A property manager isolates building access control and cameras from the office and resident networks after a vendor remote-access incident
A residential and commercial property manager of about 110 staff overseeing roughly 60 buildings in the Southeast, a leader in its segment.
- Scale
- About 110 staff, 60 buildings, 3 building-system vendors, 5 network zones per building, 1 vendor access gateway, 0 shared remote-access passwords after rollout
- Engagement
- Two weeks of incident response, then about four months to roll out the new design across all buildings
The challenge
In every building the access-control server, the door controllers, the cameras and recorders, the HVAC gateway, the leasing office computers and the resident Wi-Fi sat on the same flat network. Three vendors supported those systems through one shared remote-support tool with a single password that technicians passed around. One morning the access-control vendor reported that its password had appeared in an unrelated breach, and the firm's logs showed a session from an unfamiliar address on the access-control server of one building. It had listed door schedules and opened the cardholder list, which held resident names and unit numbers. Nobody could say, from the network, what else that session could have reached.
A building is a small operations network that happens to have people living in it. Door controllers, cameras, elevators and air handlers are all computers, each supported by a company that needs to reach it from outside, and the property manager is usually the one who finds out how all of it connects after something goes wrong.
The first days were containment and evidence. The shared support account was closed, every vendor credential was replaced and the logs were copied off the devices before anyone rebuilt anything, so counsel could decide what the state's notice rules required. The session had only looked at schedules and a list of residents, but without separation nobody could prove that from the network alone.
The fix was a standard building design, not a set of one-off patches. Access control, cameras and recorders, building controls, the leasing office and the residents each have their own network, and a firewall between them allows only the few flows the systems need. The same design repeats in every building, so a new technician or a new acquisition sees something familiar.
Vendor access changed the most. The shared remote tool gave way to a gateway with a named account for each technician, multi-factor sign-in, a time window tied to a ticket and a single target system, with the session recorded. The vendors kept doing their work and the firm gained a record of who touched what. Every device got its own password, and the cameras lost their direct path to the internet.
Each building was tested after cutover from the resident and office sides, and the tests were repeated after later changes. The lesson for other property managers is that building systems are rarely attacked directly; they are reached through the vendor's tools and through a flat network, and both can be closed without replacing a single door or camera.
What our team delivered
- Containment first: the shared remote-support account was disabled, every vendor credential was rotated, and the access-control server, recorder and firewall logs were copied off the devices before anything was rebuilt, with times recorded so counsel could assess notice duties under state law
- An inventory of every building system, its address, its firmware version and the vendor that supports it, which found 3 vendors, a recorder on the office network in 9 buildings and cameras still using factory passwords
- A repeatable building design with five zones: office, resident Wi-Fi, access control, cameras and recorders, and building controls such as HVAC. Each zone is its own VLAN, a firewall sits between them with default deny, and only named flows are allowed, for example cameras to the recorder, door controllers to the access-control server and the BACnet/IP gateway (UDP 47808) to the building controls server
- Resident Wi-Fi with client isolation and its own path to the internet, so a resident's device cannot see a neighbor's and has no route to the office or to the building systems
- A vendor access gateway that replaced the shared tool: a named account for each technician, multi-factor authentication, access opened for an approved time window to the one system named in the ticket, and a recorded session. A vendor that cannot use the gateway has no way in
- Unique passwords for every camera, recorder and controller kept in a password vault, firmware updates for the devices the vendors supported, and no direct internet access for any device in the access-control, camera or building-control zones. Live camera viewing for staff goes through the gateway
- Monitoring that alerts when a new device joins a building zone, when a camera connects to anything but its recorder, and whenever a vendor session starts, plus a test from the resident and office networks after each building was cut over to confirm that no path to the other zones remained
Result
The first building was cut over in a weekend, and the rest followed at about four a week once the design was proven. After the rollout, tests from the resident network and the office network reached none of the access-control, camera or building-control devices in any of the 60 buildings, and the camera zone made no connection to the internet. Two months later a vendor technician tried the old shared tool, was refused, and requested a gateway session through the normal ticket in under ten minutes. The 9 recorders that had been on the office network moved into the camera zone, and the 11 percent of cameras that had still used factory passwords were reset and vaulted. That is one illustrative outcome, not a promise: legacy controllers vary, some cannot be updated, and isolation limits what a compromised device can reach, it does not make the device safe. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 5 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Cloud security review
A review of one Microsoft 365, Azure, AWS or Google Cloud tenant against recognized benchmarks.
Report within 7 business days of read-only access
$2,800 per tenant
Cloud management
We run your Microsoft 365, Azure, AWS or Google Cloud environment: access, cost, patching, backup and security settings. Priced per month for one tenant.
Onboarding within 15 business days
$1,900 per tenant, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Access to one app, not to the network
Zero trust network access replaces the all-or-nothing VPN. The identity provider proves who you are, the device agent proves the laptop is healthy, the policy engine decides, and the enforcement point opens a tunnel to that single application and nothing else.
Roaming without dropping the call
Time from leaving one access point to the first data frame on the next, split by phase. A full WPA2/WPA3‑Enterprise re-authentication repeats the 802.1X exchange; 802.11r (Fast BSS Transition) reuses cached keys, 802.11k (neighbour reports) removes the blind scan, and 802.11v (BSS transition management) lets the network steer the client. Illustrative figures.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.