Home lab safety, and staying on the right side of the law

Two kinds of safety matter with a home lab. One is keeping the household happy. The other is considerably more serious, and it is worth being direct about with anybody young who is interested in security.

Keeping the family network intact

The fastest way to have your lab unplugged is to take down the internet on a weeknight.

Segment it. Put the lab on its own VLAN or its own network, separate from the computers everybody else uses. Then an experiment that breaks something breaks only your things.

This is also excellent practice, because it is exactly how it works in a real organisation, and configuring it teaches you more than most tutorials.

Be careful with DHCP. Running a second DHCP server on the family network is the classic way to break everything for everybody simultaneously, and it is very hard to diagnose from the other end. Keep it on your own segment.

Do not experiment during dinner or during someone’s work call. Have maintenance windows. Tell people. This sounds like a joke and it is genuinely the professional habit you are trying to build.

Label the physical things. Which cable is yours. Which plug must not be turned off. A luggage tag on the power lead prevents a great deal of grief.

Electrical and physical

Do not overload a power board, particularly with several machines and drives.

Keep it ventilated. Not in a sealed cupboard. Machines that overheat shut down, and in the worst case they are a fire risk.

Use a UPS if you can, even a small one. It protects against the sudden power loss that corrupts file systems, and around here summer storms make that a real consideration.

Old lithium batteries. If you are using retired laptops, check for swollen batteries. A bulging battery wants proper disposal, not a drawer and not the bin.

Dust. Ex-corporate machines arrive full of it. Clean them properly before running them continuously.

The part that actually matters

Now the serious bit, and it deserves plain language.

Security is a legitimate, valuable and genuinely interesting thing to learn. Understanding how attacks work is how defenders are trained, and the industry needs people who understand both sides.

All of that learning happens on your own equipment, on your own network.

Not the school’s network. Not your employer’s. Not a neighbour’s Wi-Fi. Not a website you found that looks poorly protected. Not a company’s login page you thought you would “just test”.

Accessing a computer system without permission is a criminal offence in Australia under Commonwealth and state law. It does not matter that you did no damage. It does not matter that you were curious, or that you intended to report it. The offence is the access.

The consequences are real and they are not proportionate to the curiosity behind them. A conviction closes off the entire industry you were trying to get into, because this field runs on background checks and security clearances. It closes off government work, defence, finance, and most large employers.

I raise this not because I assume anybody is planning it, but because the line is genuinely not obvious to a fifteen-year-old who has just learned something works and wants to see whether it works elsewhere. That is a completely natural impulse and it needs redirecting rather than punishing.

Where to do it properly

The good news is that there are excellent legal places to do exactly this.

Your own lab. Set up deliberately vulnerable machines and attack them. This is the standard professional training method.

Hack The Box, TryHackMe and OverTheWire. Purpose-built legal environments with structured learning paths. Genuinely good, and free tiers exist.

Capture the flag competitions. Regular, often free, frequently with prizes, and they look excellent on an application.

Bug bounty programs, once you are more experienced. Companies that explicitly invite security testing within defined rules. Read the scope carefully and stay inside it.

Every one of these gives you the same skills, is entirely legal, and can be listed on a resume. Unauthorised access gives you the same skills and a criminal record.

If you find something by accident

It happens. You notice a school system is misconfigured, or a local business has something exposed.

Do not explore it. The moment you look further, you are on the wrong side of the line.

Report it to a responsible adult, and let them make contact. A teacher, a parent, or the organisation’s published contact.

Do not report it anonymously from your own account, and do not demonstrate it to prove the point. Well-intentioned people have been prosecuted for exactly this.

For parents

If your child is interested in security, that is a genuinely good sign and it points at a well-paid career with a long-term shortage of people.

The two things worth doing are making sure they have a legal place to practise, which a home lab and the platforms above provide, and making sure somebody has had the conversation above with them clearly, once, before curiosity makes the decision for them.

That conversation is part of how I teach this. Everything we do is defensive, contained, and on equipment the student owns. Details on the home labs page and the kids and teens page.