A shared network may connect a charging point, an access control system, a boiler room, a lift or other equipment. The problem appears when every device and every contractor shares the same access for years. A co-ownership should at the very least know which equipment is connected, who holds the administration rights, how access is separated and how the data is processed.
Why does a shared password end up becoming a problem?
Because a password handed to several people is no longer really a secret.
It may stay with a former contractor, a co-owner who has moved out, or on a datasheet forgotten in a plant room.
Cybersecurity therefore starts less with a sophisticated product than with a question of governance: who has access to what?
Should the technical equipment be isolated?
Good security practice recommends limiting access rights and separating uses that have no reason to talk to one another.
BEE SECURE points in particular to the importance of updates, strong passwords, encryption and the management of access rights for connected objects.
The precise configuration is a matter for a professional: there is no network design valid for every building.
Who should administer the system?
The co-ownership needs to know who actually administers the connection, the procedure for changing the password, and how access is handed over when a contractor or a syndic changes.
A network whose administrator nobody knows is already a problem, even before any attack.
And personal data?
Where equipment collects identifiers, access logs, images or other data relating to people, the GDPR applies.
The association may be the controller; a contractor processing the data on its behalf has to be covered by a processing agreement. Retention also has to be limited and the people concerned informed.
If data is sent to a cloud service outside the European Union, the rules of Chapter V of the GDPR on international transfers also have to be examined.
Should residents be offered the same Wi-Fi?
It is better not to turn the building's technical network into a collective internet connection.
Providing internet access to occupants raises separate questions of liability, security and possibly the status of the service. They have to be dealt with separately before the network is opened up.
What should you ask a supplier of connected equipment?
A few answers are enough: what connection is needed, who administers the equipment, how updates are carried out, what data leaves the building and how access is transferred when the contractor changes.
These questions cost far less before the installation than after five years of dependence on equipment whose password nobody knows.