The Line Beneath the Floor: Auditing Analog Bypasses in a Zero-Trust Estate

Zero-trust programmes tend to describe a world in which every path is mediated by policy, every device has an identity and every session is logged. The estate beneath the floorboards often tells a different story. A lift phone, an alarm panel, a payment terminal or a modem in a comms cabinet can still depend on an analog line that predates the identity provider and bypasses the controls built around it.

As the UK moves toward the final withdrawal of the public switched telephone network, scheduled for the end of January 2027, these dependencies stop being a curiosity. They become a delivery risk. The carrier deadline will not wait for a trust programme to finish its roadmap. The task is to find the analog paths, understand what they protect and sequence their replacement before a hidden line becomes an unplanned outage.

Why analog paths survive modern programmes

Analog circuits persist because they work, because they are somebody else's responsibility, and because they rarely appear in the places where security teams look. They are installed by lift contractors, fire alarm engineers and facilities teams. They may be recorded in a building manual, an alarm receiving centre contract or a carrier invoice, but not in the configuration management database. The result is a set of trust paths that are operationally real and architecturally invisible.

This is not only a matter of old technology. It is a matter of ownership. A line that nobody owns cannot be reviewed, tested or decommissioned with confidence. It can remain in service long after the system it supported has been replaced, or it can be removed by a carrier during migration without anyone noticing that a safety function depended on it.

Start with contracts, not cable

Discovery should begin with paper and people, not with a tone generator. Reconcile carrier invoices and line inventories against the configuration management database, the service catalogue and site records. Ask facilities managers, lift maintenance providers, fire alarm contractors and alarm receiving centres what they believe is still connected. Check building safety cases, lift emergency communication records and insurance requirements. Then walk the estate.

A useful site survey covers risers, plant rooms, communications cabinets, lift motor rooms, reception desks, tills and service corridors. Record every line with its site, carrier, circuit identifier, connected device, business owner, safety function and contract end date. Label the physical endpoint where possible. Where tracing is needed, use qualified engineers and safe procedures. The aim is not to produce a perfect diagram on the first pass. It is to make the unknown visible enough to govern.

Tier by safety and trust impact, not by age

Not all analog lines carry the same risk. A sensible audit separates them by what happens if the line fails and what happens if the line is abused. Life-safety dependencies come first: lift emergency phones, fire alarm signalling, disabled refuge communications and other systems with a statutory or building safety dimension. Next come security and regulatory paths: intruder alarms, environmental monitoring and out-of-band management. Financial and convenience lines, such as legacy payment devices or fax machines, can follow.

Tiering by criticality alone is not enough. An out-of-band modem may have little safety impact but a high trust impact, because it can provide a path into network equipment that bypasses privileged access management and session logging. A lift phone may have low data sensitivity but a very high availability requirement. The audit should capture both dimensions and make the trade-off explicit.

The bypass problem in zero-trust terms

An analog line cannot present a device identity to a network access control system. It does not join a VLAN, it does not authenticate to a policy engine and it may not produce useful logs. That is precisely why it matters. If the line terminates in a device that can influence building systems or network infrastructure, it is a route around the trust boundary.

Compensating controls should be proportionate. Physical port security, dedicated signalling paths, call filtering and monitored line integrity can reduce exposure in the short term. But obscurity is not a control. Where a line exists only because a replacement has been deferred, the audit should say so plainly and assign an owner and a date.

Sequence replacement without creating a new outage

Migration should be planned by dependency, not by carrier notice. For each line, decide whether to retain, migrate or retire. Replacing analog with voice over IP or cellular signalling can improve observability, but it introduces new dependencies on power, network priority and battery backup. Lift phones need tested emergency power and compatible auto-dialler arrangements. Alarm panels need dual-path signalling and acceptance testing with the alarm receiving centre. Out-of-band management should move toward managed console access with multi-factor authentication and session recording, not simply a different modem.

Test the failure modes, not just the dial tone. Simulate a power failure, a network outage and a carrier migration cutover. Confirm that the alarm receiving centre sees the right signals and that the lift phone still reaches a responder. Update the configuration management database and obtain carrier confirmation when the old line is ceased. A migration that leaves the inventory stale has only moved the blind spot.

Make analog visible to the trust programme

The final step is governance. Add the analog inventory to the audit plan, the risk register and the change board. Give each line an owner. Reconcile the inventory quarterly against carrier records and site changes. Include analog dependencies in incident exercises and resilience reviews. The objective is not to eliminate every copper line by a fixed date. It is to ensure that no path carrying safety signalling or management traffic is unknown, unowned or untested. The carrier deadline is a forcing function, not a strategy.

Zero trust is often described as a journey. In practice it is also a process of discovering what was never in the diagram. The line beneath the floor deserves a place in that process before the carrier removes it for you.