.webp)
Morgan Stanley Replaced Manual VLAN Management with Automated Micro-Segmentation to Stop a Hacked Camera from Reaching the BMS
Creating Connected Buildings through a horizontal architecture means converging multiple systems onto the same network so they can communicate with one another. From an OT device management perspective, that creates a new problem: when one of those devices gets hacked, nothing is stopping it from reaching every other system on the network.
Grace Lai, Executive Director at Morgan Stanley, brought this concept to the NexusCast stage. Her premise: in most enterprise portfolios, IoT and OT devices already outnumber traditional PCs. Most ship with operating systems but without the security mindset standard on a corporate laptop. Most network architectures are flat, meaning lateral movement between devices is the default after a single breach.
Morgan Stanley's response is built around two technologies: Software Defined Access and Scalable Group Tags, or SDA and SGT. Together, they let devices share a network while controlling who they can talk to. Every device gets a tag based on its type, and the tags carry rules defining legitimate communication. A BMS server should never need to talk to a printer, so it can't. But a BMS does need to communicate with lighting controls or occupancy sensors to support occupancy-driven adjustments, so those conversations are permitted. The architecture lets the network know what "normal" looks like.
Where SGT really earns its keep is in automation. Traditional VLAN management requires manual per-host curation, which quickly becomes unwieldy as devices multiply across a portfolio. Lai noted that manually managed VLANs quickly fall out of sync at any real scale. SGT tags get applied at runtime by device type, not by individual host. That's what lets Morgan Stanley run this as a "golden template" across its portfolio rather than reinvent the architecture building by building.
A horizontal, converged network is what makes a Connected Building possible, and what makes new operational use cases like occupancy-driven controls real. But it's also what gives a single compromised device a path to every other system. That trade-off is what raises the bar on cyber posture. SDA and SGT are how Morgan Stanley is keeping the path open for use cases without leaving it vulnerable to threats.
Register for the next Nexus Labs event.
Sign up for the newsletter to get 5 stories like this per week:
Creating Connected Buildings through a horizontal architecture means converging multiple systems onto the same network so they can communicate with one another. From an OT device management perspective, that creates a new problem: when one of those devices gets hacked, nothing is stopping it from reaching every other system on the network.
Grace Lai, Executive Director at Morgan Stanley, brought this concept to the NexusCast stage. Her premise: in most enterprise portfolios, IoT and OT devices already outnumber traditional PCs. Most ship with operating systems but without the security mindset standard on a corporate laptop. Most network architectures are flat, meaning lateral movement between devices is the default after a single breach.
Morgan Stanley's response is built around two technologies: Software Defined Access and Scalable Group Tags, or SDA and SGT. Together, they let devices share a network while controlling who they can talk to. Every device gets a tag based on its type, and the tags carry rules defining legitimate communication. A BMS server should never need to talk to a printer, so it can't. But a BMS does need to communicate with lighting controls or occupancy sensors to support occupancy-driven adjustments, so those conversations are permitted. The architecture lets the network know what "normal" looks like.
Where SGT really earns its keep is in automation. Traditional VLAN management requires manual per-host curation, which quickly becomes unwieldy as devices multiply across a portfolio. Lai noted that manually managed VLANs quickly fall out of sync at any real scale. SGT tags get applied at runtime by device type, not by individual host. That's what lets Morgan Stanley run this as a "golden template" across its portfolio rather than reinvent the architecture building by building.
A horizontal, converged network is what makes a Connected Building possible, and what makes new operational use cases like occupancy-driven controls real. But it's also what gives a single compromised device a path to every other system. That trade-off is what raises the bar on cyber posture. SDA and SGT are how Morgan Stanley is keeping the path open for use cases without leaving it vulnerable to threats.
Register for the next Nexus Labs event.
Sign up for the newsletter to get 5 stories like this per week:
This is a great piece!
I agree.