Smart-Building Cybersecurity

This series distils the technical richness of the Building Management System (BMS) & Building Automation System (BAS) Cybersecurity Handbook into three easily shareable articles. Part 1 outlines why structures have become cyber targets. Part 2 analyses a genuine building-protocol assault. Part 3 describes the ransomware journey, from phishing email to blocked data center, and how to break it.

Defense in depth for smart buildings: the theme running through all three articles.

Part 1: Your Building Automation Systems Are Computers Now (and Attackers Know It)

The Building Management Infrastructures is linked to the Heating, Ventilation, and Air Conditioning (HVAC) system. The cybersecurity risk associated with interconnected building systems is also present. For decades, the systems that heat, cool, illuminate, and safeguard our buildings have been in their own universe, with serial wires, proprietary panels, and a technician with a laptop in the plant room. There is no such world anymore. Today’s Building Management System (BMS) and Building Automation System (BAS) are IP-connected, cloud-integrated computers that act as management systems for various building systems across broader building infrastructure, integrating HVAC systems, lighting controls, security systems, fire safety, and other building services as core building functions. Any computer connected to a network is vulnerable to attack.

The painful fact is that building control systems were created for dependability and safety, not security. They rely on antiquated protocols with little or no authentication, operate on rarely patched firmware, and are increasingly interconnected with corporate IT networks and the internet creating high-value targets that are often inadequately protected. Regular security audits identify vulnerabilities in building.

Why a Cyberattack on a Building Is Different

When an email server is compromised, you lose data. When a building system is compromised, you may lose control over the physical environment. That kind of threat is essentially different:

• Manipulating HVAC, fire, or access-control systems can pose a direct threat to the safety of people inside the premises.
• Cooling loss may quickly shut down a data center or manufacturing line, affecting business continuity.
• A flat building network is a common entry point for corporate IT, as evidenced by a 2013 retail hack that started with HVAC vendor access.
• Operational Technology (OT)-aware ransomware can encrypt building processes in addition to data.

Traditional vs. Smart Buildings

Smart buildings provide significant improvements in energy efficiency, sustainability, and tenant experience. However, every sensor, gateway, and cloud dashboard in smart building solutions adds to the attack surface as connected technology systems and iot devices, even as they help optimize energy usage and support energy management.

What History Teaches Us

Three recurring factors account for nearly all major control-system incidents: inadequate network segmentation, unprotected remote access, or inadequate credential hygiene. From a retail facility compromised through an HVAC provider to a steel mill physically damaged by a phishing attack, and power-grid operators locked out of their own HMIs, the pattern is consistent. More importantly, these risks are persistent but manageable: established secrurity controls and mitigations can address them. You* cannot defend something you cannot perceive. An accurate asset inventory is the first control, not the last.*

Five Moves That Move the Needle

1. Treat the building network as production OT and not “just facilities”, managed by a robust security policy with building managers and facility management teams enforcing it.
2. Create and maintain an asset inventory for all controllers, gateways, and sensors with facility managers.
3. Separate OT and IT with a true DMZ barrier, not a common VLAN.
4. Implement multi-factor authentication and logged remote access for all vendors and engineers.
5. Use a recognized framework, such as NIST CSF 2.0 or ISA/IEC 62443, as the foundation of your program.

Part 2: The Unlocked Front Door: Access Control and Inside a BACnet Attack

There is no password for the protocol that powers your building. If you operate a contemporary building, you are probably using BACnet, the main protocol for HVAC, lighting systems, and other building functions managed through building automation systems. It is trustworthy, interoperable, and available everywhere. It also has an unusual attribute in its natural form: no authentication or encryption. Any device that can connect to the network may read and write control points. Now, let’s open the hood.

How BACnet Works

BACnet represents each device as a collection of objects such as Analog Inputs and Outputs, Binary Values, Schedules, and Trend Logs each with defined attributes, including Present_Value and Out_of_Service. Devices communicate using a minimal number of service primitives across automation systems and management software that connect building networks. Some of these capabilities can be highly dangerous when in the wrong hands, yet remain innocuous in routine daily operation:

• Discovery broadcast: Who-Is/I-Am. One global Who-Is causes every gadget to announce itself: immediate inventory.
• Read Property provides valid polling and helpful reconnaissance.
• The Write Property service can alter a setpoint or force an output, making it one of the most hazardous primitives in the protocol.DeviceCommunicationControl disables a controller’s communication as a protocol-native denial of service.

Network access to BACnet is especially risky because many legacy systems on these paths lack modern security features.

The Priority Array: A Covert Backdoor

Commendable BACnet outputs employ a 16-slot priority array. Normal control logic typically writes at lower priorities (8-16), while manual life-safety overrides use the highest-priority slots (1-2). An attacker who writes at priority 1 can seize control of an output, preventing legitimate control software from overriding the command until it is surrendered. More concerning, simply inspecting Present_Value may not reveal the malicious command; defenders must examine the entire priority array.Examining just Present_Value while the output is being held by a priority-1 write is like making sure the door is closed while someone is holding it shut from the opposite side.

Anatomy of an Unauthorized-Write Attack

Anatomy of an unauthorized BACnet write from network foothold to physical impact.

1. Gain access to any segment that can transport BACnet/IP (UDP 47808) to the controller VLAN.
2. Conduct a worldwide Who-Is and gather I-Am responses to create a device map.
3. Use object lists to find a specific target, such as an air conditioning systems controller or a ventilation systems setpoint.
4. Use a high-priority Write Property command to force a hazardous state, such as disabling cooling in a data hall.
5. Implement DeviceCommunicationControl to prevent operators from readily reverting to previous settings.

