A lighting network is a computer network
A modern networked lighting system has controllers, gateways, sensors and sometimes thousands of addressable fixtures. Many of those devices run an embedded operating system, talk IP and reach a cloud service. Add a BMS, people counters and leak sensors, and the building can have more networked devices than the office has laptops. Most of them were installed by contractors whose job was to make the lights work.
The decision that matters is how your building systems should sit on your network, and who looks after them once they’re there. We’d rather settle that with your IT team at the design stage than discover it in a security review two weeks before occupancy.
What we put in place, mapped to the risk
| Risk | What we put in place | Who owns it after handover |
|---|---|---|
| A compromised device reaches the corporate network | Segmentation by VLAN or physical network; deny-by-default rules between zones | Your IT team, with our rule list |
| Nobody knows what’s connected | Asset inventory with firmware and owner for every device | Facilities and IT, kept current in Lytbit Ledger |
| Default or shared passwords | Unique credentials, defaults removed at onboarding, MFA on portals | You hold the credential register |
| Known vulnerabilities stay unpatched | Firmware baseline, notice tracking, bench-tested updates | Us under a Steward plan, or your team |
| Vendors with permanent remote access | Brokered, time-limited, logged sessions approved per visit | Your IT team approves each session |
| Legacy protocols with no security | BACnet/SC where supported; isolation and monitoring where not | Shared, and documented in the design |
Segmentation does most of the work
If we could do only one thing on an existing building network, it would be segmentation. Lighting, BMS and IoT devices go into their own zones, and the conduits between zones carry only defined traffic. The BMS reads specific BACnet points from the lighting gateway. The gateway reaches its cloud service outbound on one port. Nothing on the corporate LAN starts a connection into the ceiling. We write those flows as a short list with a reason on every line, because IT teams approve what they can read.
That’s the zones-and-conduits model from IEC 62443, the series of standards for industrial automation and control system security. We use its practices to structure the design and to compare products against its component requirements. We don’t claim certification, and we tell you plainly which parts of your system have been independently assessed and which haven’t.
BACnet/SC and the protocols that can’t protect themselves
Classic BACnet/IP has no encryption or authentication and depends on broadcasts. BACnet Secure Connect (ASHRAE 135 Annex AB) adds TLS and certificate-based authentication through a hub, and removes the need for BBMDs. We use it where both sides support it, and we plan certificate renewal as part of operations rather than leaving it for the day a certificate expires. Where equipment can only speak BACnet/IP or Modbus, we keep it on an isolated segment, limit who can write to it and log changes.
What we check on the bench
Before a device type goes on your network, it runs on the Lytbit Lab bench with packet capture. We record every destination it contacts, whether the traffic is encrypted, which ports it listens on, and what it does when its cloud service is unreachable. That record becomes a Bench Note your security team can read. Findings are common: debug services left running, telemetry sent to unexpected hosts, time sync over unauthenticated protocols.
The DLC requirement is a floor
Since NLC5, the DLC has required systems on its Qualified Products List to meet a cybersecurity requirement. Choosing listed products gives you a better starting point. But the listing describes the product. Flat networks, shared logins and a cellular modem zip-tied inside an electrical panel are installation decisions, and that’s where most real exposure comes from.
Working with your IT team
We answer security questionnaires in writing, join architecture reviews, follow your change process and hand credentials to your custody. If you don’t have an IT team, we document the design so the next provider can pick it up. Our security and data page describes how Lytbit Ledger itself handles access, retention and firmware, and our post on questions to ask before your lighting network touches IT is a good checklist for any vendor, including us.
