A network hub is a simple device that connects multiple network endpoints and repeats incoming traffic to every port. In identity and security terms, it lacks awareness of source, destination, or policy, so all connected systems receive the same data, creating inefficiency and exposure compared with controlled switching.
How a network hub works
A hub is the most basic form of network interconnect: it takes an incoming frame or signal and repeats it to every connected port. That makes it easy to understand, but it also means the device does not make forwarding decisions based on address, session, or policy.
Because every attached endpoint receives the same traffic, a hub behaves like a shared medium rather than a selective switch. In practice, that increases unnecessary chatter on the network and can expose traffic to any device on the segment, which is why hubs were largely displaced by switching and segmentation.
Why hubs create exposure and inefficiency
The main limitation of a hub is not just speed, it is lack of awareness. It cannot isolate traffic, enforce per-port policy, or reduce the blast radius of a broadcast or maliciously noisy device. On a crowded segment, that design causes collisions, wasted bandwidth, and poor performance.
The same simplicity also creates exposure. If a system can observe the shared wire, it can see traffic not intended for it, which weakens confidentiality on the local network. Modern network design normally replaces this with controlled forwarding and tighter trust boundaries.
For a more structured cloud-networking view of segmentation, egress control, and isolated network paths, see the Cloud Network Security Guide.
How hubs differ from switches
A switch learns where devices live on the network and forwards frames only where they need to go. That single change removes most of the inefficiency associated with a hub and sharply reduces unintended visibility of traffic across the segment.
In security terms, the difference is control. A hub treats all attached systems as part of the same open conversation, while a switch can support segmentation, port controls, and more predictable traffic flow. That is why hubs are considered obsolete for most enterprise and cloud-connected designs.
When designing or reviewing network paths, the important question is not whether a device connects endpoints, but whether it can enforce least exposure between them.
Where hubs still matter conceptually
Hubs are still useful as a teaching model because they show what happens when a network has no forwarding intelligence. That makes them a clean contrast case for understanding why segmentation, inspection, and policy enforcement matter in real environments.
They also help explain why older flat networks were easier to overhear and harder to control. Even when a physical hub is no longer present, the same design mistake can reappear in poorly segmented virtual networks, unmanaged shared services, or any topology that allows unnecessary east-west visibility.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Network Integrity and Segmentation | Hubs lack selective forwarding, so segmentation is the core control concept. |
| Recommendation — Enforce segmentation and controlled traffic paths to prevent unnecessary network-wide exposure. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | A hub undermines boundary enforcement by repeating traffic to all ports. |
| Recommendation — Apply boundary protection to restrict traffic flow between network segments. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Hub-like flat networks are a network-device governance and control issue. |
| Recommendation — Maintain controlled network infrastructure so only approved connectivity paths remain in place. | ||
| ISO/IEC 27001:2022 | A.8.20 — Network Security | Network security controls should limit uncontrolled broadcast and exposure. |
| Recommendation — Use network security controls to prevent unrestricted traffic propagation. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org