Building automation systems (BAS) were designed for reliability, not security. Many were installed on isolated networks with default passwords, unencrypted protocols and no expectation that anyone outside the mechanical room would ever reach them. That has changed. Today a BAS is usually connected to the corporate network, a cloud analytics platform, a vendor's remote support service or all three.
An insecure BAS is a real risk. An attacker could change setpoints in a data centre or hospital, disable equipment, or use the BAS as a foothold to reach the business network. This guide covers the practical measures owners, facility managers and contractors can take to reduce that risk without compromising how the HVAC system operates.
Why BAS networks are vulnerable
Several characteristics make building controls an attractive target:
- Legacy protocols. BACnet/IP, Modbus TCP and LonWorks were designed without authentication or encryption. Any device on the network that speaks the protocol can usually read and write points.
- Long equipment life. Controllers often stay in service for 15 to 25 years, well beyond the period in which their operating systems or firmware receive security updates.
- Default credentials. Supervisory controllers and web interfaces are frequently left with vendor default usernames and passwords.
- Unmanaged remote access. Contractors may install modems, remote desktop software or port forwarding to make service calls easier, sometimes without the owner's knowledge.
- Unclear ownership. IT departments may not consider the BAS their responsibility, and facilities teams may not have cybersecurity expertise. Gaps between the two are where problems appear.
A layered approach
No single control makes a BAS secure. The goal is defence in depth: several independent layers so that the failure of one does not expose the whole system. Frameworks such as the NIST Cybersecurity Framework and the ISA/IEC 62443 series for industrial automation and control systems provide structure, and the Canadian Centre for Cyber Security publishes guidance on operational technology that applies to building systems.
1. Inventory
You cannot protect what you do not know about. Build an inventory of every networked BAS device: supervisory controllers, field controllers on IP, servers, workstations, gateways and integration devices for lighting, metering or access control. Record model, firmware version, IP address, location and who has access.
2. Network segmentation
Place the BAS on its own network segment, separated from the corporate network by a firewall. Only specifically required traffic should pass between them, for example from an operator workstation to the BAS server. Within larger systems, further segmentation between buildings or system types limits how far an intruder can move.
BACnet/IP relies on broadcast messages for device discovery, so segmentation must be planned with the controls contractor. BACnet Broadcast Management Devices (BBMDs) or Foreign Device Registration are used to pass BACnet traffic between subnets, and they should be configured to accept connections only from known devices.
3. Secure remote access
Remote access is necessary for service and monitoring, but it is also the most common entry point. Good practice includes:
- All remote access through a single managed path, such as a virtual private network (VPN) or a secure remote access gateway, controlled by the owner.
- Multi-factor authentication for every remote user.
- Individual accounts for each technician, not shared logins.
- Access enabled only when needed, with sessions logged.
- No direct exposure of BAS web interfaces or BACnet ports to the internet.
4. Accounts and passwords
Change all default passwords during commissioning. Use unique, strong passwords and role-based accounts so that operators can view and adjust setpoints while only administrators can change programming. Remove accounts for staff and contractors who no longer need access.
5. Patching and lifecycle
Apply firmware and software updates from the manufacturer on a planned schedule, tested first where possible. When devices reach end of support, plan their replacement as part of the capital program. A BAS upgrade or migration is often the best time to fix fundamental security weaknesses.
6. Monitoring and backup
Log access and configuration changes. Keep current offline backups of controller programs, graphics and databases so that the system can be restored after a failure or attack. Test restoration occasionally.
BACnet Secure Connect
BACnet Secure Connect (BACnet/SC) is an addition to the BACnet standard (ASHRAE Standard 135) that adds encryption and certificate-based authentication. Instead of broadcasting on a local network, BACnet/SC devices connect through a secure hub using TLS over WebSocket connections, which works more naturally with IT network practices.
BACnet/SC does not make older devices secure, and it requires planning for certificate management. For new projects and major upgrades, owners should ask whether the proposed products support it and whether the supervisory layer can use it even if field devices on MS/TP cannot. See BACnet basics for building owners for background on the protocol.
Responsibilities on a project
| Party | Cybersecurity responsibilities |
|---|---|
| Owner | Sets requirements, owns accounts and remote access, coordinates IT and facilities |
| Design engineer | Specifies network architecture, security features, protocols and documentation |
| Controls contractor | Implements segmentation, changes defaults, documents devices, provides backups |
| IT department | Manages firewalls, VPN, monitoring and integration with corporate policies |
| Commissioning agent | Verifies that specified security measures are in place at turnover |
Writing cybersecurity requirements into the controls specification is the most effective step. Without them, contractors will deliver whatever is quickest to commission. Requirements should cover network architecture, credential management, remote access, supported encryption, documentation and handover of all passwords to the owner.
A quick assessment checklist
Owners can start with these questions:
- Do we have a current list of every networked BAS device and its firmware version?
- Is the BAS separated from the corporate network by a firewall?
- Are any BAS interfaces reachable directly from the internet?
- How do contractors connect remotely, and who approves it?
- Have all default passwords been changed, and do we hold the administrator credentials?
- Are controller programs and databases backed up, and when was a restore last tested?
- Which devices are past the end of manufacturer support?
A "no" or "not sure" on any of these is a good reason to schedule a review with IT and the controls contractor.
Frequently asked questions
Should the BAS be on the same network as corporate IT?
It can share physical infrastructure, but it should be on a logically separate network segment, such as a dedicated VLAN behind a firewall, with tightly defined rules for what traffic may cross.
Is a cloud-connected BAS less secure?
Not necessarily. A well-designed cloud connection with outbound-only traffic, encryption and strong authentication can be more secure than an unmanaged remote desktop tool. The design of the connection matters more than whether it reaches the cloud.
Key takeaways
- Most BAS protocols were not designed with security in mind, and many installed systems have default passwords and unmanaged remote access.
- Start with an inventory, then segment the BAS network behind a firewall.
- Control remote access through one owner-managed path with multi-factor authentication and individual accounts.
- BACnet Secure Connect adds encryption and authentication for new and upgraded systems.
- Put cybersecurity requirements in the controls specification and verify them at turnover. Our building automation and BACnet work includes reviewing these requirements.
Talk to an engineer
Have a project or a problem this guide touches on? Tell us about the building and we’ll be in touch within one hour.