It’s not a theory though security researchers have been demonstrating this concept on flat networks at public conferences for years. It is simple to use on an unsegmented building network. Flat building networks and unsecured wireless networks can expose connected IoT devices to cyber attacks.

Closing the Door: A Layered Defense

These protections improve system performance and help preserve optimal building performance.

A detection that you can use the following day: Flag any Write Property, DeviceCommunicationControl, or Reinitialize Device request originating from an IP address outside the authorized supervisory allow-list, and correlate with recent Who-Is reconnaissance from the same host. This produces a low noise, high-confidencedetection signal.

Part 3: From Phishing Email to Frozen Data Center

OT ransomware does not start in OT; it begins within your email. Most people overlook this unexpected turn of events: the ransomware that brings down a building rarely starts inside the building. It starts with a phishing email or an open remote-access port in typical corporate IT, then pivots into OT. An office-level virus turns into a physical outage if there is no coordination between IT and OT that regulates power and cooling.

The Kill Chain, Mapped to Your Architecture

The Purdue model is used by security teams to represent layers of a control environment, starting with corporate IT (Levels 4/5) and ending with controllers and physical processes (Levels 0-1), with an OT DMZ (Level 3.5) in between. Mapping the ransomware death chain into those levels shows the precise location of a break-point control.

The ransomware kill chain from initial IT access to OT impact and the DMZ as the point to break it.

Why Buildings Are Uniquely Exposed to Cybersecurity Measures

• Hospitals and data centers in commercial buildings have limited maintenance periods, allowing outdated malware to persist and hurt building performance.
• Many BMS servers use outdated Windows operating systems that cannot support contemporary endpoint protection without manufacturer approval; these older servers are legacy systems that may lack modern security features.
• Enterprise backups typically exclude controller configurations and BMS databases, creating backup blind spots.

A building management system can improve operational efficiency and reduce operational costs through automation, but only if it is maintained and secured properly.

Break the Chain: Defense That Works

1. A real IT/OT DMZ and Network Segmentation

Every cross-boundary flow should be terminated and restarted so IT and OT do not operate as a single system across the boundary. A replica history is written by OT and read by IT, while a jump host coordinates all remote sessions. Zero Trust architecture enhances security by requiring continuous verification even when traffic crosses approved paths. No single session flows directly from an office laptop to a controller. The pivot is killed by just one design choice.

2. Zero-Trust identity

Network location no longer confers trust; identification does, and building owners should ensure building managers and facility management staff follow centralized identity controls for remote access. Federate accounts to a central directory using phishing-resistant MFA, remove shared local admin accounts, and route every privileged session through a PAM tool that provides just-in-time, documented access. Credentials that have been harvested become far less useful, while artificial intelligence can support data analysis for access anomalies and automate responses to security incidents.

3. Recovery you have tested

1. Maintain offline, immutable backups of BMS servers, historian databases, and controller programs.
2. Maintain gold master images to rebuild HMIs and servers in hours rather than days.
3. Document and practice manual/safe-state operations to ensure building continuity after system restoration.
4. During an incident, isolate the IT/OT border first to prevent encryption of OT backups.

Frequently Asked Questions

1. Is BACnet insecure by design, or can it be secured?

BACnet itself has no built-in authentication or encryption, any device on the network can read and write control points by default. That’s a protocol limitation, not necessarily a fatal flaw. It can be secured through layered fixes: confining BACnet traffic to its own VLAN, blocking UDP 47808 between zones, and migrating to BACnet/SC that adds TLS 1.3 encryption and certificate-based mutual authentication. The protocol’s openness is what makes it interoperable in the first place, so the goal isn’t replacing it, it’s containing what an unauthenticated write can reach.

2. What is the BACnet priority array, and why can’t I just check Present_Value to see if something’s wrong?

The priority array is a 16-slot mechanism where higher-priority writes (like life-safety overrides) can seize control of an output and block lower-priority commands, including legitimate ones, until released. An attacker writing at priority 1 can hold an output hostage while Present_Value shows nothing unusual; the value looks normal because the override sits above it in the stack. Detecting this requires inspecting the full priority array, not just the current value, which is why monitoring should specifically flag writes to priority slots 1–2 from non-supervisory hosts.

3. Why would a phishing email sent to an office employee end up shutting down a data center’s cooling?

Since OT ransomware rarely starts in OT, it starts with a compromised IT credential or endpoint, then moves laterally until it finds a path into the building network. If there’s no boundary between corporate IT and OT (just a shared VLAN, for example), that lateral movement can reach BMS servers and controllers directly. Mapped to the Purdue model, the breakpoint is the IT/OT DMZ: a properly brokered DMZ terminates every cross-boundary session instead of letting traffic flow straight from an office laptop to a controller. Thiscan stop a phishing incident from becoming a physical outage.

4. What’s the difference between putting building systems on their own VLAN and building a true IT/OT DMZ?

A VLAN separates traffic logically but often still allows routing between zones if a firewall rule is missed or misconfigured as it’s a tag, not a hard boundary. A true DMZ terminates and restarts every session that crosses it: OT writes to a replica historian that IT reads from, and remote access goes through a jump host rather than a direct connection. That means no single session ever flows straight from an IT endpoint to an OT controller. It’s a stronger control because it removes the direct path entirely, rather than relying on rules that can drift or get bypassed.