Assignment – Network Design Proposal for a Small Australian Accounting Firm

Introduction

Marlow Accounting Group is a small Australian public practice with 25 staff across two Victorian sites: a head office in the Melbourne CBD (17 staff) and a branch in central Geelong (8 staff). Each site currently runs a flat network of consumer-grade routers, unmanaged switches and ad hoc USB backups. This is no longer tenable: the practice has moved its ledgers to cloud accounting platforms, its staff work across both sites and from home, and its client files hold tax file numbers and financial records that attract strict confidentiality obligations. The threat environment is also worsening. The Australian Cyber Security Centre (ACSC, 2024) puts the average self-reported cost of cybercrime for an Australian small business at just under A$50,000 per incident, and the Office of the Australian Information Commissioner (OAIC, 2024) recorded 527 notifiable data breaches in the first half of 2024, with the finance sector among the top reporting industries.

This proposal presents a complete network design for the firm. It analyses business and technical requirements, proposes a two-site topology (Figure 1), sets out an IP addressing plan (Table 1), selects hardware within a A$15,000 capital budget (Table 2), specifies a security design aligned to the ACSC Essential Eight, evaluates the cloud versus on-premises trade-off, and closes with a phased implementation plan (Table 3).

Requirements Analysis

Business Context and Constraints

The Melbourne office houses the partners, senior accountants and administration team; Geelong hosts a smaller compliance and bookkeeping team. Core workloads are Microsoft 365 (email, SharePoint document management and Teams), Xero and its practice management suite, a payroll platform, and a hosted VoIP telephony service. Workstations are Windows 11 devices, and roughly a third of staff work hybrid and require secure remote access.

Three constraints shape the design. As an APP entity, the firm must take reasonable steps to secure personal information under Australian Privacy Principle 11 of the Privacy Act 1988 (Cth) and be able to assess and notify eligible breaches under the Notifiable Data Breaches scheme (OAIC, 2023). Its registered tax agents are bound by the confidentiality obligations of the Code of Professional Conduct under the Tax Agent Services Act 2009, which the Tax Practitioners Board (TPB, 2023) expects to be supported by sound cyber security controls, including over records held with cloud providers. Commercially, capital expenditure must not exceed A$15,000, and disruption must avoid quarterly BAS lodgement peaks. These pressures are typical: Australian Bureau of Statistics (ABS, 2024) business characteristics data indicate that roughly one in five Australian businesses reported an internet security incident, yet few small firms employ dedicated IT staff.

Functional and Technical Requirements

• Secure, always-on connectivity between the two sites for file access, telephony and management traffic.
• Segmentation of staff, telephony, server or management, and guest traffic into separate VLANs with controlled inter-VLAN routing.
• Business-grade internet at both sites with automatic failover, sized for cloud-first workloads and VoIP.
• Secure remote access for approximately eight hybrid workers, protected by multi-factor authentication (MFA).
• Centralised identity through Microsoft Entra ID, with MFA enforced on all accounts.
• A 3-2-1 backup arrangement: local staging plus encrypted cloud copies, with quarterly restoration testing.
• Availability of at least 99.5 per cent during business hours, supported by UPS protection for network equipment.
• Alignment with the Essential Eight at Maturity Level One as a minimum security baseline.

Capacity Estimation

Link sizing follows standard concurrency reasoning, in which peak demand is estimated from the user population, a per-user working rate and a concurrency factor rather than the theoretical maximum (Kurose & Ross, 2021). Assuming a 2.0 Mbps average working rate for cloud-heavy office work and 60 per cent concurrency, firm-wide peak demand is:

Peak demand = 25 users x 2.0 Mbps x 0.6 = 30 Mbps, of which the head office share is 17 x 2.0 x 0.6 = 20.4 Mbps.

Telephony adds little: at roughly 100 kbps per call including overheads, ten concurrent calls require only 1 Mbps, provided a quality of service policy prioritises voice. A business-grade NBN fibre service at 100/40 Mbps for the head office and 50/20 Mbps for Geelong therefore provides comfortable headroom for growth, cloud backup windows and simultaneous video meetings, with a 4G/5G mobile broadband service on each firewall as failover. Power over Ethernet (PoE) capacity is verified the same way: the head office worst case of 3 access points x 15 W plus 17 handsets x 6.5 W equals 45 + 110.5 = 155.5 W, well inside the 370 W budget of the proposed switches.

