IT & Cyber Security

Once the cables are laid, the real question remains: on this network, who reaches what. In a default installation every device plugged into a floor outlet meets in the same address pool. An IP camera sitting beside the accounting server is nobody's decision; it turns out that way because no decision was made.

Segmentation is therefore the first layer. Camera streams, access control controllers, office computers, production machines and guest access sit on separate networks, and the crossings between them are opened by writing a rule rather than left open and shut afterwards. The same separation bounds a fault, since a contagion starting in one segment cannot reach its neighbour unaided.

Maintenance access from outside is the part most easily skipped. A remote connection opened to the manufacturer of a camera or an air-conditioning panel becomes a permanent door when nobody closes it; access that is time-bounded, named and logged does the same job and leaves a trace behind it.

Identity and privilege

Privilege attaches to a role, not to a person. Accounts carrying old rights across a change of role accumulate until everyone reaches everything, and only regular review prevents that. An administrator account is kept out of daily work, held separately and protected with multi-step verification. Taking delivery of cameras, controllers and switches on their factory passwords is the open door met most often.

Patching and visibility

A vulnerability closes not on the day a manufacturer publishes the patch but on the day that patch reaches the device in the field. No patch plan is possible while it is unknown which device runs which version, so an inventory is not a list but a continuously updated record. Log records left on the devices themselves erase the trace of an incident within their own rotation; gathered in one place, the same records line up in order and the course of an incident becomes readable.