Property Management

Rent-payment and owner-distribution fraud comes first. The common pattern is a message that looks like part of a normal thread asking accounting to send the next distribution, or a vendor payment, to a new bank account. A second pattern takes over a resident or owner portal login and changes the payout details. We set one written rule, no bank-detail change from a message alone, and back it with a callback to a number already on file, two people on every change, a hold on the first payment to a changed account and a weekly review of every change to payee records. Authenticated email with SPF, DKIM and DMARC at enforcement makes it harder to pose as your company to owners and tenants.

Tenant and applicant data comes second. Screening reports, identity documents, income statements and lease files accumulate in email, in shared drives and in the property management system. We find where the data sits, remove the copies nobody needs, put multi-factor authentication on the people and systems that can reach it, set retention so old applicant files are deleted on a schedule, and check the logs so a question about who opened a file can be answered. State breach-notification laws set the clock if something goes wrong, so the plan names who decides and who calls counsel.

Building systems are the third gap. Access-control servers, door controllers, IP cameras and recorders, elevator and HVAC gateways, and the building management system often arrive installed by a vendor with default settings and a connection to whatever network was closest. We map every system and the vendor who supports it, move each class onto its own network (VLAN) per building with a firewall between them that permits only named traffic, change every default password, block these devices from reaching the internet directly, and alert when a new device appears or a camera starts talking to something it never talked to before. BACnet and similar building protocols were not designed with authentication, so isolation does the protecting.

Resident and guest Wi-Fi is the fourth. We separate it from everything else, turn on client isolation so one resident cannot see another's devices, and where the building offers it, give each unit its own key and network. Nothing on the resident side has a route to the office or to the building systems, and we test that from the resident side.

Vendors, owners and contractors come fifth. Instead of a shared remote-support password, each technician gets a named account with multi-factor authentication, access approved for a window and a single system, and a recorded session. Owner and vendor portals are reviewed for accounts that outlived the relationship, and file sharing uses expiring links.

Ransomware readiness protects rent collection. The property management system, the accounting ledger and the trust-account records are often on one server. We separate them, keep backups on a separate identity with an immutable copy, restore one to prove it works, and write a short plan for the week the system is down: how rent is received, how owners are paid and who calls the insurer.

Related work on our track record: a property manager that isolated building access-control and camera systems after a vendor remote-access incident (illustrative), a general contractor's segmented job-site network (illustrative), a title and escrow office's callback control against deepfake wire changes (illustrative), and a coworking operator's multi-building network design.