I'll argue for the same argument as Cameron Miller: Trust is probably your best bet. It stems from one of my favourite quotes:
In a networked world, trust is the most important currency. -- Eric Schmidt
(not extremely relevant to computer networking, but hey)
Theory
Basically, the perfect option for network security is to have both:
- a network that is as secure as you can make it (it will never be 100% secure of course);
- and also have high trust in all members of the network.
This is often a possible scenario in an organization: you have network security people that actively ensure that the network is running well, and you have competent employees (which you treat well to reduce risks of a rogue employee). In simple words: in this environment, network security appliances do not reduce the trust people in the network have of the network administrator.
Applied to the household
In a household I'd argue that adding network security appliances will reduce the trust of your flatmate in you (which in turn reduces your trust in him). We just had a question about such a situation.
This may not be a bad thing, if the network security appliances perform better than trust then it is a good investment. Yet, if I had a flatmate whom I'd trust so little to go to the extent of buying expensive equipment to protect the network, I would move. The threat model most appealing is malware on your flatmates computer, yet if you guys trust each other you could talk about network security yourselves. This is analogous to network security training in an organization.
All this and following is under the following assumption:
Your flatmate is not a teenager that would go to random porn websites and then be ashamed to admit he did.
Finally let's count the costs of giving up trust and going with a hardware+software solution:
- Trying to implement a VLAN on three NICs is a hopeless situation, there is absolutely no way of performing this. You will need extra equipment.
- An industry grade router that has more than two NICs (one for LAN one for WAN) is pretty expensive, and I really mean the expensive. Even most (non-security related) organizations do not use such routers. For an example: my university (the main network of it) connects all 10k students and staff into the same network through several APs, then monitor the network, no VLANs.
- It is likely to be cheaper to buy three customer grade routers and connect them together.
Note that under the threat model of malware on your flatmates computer, the above is not very secure either. Assuming that the malware has full control of his machine he becomes a insider attacker. An insider can brute-force router admin interfaces for example.
Conclusion
It is a lot easier to chat to your flatmate in the morning and ask:
Dude, your machine is trying to send packets to mine. You got infected with something, wanna me to have a look later?
Adding all the network security on top of of your current network will reduce the chance that your flatmate will answer:
Yeah, let's do it
In terms of risk management that reduction is a reduction in the security of your network.
Therefore the costs of adding extra hardware (and software) into the network to secure it better far outweigh the added benefits, since the benefits are vastly reduced by the reduction in trust.
Extra notes
- Kill Comcast, seriously, kill that with fire.
- This answer does not apply at all for a professional environment
