Cybersecurity at the Physical Layer

The threat that software cannot solve

Most cybersecurity conversations in commercial buildings focus on firewalls, endpoint protection, SIEM platforms and zero-trust architecture. These are all important. But there is a layer beneath all of them that is rarely discussed in a security context, and it is the layer that a determined attacker will look for first: the physical network.

If an attacker can physically connect to your network infrastructure, tapping a cable run in a ceiling void, plugging into an unsecured patch panel port, accessing a comms room that was left unlocked, the software security stack becomes significantly easier to circumvent. Physical layer security is not an alternative to software security. It is the foundation on which everything else sits.

Structured cabling design contributes to security by making physical connections controlled, traceable and easier to audit.

Physical layer security is not an alternative to software security. It is the foundation on which everything else sits.

How AI systems change the attack surface

The deployment of AI in commercial buildings substantially increases the physical attack surface. Every AI-powered device, a CCTV camera with on-board analytics, an occupancy sensor feeding a building management system, an AI-managed Wi-Fi access point, an edge compute node in a comms room, is a physical network endpoint. Each one is a potential entry point to the network if it is not physically secured and logically isolated.

The risk is not theoretical. A compromised IP camera on the same network segment as business workstations provides lateral movement opportunities. A malicious device plugged into an unmonitored patch panel port can capture traffic, inject packets, or establish a persistent foothold. An AI building management system connected to the corporate LAN creates a bridge between operational technology (OT) and IT networks that did not exist in older analogue building systems.

VLAN architecture and the cabling contractor’s role

Virtual LANs (VLANs) are the standard mechanism for segmenting a network logically, separating corporate data traffic from IoT devices, guest Wi-Fi from staff Wi-Fi, AI surveillance systems from general business systems. VLANs are effective and essential. But they are implemented in switch firmware, and switch firmware can be misconfigured, exploited, or bypassed by an attacker with physical access to the network.

The cabling contractor’s role in VLAN security is often overlooked. VLAN design only works if the physical cabling correctly routes each device to the right switch port, patch panel port and logical segment. A cabling error that connects a CCTV camera to the wrong patch panel row can inadvertently place it on the corporate network segment. A poorly documented comms room makes this kind of error invisible for months or years.

ACCL can align outlet, panel and cable identifiers with the agreed network design. TIA-606-style labelling and Fluke DSX certification provide an auditable record of cable identity and physical performance. VLAN and switch-port configuration must be verified separately through the switching or network-management environment.

Physical separation for AI systems: when and how

For many commercial buildings, VLAN segmentation across shared cabling is appropriate when it is correctly designed, configured and monitored. Dedicated physical infrastructure may be considered where the consequence of compromise, operational requirements or assurance needs justify the additional cost.

• AI-powered CCTV and access control systems in environments handling sensitive data, legal, financial, healthcare, government
• Edge compute nodes running AI inference on business-critical processes
• Building management systems controlling physical access, power distribution or environmental controls
• Any network segment where a breach would have regulatory consequences, GDPR, FCA, NHS DSP Toolkit

Physical separation means dedicated cable runs, dedicated switch hardware, and in some cases dedicated comms room infrastructure. The cost is higher than a shared physical plant. The risk reduction is substantially higher still.

Documentation as a security tool

A structured cabling installation without complete, accurate documentation is a security liability. Unknown cable runs, unlabelled ports and undocumented connections are the physical equivalent of shadow IT. An attacker who understands your building’s layout can exploit undocumented network access points that your IT team does not know exist.

Where included in the agreed scope, ACCL provides cable and port labelling, link certification and as-built documentation. These records support asset control and investigation, but they should be maintained alongside switch configurations, access logs and change records.