Network Security for Building Digital Signage

Every screen on a building network is a small computer. Left with default settings, it can be a way into the network, or a way for someone to put content on your lobby wall that you'd rather not see. Directors are right to ask about it.

The risks

• Unauthorized content. A compromised player or management account could display anything.
• A foothold on the network. If screens share a network with building systems (access control, cameras, building automation, office computers), a weak device can expose the others.
• Disruption. Screens taken offline or stuck on an error message.

Good practice

Separate the screens

Screens should sit on their own network segment (a separate VLAN or a dedicated network), isolated from management computers, access control, cameras and building automation. If a player is compromised, the damage stays contained.

Change every default

Default usernames and passwords on displays, players and network equipment are the most common weakness. Each should have a unique, strong credential, stored securely.

Turn off what isn't needed

Disable unused services and ports on players and displays. Lock physical buttons and remote-control inputs so passers-by can't change settings.

Update regularly

Players, displays and signage software receive security updates. Someone needs to apply and test them, on a schedule.

Control remote access

Remote management should use secure, authenticated connections, ideally initiated outbound from the player, with no open inbound ports on the building's internet connection.

Limit who can post

Management accounts in the signage software should be individual (not one shared login), with only the permissions each person needs. Remove accounts when staff leave.

Keep a log

A record of who posted what, and when, helps if something unexpected appears.

Wireless screens

Where screens use Wi-Fi, they should connect to a dedicated, secured network for signage, not the residents' amenity Wi-Fi or the management office network.

Physical security

Recessed installations help here: the player and cables are inside the wall, not hanging behind a screen where someone could plug in a device.

Who's responsible

Ask any contractor how they handle each of these, and who is responsible for updates after installation. On our projects, network design and security are part of the installation, and ongoing updates are part of the managed service.