Building automation reachable from office network: Should BA networks be isolated from office networks

Network administrator Zhang was alarmed by an alert early one morning: the IP address of the building automation (BA) controller was pingable from any PC on the office network. Access control, air conditioning, lighting and exhaust systems all shared the same freely accessible network. Worse still, several low-voltage subcontractors had connected the BA network and office network into the same switch for convenience, without separate IP segments.

This is far from an isolated incident. Many BA networks in industrial parks and office buildings are merged into office networks in this casual manner. Only when conducting classified protection assessments, facing public security inspections, or suffering actual security incidents do operators realize that this single network cable has exposed control over the whole building.

1. Risks introduced by careless interconnection

The BA network carries critical functions: access control activation, fire alarm linkage and power supply for equipment rooms. If compromised by an infected PC on the office network, the consequence is not merely lost files, but loss of physical control over the premises.

BA systems are particularly vulnerable to such improper merging. They are usually deployed by low-voltage subcontractors, whose priority is basic connectivity rather than cybersecurity. Meanwhile, park IT teams generally only manage office networks. Separate teams and separate asset ledgers mean the bridging cable slips through oversight. Yet security accountability ultimately falls on the network team once an incident occurs.

A typical attack chain unfolds like this: office networks host large numbers of diverse endpoints prone to phishing malware. Once one terminal is compromised, attackers can pivot laterally across the shared link to reach BA controllers. BA devices often use identical default passwords, run outdated firmware and rarely receive patches, handing over the ability to modify access rules and air-conditioning schedules to attackers. The attack surface expands dramatically.

The core question is not whether isolation is needed, but how to isolate cleanly without breaking legitimate business requirements.

2. BA and office networks belong to separate lanes on the same infrastructure

Built on all-optical infrastructure, powered by audio & video engine, and protected by robust security capabilities, AINOPOL delivers an integrated “connectivity & security” solution. Segmentation between BA and office networks is defined at the design stage. The two networks are separated via VLAN isolation at Layer 2 to split broadcast domains. BA devices are hidden from the office broadcast domain, so office endpoints cannot discover or ping BA address segments by default.

The underlying two-layer flat PON architecture reduces the need for air-conditioned equipment rooms and cuts cabling workload. BA and office endpoints connect through separate ONU uplinks, creating logical separation at the physical forwarding layer. The BA system gains the stability and low latency of the all-optical foundation while being insulated from noisy office traffic. The design saves over 70% of computer room space and power consumption, and supports smooth evolution toward 50G / 200G PON.

3. Only minimal, controlled access when interconnection is required

Total disconnection is not always practical. Property staff may need to view BA status from the office network, and maintenance engineers require management access. The guiding principle is least privilege access for only necessary services:

• Whitelist-based forwarding: only required ports and protocols for BA operation are permitted; all other traffic is denied by default.
• One-way access: office terminals may query BA status, while BA devices are blocked from initiating outbound connections to the office network to eliminate callback risks.
• Automatic isolation of unauthorized terminals: new endpoints must pass admission checks; devices outside the MAC whitelist are blocked.
• Rogue access detection: unauthorized routers and private hotspots are detected and blocked, preventing accidental re-merging of the two networks.

All access logs are centrally tracked for audit. The AINOPOL Dream Gateway integrates routing, AC and firewall functions, acting as the boundary checkpoint between the two networks. Legitimate interconnection is traceable, while unauthorized traffic is blocked before reaching BA assets.

Systems including access control, fire alarms and surveillance are recommended to be grouped into dedicated security and BA subnets. These subnets must not be mapped to the public internet or allow direct remote access. Remote maintenance is delivered through controlled tunnels, paired with strong passwords and baseline validation.

As a multi-service converged security gateway, the Dream Gateway integrates routing, AC and firewall, with next-generation firewall and IPS capabilities. It blocks external scanning and anomalous traffic at the perimeter of dedicated subnets. For multi-building sites, centralized headquarters management provides full topology visibility and synchronized policy distribution. Administrators can clearly view permitted and blocked traffic paths on a single dashboard. For high availability, core equipment supports dual power supplies and dual main control hot standby, with millisecond-level failover upon link faults, so a single failure will not take down building-wide controls.

FAQ

Q: Does full physical isolation between BA and office networks cost a lot?
A: Not necessarily. VLAN logical isolation with separate uplinks can be implemented on the same all-optical infrastructure, without deploying a completely independent cabling system for BA. The final isolation level is determined based on system criticality and classified protection requirements.

Q: The existing BA network is already merged into the office network. How to carry out remediation?
A: First sort out IP addressing and access relationships. Divide the BA segment into an independent VLAN on the gateway and tighten interworking policies. Gradually migrate key controllers to dedicated security subnets, without disrupting ongoing business operations.

Q: BA vendors require remote maintenance. How to balance access and security?
A: Provision a dedicated controlled access channel for vendors, using VPN plus two-factor authentication. Only open the ports required for maintenance, and record all operations in audit logs. Never expose BA devices directly to the public internet. Remote sessions automatically expire and revoke permissions.