Network Segmentation for Parking Operational Technology: Isolating OT from IT

Parking facility networks occupy an uncomfortable position in enterprise IT security architectures. They are typically managed by facilities or operations teams rather than IT security, they contain payment-processing equipment that falls under PCI DSS, and they are increasingly connected to the corporate network for centralized management — creating a pathway between IT and operational technology (OT) that security teams often underestimate.

This article covers the network segmentation principles and technical approaches that reduce risk in parking OT environments and satisfy PCI DSS segmentation requirements.

The IT/OT Boundary in Parking Facilities

Operational technology in parking facilities includes: PARCS controllers and servers, access control panels, pay stations, LPR cameras, occupancy sensors, intercom systems, and EV charging management. These systems have distinct security characteristics compared to corporate IT:

Longer lifecycles: OT equipment may run for 10–15 years. Software patching is less frequent, and some legacy equipment cannot receive patches at all. Systems designed before modern security practices may have fundamental vulnerabilities that cannot be remediated.

Real-time operational requirements: Unlike most IT systems, OT systems often cannot tolerate the latency or availability interruptions that security controls (antivirus scanning, deep packet inspection, frequent policy updates) can introduce.

Physical safety and revenue implications: A misconfigured firewall rule that blocks a corporate email server causes inconvenience. A firewall rule that prevents a gate controller from communicating with the PARCS server locks vehicles in a parking structure.

These characteristics make a “bolt on security to the existing IT model” approach inappropriate. Parking OT requires security architecture designed specifically for its characteristics.

Network Segmentation Architecture

VLAN Design for Parking Environments

VLANs (Virtual Local Area Networks) are the foundational segmentation tool for parking OT networks. Recommended VLAN structure:

Management VLAN: Administrative access to parking equipment — switches, AP management, server management interfaces. Strict access control; only authorized administration workstations.

PARCS OT VLAN: PARCS controllers, access control panels, gate operators, and their management servers. This VLAN contains the core access and revenue infrastructure.

Payment VLAN: Pay stations and payment processing servers. This VLAN may require heightened PCI DSS controls due to cardholder data handling.

Camera VLAN: LPR and surveillance cameras. Camera traffic is high-bandwidth video; isolating it prevents camera traffic from competing with control traffic on shared segments.

IoT/Sensor VLAN: Occupancy sensors, environmental monitors, and other IoT devices. These devices often have minimal security controls and should be isolated from more sensitive OT systems.

Guest/Public WiFi VLAN: Any public-facing wireless networks must be strictly isolated from all OT VLANs with no lateral movement possible.

Firewall Rules Between VLANs

VLAN isolation without firewall-enforced access control between VLANs provides weaker protection than it appears — a single misconfigured routing rule can expose all VLANs simultaneously. Inter-VLAN traffic should traverse a firewall (or router with ACLs) with explicitly defined allowed flows:

Allowed flows to document:

• PARCS server to/from lane controllers (specific ports)
• Management workstation to PARCS server (specific management ports)
• PARCS server to payment gateway (HTTPS/TLS to specific IP ranges)
• Camera VLAN to video management server (specific port)
• OT VLAN to time server for NTP synchronization

Default deny: All inter-VLAN traffic not explicitly permitted should be denied. This “default deny” posture prevents undocumented communication paths from becoming exploitation vectors.

PCI DSS Scope Reduction Through Segmentation

Pay stations and payment processing systems that handle cardholder data fall within PCI DSS scope. The scope of a PCI DSS assessment is determined by which systems can communicate with in-scope cardholder data environments (CDE) — systems with routes to the CDE are themselves in scope unless demonstrably segmented.

Effective network segmentation reduces PCI DSS scope by isolating the payment environment from other systems:

Scope reduction through segmentation: If the payment VLAN containing pay stations is accessible only from the PARCS management server (which has no pathways to corporate network systems), the PARCS server itself enters PCI DSS scope but the broader corporate network does not.

Segmentation testing: PCI DSS requires that segmentation be tested at least annually — verifying that systems outside the cardholder data environment cannot communicate with in-scope systems. This testing should be performed using penetration testing techniques, not just firewall rule review.

Documentation requirements: PCI DSS auditors require documented network diagrams showing all in-scope components, their communication flows, and the segmentation controls isolating them from out-of-scope systems.

Remote Access Security for Parking OT

Parking facility management increasingly involves remote access — vendor technicians, centralized operations centers, and management staff accessing systems remotely. Remote access to OT environments is one of the most exploited entry points in operational technology attacks.

VPN requirements: Remote access to parking OT should require VPN with multi-factor authentication (MFA). Direct internet exposure of parking OT management interfaces (web UIs accessible from the public internet) is not acceptable.

Vendor remote access: Third-party vendor access should be provided through controlled mechanisms — time-limited access credentials, session recording, jump server architecture that prevents vendors from directly accessing production systems. Permanent always-on VPN credentials provided to vendors are a common vulnerability.

Just-in-time access: Remote access credentials that are active only during authorized maintenance windows reduce the exposure window. Many commercial privileged access management (PAM) solutions support just-in-time provisioning.

Monitoring and Anomaly Detection

Segmentation prevents lateral movement; monitoring detects when segmentation has been bypassed or when anomalous activity occurs within segments.

NetFlow analysis: Monitoring traffic flows between VLANs for deviations from established baselines. An occupancy sensor VLAN suddenly generating outbound SMTP traffic is anomalous and warrants investigation.

Log aggregation: Central logging of authentication events, firewall blocks, and VLAN access from all parking OT devices. Without centralized logging, investigating an incident requires collecting logs from each system individually — a process that takes days and may miss correlated events.

Intrusion detection: IDS/IPS tuned for OT protocols and parking system communication patterns. OT-aware IDS rules distinguish legitimate PARCS controller traffic from potentially malicious traffic that follows the same protocol.

FAQ

Does VLAN segmentation alone satisfy PCI DSS segmentation requirements? VLAN segmentation is a valid technical approach, but PCI DSS specifically requires that segmentation be effective — meaning it is correctly configured, tested, and monitored. VLANs without firewall-enforced inter-VLAN access controls may not satisfy this requirement, as VLAN isolation can be bypassed by misconfigured routing. Firewall enforcement is the standard for demonstrating effective segmentation.

How should parking operators handle the connectivity requirement for cloud-managed parking systems? Cloud-managed PARCS platforms require outbound connectivity from the OT network to the cloud management platform. This connectivity should be allowed only to specific, documented cloud service endpoints over HTTPS, with DNS resolution for those endpoints restricted to a known DNS server. Monitor for unexpected outbound connections from OT devices, which may indicate compromise.

What is the recommended approach for parking facilities connected to a building management system (BMS)? BMS integration — for HVAC, lighting, and elevator control that may need to coordinate with parking operations — should be implemented through a dedicated, monitored interface zone rather than allowing direct network access between the BMS network and the parking OT network. Shared network access between BMS and parking OT creates a propagation path for security incidents.

Are there specific frameworks for OT security in parking facilities? The NIST Cybersecurity Framework (CSF) and IEC 62443 (Industrial Automation and Control Systems security) are the most applicable standards for parking OT security architecture. IEC 62443-3-3 specifically addresses system security requirements for control systems and provides a zone/conduit model that translates well to parking OT network segmentation design.