Zero-Trust Network Architecture for Smart Buildings in the UAE

Why Smart Buildings Need Zero-Trust Thinking

A modern UAE commercial building might have thousands of network-connected ELV and BMS devices — cameras, access readers, sensors, controllers — many running firmware that's rarely patched. Traditional "flat network, trusted perimeter" design treats every device on the building network as implicitly trusted once inside the firewall, which means a single compromised camera can become a path to the access control system or the corporate IT network.

Zero-trust architecture assumes no device is trusted by default, regardless of network location, and requires explicit authentication and authorisation for every connection — a meaningfully different starting point for ELV/BMS network design than the flat-VLAN approach still common on older UAE building projects.

Segmenting BMS, ELV and IT Networks

Practical segmentation for a UAE smart building typically separates: corporate IT, BMS/building automation, physical security (CCTV/access control), and fire/life-safety systems into distinct VLANs or physically separate networks, with tightly controlled, logged inter-VLAN routing only where integration genuinely requires it (e.g. access control triggering a BMS lockdown scene).

Device Identity and Access Policy

Beyond network segmentation, zero-trust design increasingly expects device-level authentication (802.1X for wired ELV devices, certificate-based authentication for IP cameras) rather than relying on network location alone as a trust signal. This is a bigger ask of UAE ELV/ICT vendors than segmentation alone, and should be scoped explicitly in the tender specification rather than assumed as standard.

Doing This Without Breaking System Integration

The most common failure mode is over-segmenting to the point that legitimate integrations (fire alarm triggering CCTV pre-position, access control feeding a visitor management system) become difficult to implement securely. ASDV's network designs map out the specific integration points required at brief stage, then build segmentation and controlled routing rules around those known requirements rather than applying a generic zero-trust template that ends up needing exceptions punched through it later.