Proposed Network Topology

The design uses a hierarchical star topology at each site, collapsed into a single access and distribution layer as is appropriate at this scale (Tanenbaum et al., 2021). Each site is anchored by a next-generation firewall (NGFW) acting as the security gateway, internet edge and inter-VLAN router. Behind it, managed PoE switches serve wired workstations, VoIP handsets and Wi-Fi 6 access points, with the access points trunked so that staff and guest SSIDs map onto their respective VLANs (Odom, 2020). At the head office, two stacked 24-port switches present a single logical access layer; Figure 1 abstracts these as one switch per site, in keeping with single-line diagram conventions.

The sites are joined by a site-to-site IPsec VPN (IKEv2, AES-256-GCM) between the firewalls, markedly cheaper than a carrier private WAN at this scale and adequate for the modest inter-site traffic that remains once file storage moves to SharePoint. Because workloads are cloud-first, each site breaks out to the internet locally, with most traffic flowing north-south to Microsoft 365 and Xero rather than across the tunnel. A network-attached storage (NAS) unit at the head office provides local backup staging; Figure 1 depicts the full arrangement.

IP Addressing Plan

Private RFC 1918 addressing is used throughout, structured so that the address itself communicates location and role: the second octet encodes the site (10 for Melbourne, 20 for Geelong) and the third octet encodes the VLAN function. Staff, voice and guest segments receive /24 networks for simplicity and DHCP headroom, while the smaller server and management segment is right-sized to a /26. The number of usable hosts in that subnet is calculated as 2^(32-26) – 2 = 2^6 – 2 = 62, which comfortably exceeds the dozen or so printers, switches, access points and NAS interfaces it must hold (Odom, 2020). Each firewall provides DHCP per VLAN, with addresses .1 to .20 in each range reserved for static infrastructure. The full plan is shown in Table 1.

Table 1: IP addressing and VLAN plan for both sites.

Hardware Selection and Budget

Hardware selection favours a single-vendor security fabric for the firewalls and business-class managed switching, since integrated management suits a firm without dedicated IT staff. The desktop NGFW class chosen is rated for threat-protection throughput of around 700 Mbps, roughly seven times the head office WAN rate, so enabling intrusion prevention and TLS inspection will not bottleneck the link. Existing workstations and VoIP handsets are retained, which keeps the refresh within budget. Table 2 itemises the capital costs in Australian dollars, including installation of Cat 6A cabling by a licensed contractor.

Table 2: Proposed hardware and capital budget (A$, ex GST).

The budget position is confirmed by summation: Total = 2,360 + 2,280 + 1,700 + 1,240 + 1,050 + 3,400 = A$12,030. Applying a 10 per cent contingency for freight, mounting hardware and minor variations gives 12,030 x 0.10 = A$1,203, for a total project provision of 12,030 + 1,203 = A$13,233, which sits A$1,767 under the A$15,000 cap. Recurring costs (NBN services, failover, licensing and backup storage) are operating expenditure, considered below.

Security Design

Perimeter, Segmentation and Remote Access

The security architecture applies defence in depth, layering perimeter, network, identity and data controls so that no single failure exposes client records (Stallings, 2017). At the perimeter, each NGFW enforces a default-deny inbound policy with no published services, outbound application-aware filtering, intrusion prevention and DNS filtering against known malicious domains. Internally, inter-VLAN policy is deliberately restrictive: the guest VLAN reaches only the internet; the voice VLAN communicates solely with the hosted telephony provider; and the server and management VLAN accepts connections only from named administrative hosts. This segmentation limits lateral movement: a compromised guest device or handset cannot reach workstations or the NAS.

Remote access is provided by client VPN on the head office firewall, authenticated against Microsoft Entra ID so that conditional access and MFA apply to every session; the same MFA policy covers Microsoft 365 and Xero logins. Administration uses separate named accounts, with management interfaces reachable only from the management VLAN. Backups follow the 3-2-1 pattern: nightly snapshots of SharePoint and workstation profiles stage to the NAS, with an encrypted copy replicated to an Australian-region cloud storage service and restoration tested quarterly.

Essential Eight Alignment

The Essential Eight is the ACSC’s prioritised baseline of mitigation strategies, and Maturity Level One is the appropriate initial target for a small practice (ACSC, 2023). The design operationalises each strategy as follows:

• Application control: workstation policies allow only approved, signed applications to execute.
• Patch applications: browsers, Office and the practice software patch automatically, within 48 hours where an exploit exists.
• Configure Microsoft Office macro settings: macros from the internet are blocked, with narrow signed exceptions.
• User application hardening: browsers block ads and Java content from untrusted sites, and legacy scripting is disabled.
• Restrict administrative privileges: partners and staff hold standard accounts, with separate audited admin accounts.
• Patch operating systems: Windows and firmware updates are applied monthly, or within 48 hours for exploited vulnerabilities.
• Multi-factor authentication: enforced for VPN, Microsoft 365, Xero and all administrative logons.
• Regular backups: the 3-2-1 arrangement above, with quarterly restoration verification.

