunnel users internet traffic back to office while they are away or if you want local breakout. Be sure to use rfc1918 addressing everywhere, 10.x for corporate and 192.168.x for internet facing is what I prefer. Avoid the most common ones like 192.168.0 or 192.168.1 etc to avoid overlapping with most peoples home networks.

Guys, I am new to networking. Is this question is CCNA level or its way advanced even though its soho

I’m also a cloud based firm and my strategy until last month was to provide a computer. None of my apps have required my own server by design.

When onboarding my last employee I wasn’t able to get a computer in time. Lenovo was 4 months out. I probably could have found something else that would have worked but this new employee already had a workstation set up at their home.

I decided to create a terminal server that we all sign into using RDP. I went with Infinitely Virtual.

It’s been working great and has opened additional software options since I have my own server now.

I can set up someone’s new desktop in a day and they can use their own device.

We use MFA to log in and they’re unable to download files from my system.

My new job is giving me a stipend to buy whatever I need to work remotely. I already have everything because I've been working remotely for some time, so I don't need the stipend. My setup is a laptop with a multimedia dock and an extra monitor. I also have a desk.

The idea for you to buy/control the hardware is nice, but you can't guarantee anything. Working in the office scares people more about doing personal stuff on the work computers, but if you buy them a laptop, unless you install monitoring software on it and let it be known you've done that, it's still probably going to be used as a personal laptop. You also can't control their home network, which is another potential security issue. So, I'd say give a stipend, which is going to be easiest if you have people working in different parts of the country/world vs shipping a lot of tech.

My Firm shipped me a laptop, wireless keyboard & mouse and two 24 inch monitors via UPS. It’s against company policy to hook up personal printer to company laptop. Our Firm didn’t provide us company printers due to privacy of client data.

I would definitely get them Lenovo laptops and a docking station, and then give them a technology stipend for them to buy monitors, etc.

You always want to control the hardware your end user uses to connect with your network, no matter how it is set up. End of story. Employees should not be using their personal equipment to access any of your data

Do you guys like the look of the fans back I purchased reverse blades to avoid seeing them interesting flavour I see in some setups

Otherwise this setup is sick!!

Dell Premier is probably the closest to what you're looking for. I have access to most of their offerings. Some of the really high end enterprise stuff I have to contact my account rep, but most everything else I go through my Premier account.

I've always been curious about the same thing...

As an HPE Partner, we get access to tons of stuff to build CTO orders, information on configurations, special pricing, information required to generate configurations and quotes. Also (pre COVID) regularly attended events to provide training to solution architects to build configurations.

I've given up a few years ago, but used to try to find out how to configure/sell Dell, but it almost seemed like there were no resources or information on how to build configurations or quote. It always seemed like they just wanted customers to buy direct, so we never offered any of the product.

I'm gonna keep watching this, curious if there's such a thing.

Dell have the partner portal - https://www.dellemc.com/partner/en-uk/partner/partner.htm

this is for registering deals and seeing product info.

In addition, there is Dell Premier if you are a large client.

However, Dell just suck for partners... you are not treated as such in the slightest.

I have no idea what you are asking for? Sorry.

I also don't understand. The dell website lists all models and also has per product manuals etc. what information is it that you want to be provided?

I am a dell reseller but in relatively low volume, but we sell a wide range of their products. Servers, business and residential laptops, workstations, gaming machines.

very unique, i like it! plus, can never go wrong with dexter.

I am curious, why would you want to reinstall the Dell apps? I used to work for a computer store and we would do fresh installs on computers to remove bloatware like the Dell apps as a courtesy for customers who bought the computer from us.