At work we have a config where VLAN 1 is the main network and VLAN 2 is the phone system. The workstations connect automatically to VLAN 1 but can also access the control panels of each phone through that same cable, which means that a direct connection to each phone can be made.
Now I've heard that VLANs are supposed to separate traffic to increase security. But what's the point if my computer can access them all and a virus attack, which is intelligent enough to infect both workstations and phones, can reach them all? If it's not a good setup, what kind of setup would be a) secure enough to separate both VLANs entirely and b) management of the phones through their control panel can still be done efficiently?
Also I've heard that using the default VLAN (untagged 1) is not recommended security-wise for the same reason as described above, as the whole main network would be accessible to an attack.