These controls also evidence the reasonable security steps expected under the Privacy Act, reducing both the likelihood of an eligible data breach and the burden of any OAIC notification (OAIC, 2023).

Cloud Versus On-Premises Services

The design deliberately keeps almost all services in the cloud, consumed as software as a service in the sense defined by Mell and Grance (2011), rather than rebuilding on-premises servers. At small scale the economics favour this: subscriptions convert lumpy capital outlays into predictable operating expenditure and transfer patching, refresh and availability engineering to the provider (Armbrust et al., 2010). A comparison for the firm’s practice software illustrates the point. An on-premises application server would cost approximately A$9,500 in hardware plus A$1,600 per year in power, warranty and support, a five-year cost of 9,500 + (1,600 x 5) = A$17,500, or A$3,500 per year, before labour. The hosted edition costs A$12 per user per month, or 25 x 12 x 12 = A$3,600 per year. At effective price parity, the decision rests on risk and capability, where the hosted option’s professional patching, redundancy and monitoring clearly exceed what a 25-person firm can sustain.

Cloud adoption nonetheless carries obligations. Because client tax records are involved, the firm should select Australian data-centre regions for Microsoft 365 and backup storage, reducing latency and simplifying compliance with Australian Privacy Principle 8 on cross-border disclosure (OAIC, 2023); the TPB (2023) likewise expects practitioners to know where providers store client data and to verify their security. A small on-premises footprint remains where it earns its place: the NAS for backup staging and fast local restores, plus the firewalls and switches no cloud service can replace. The result is a hybrid posture in which the network’s job is chiefly to deliver staff securely to the cloud.

Phased Implementation Plan

Implementation is organised into five phases over ten weeks, sequenced so that the head office is stabilised before the branch cutover and scheduled between quarterly BAS lodgement peaks to minimise disruption. Each phase ends with a verifiable milestone, and the old equipment remains available for rollback until acceptance. Table 3 summarises the program.

Table 3: Phased implementation schedule and milestones.

Conclusion

The proposed design converts an ageing flat network into a segmented, resilient and centrally managed two-site environment matched to how a modern Australian accounting practice works: cloud-first applications, hybrid staff and strict confidentiality obligations. A hierarchical topology with per-site NGFWs, VLAN segmentation and an IPsec inter-site tunnel provides the structure; a disciplined addressing plan makes it administrable; and hardware costed at A$13,233 including contingency delivers it within the A$15,000 cap. Security is designed in rather than bolted on, with MFA, restrictive firewall policy, tested backups and Essential Eight Maturity Level One alignment supporting the firm’s Privacy Act and Tax Agent Services Act obligations. The ten-week schedule avoids lodgement peaks and ties each phase to a verifiable milestone, giving the partners a low-risk path to a network that will support growth for the next three to five years.

References

Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., Stoica, I., & Zaharia, M. (2010). A view of cloud computing. Communications of the ACM, 53(4), 50-58.

Australian Bureau of Statistics. (2024). Characteristics of Australian business, 2022-23 financial year.

Australian Cyber Security Centre. (2023). Essential Eight maturity model. Australian Signals Directorate.

Australian Cyber Security Centre. (2024). Annual cyber threat report 2023-24. Australian Signals Directorate.

Kurose, J. F., & Ross, K. W. (2021). Computer networking: A top-down approach (8th ed.). Pearson.

Mell, P., & Grance, T. (2011). The NIST definition of cloud computing (NIST Special Publication 800-145). National Institute of Standards and Technology.

Odom, W. (2020). CCNA 200-301 official cert guide, volume 1. Cisco Press.

Office of the Australian Information Commissioner. (2023). Australian Privacy Principles guidelines.

Office of the Australian Information Commissioner. (2024). Notifiable data breaches report: January to June 2024.

Stallings, W. (2017). Network security essentials: Applications and standards (6th ed.). Pearson.

Tanenbaum, A. S., Feamster, N., & Wetherall, D. J. (2021). Computer networks (6th ed.). Pearson.

Tax Practitioners Board. (2023). Practice note: Cyber security for tax practitioners.