Episode Description:
Building automation systems are more connected than ever. That connectivity brings new capabilities, but it also changes what you need to know to design, install, and maintain them responsibly.
In this episode, we explore IP security fundamentals through the lens of building automation. You’ll get a practical framework for thinking about where vulnerabilities can emerge, how building networks differ from traditional IT environments, and why cybersecurity is becoming a core competency for controls professionals.
If IP addresses, VLANs, firewalls, remote access, or cybersecurity frameworks have felt like someone else’s responsibility, this episode will help you understand how they connect to the systems you work with every day.
Topics Covered
As building systems become more connected, understanding how to protect those connections becomes part of doing the job well.
Click here to download or listen to this episode now.Podcast Video
Building automation has changed. Systems that once operated on isolated wiring and proprietary protocols now connect to IP networks, remote users, enterprise systems, cloud services, and third-party vendors.
That connectivity makes buildings more capable. It also creates security considerations that building automation professionals need to understand.
Cybersecurity is no longer limited to the IT department. If you design, install, commission, service, or operate building automation systems, network security has become part of the technical environment you work in.
Episode 558 of the Smart Buildings Academy Podcast explores IP security fundamentals specifically through the lens of building automation. Here are the core concepts that help explain why security matters and how to think about it.
For much of the history of building automation, systems benefited from what is sometimes called security through obscurity.
Controllers communicated across dedicated wiring. Protocols were specialized. Systems were often physically separated from enterprise networks and the internet.
That environment has changed.
Modern controllers have Ethernet connections. Supervisory software runs on networked servers. Technicians connect remotely. Facility teams use dashboards from computers and mobile devices. Vendors may maintain remote connections for service and troubleshooting.
Every connection expands what the system can do, but it also creates another potential pathway into the controls environment.
The consequences can extend beyond losing access to software. Building automation systems can influence temperature, airflow, pressure, equipment operation, and other physical processes. In facilities such as hospitals and data centers, those processes can have significant operational consequences.
Building automation can also become an entry point into a larger organizational network when third parties have remote access.
Security therefore starts with recognizing that a BAS is no longer an isolated control system. It is a networked system that interacts with other networked systems.
You do not need to become a network engineer to understand building automation security. You do need a working mental model of IP networking.
Three concepts are particularly important: IP addresses, ports, and protocols.
An IP address identifies a device on a network. A subnet determines which portion of that address represents the network and which identifies the individual device.
Devices on the same subnet can generally communicate directly. Communication between different subnets must pass through a router or Layer 3 switch.
That boundary matters for security.
Once traffic must pass through a defined point to travel between networks, organizations gain a place where that traffic can be controlled, filtered, inspected, or blocked.
Ports provide another level of distinction.
If an IP address identifies the device, a port identifies the service running on that device. A controller or server may have several services operating simultaneously, each associated with particular ports.
Building automation professionals should know which services their systems actually require. Understanding legitimate traffic makes it possible to identify which communications should be permitted and which should not.
Protocols complete the picture.
Protocols establish the rules devices use to exchange information. Building automation relies on protocols designed to make communication between controllers, supervisors, and other devices possible.
Many legacy building protocols were created for environments where devices on the network were assumed to be trusted. Authentication and encryption were not always fundamental parts of those original designs.
That history matters because a modern IP network can expose older assumptions to a much larger environment.
A common cybersecurity model is the CIA triad: confidentiality, integrity, and availability.
Each concept has a direct application to buildings.
Confidentiality concerns who can see information. Building systems can contain credentials, occupancy information, schedules, equipment details, network information, and other data that should not be available to unauthorized users.
Integrity concerns whether information and commands can be trusted.
This is especially important for control systems. A BAS does not simply store information. It sends commands that affect physical equipment.
Changes to setpoints, overrides, sensor information, or controller outputs can alter how a building operates.
Availability concerns whether systems remain operational when they are needed.
For many control environments, availability is critical. Losing access to ventilation, environmental controls, or supervisory systems can have immediate operational consequences.
This can create a different set of priorities from those found in traditional business IT environments. Controls teams and IT teams need to understand those differences when developing security practices together.
One of the most useful concepts in cybersecurity is defense in depth.
The idea is straightforward: do not depend on one security control.
Any individual protection can fail. Multiple independent layers make it harder for the failure of one control to expose the entire system.
For building automation, those layers can include network segmentation, traffic filtering, authentication, encryption, controlled remote access, patch management, monitoring, and physical security.
The objective is not to find one product that solves security. The objective is to design a system in which multiple protections work together.
Network segmentation is one of the foundational concepts in BAS security.
A flat network allows devices to communicate broadly across the same environment. If building controllers share that environment with office computers, printers, guest devices, and unrelated systems, a compromise elsewhere can create a pathway toward the controls system.
Segmentation separates systems logically.
VLANs are commonly used to divide a shared physical network into separate logical networks. Building controls might reside on one VLAN while enterprise computers, cameras, or other systems reside on others.
Communication between those environments then passes through controlled boundaries.
Another useful concept is zones and conduits.
A zone groups devices with similar security requirements. A conduit defines the approved communication path between zones.
This approach forces an important design question:
Does this communication actually need to cross the boundary?
If it does, the next questions are what type of traffic is required, where it should originate, where it should go, and which direction it needs to travel.
That moves the network away from allowing everything by default and toward permitting only the communication necessary for operation.
Segmentation establishes boundaries. Firewalls and access control lists help determine what can cross them.
A firewall can evaluate traffic based on its source, destination, port, and protocol. This allows network designers to create rules around the communication a building system actually requires.
Access control lists can perform similar filtering functions on network infrastructure such as switches and routers.
The underlying principle is least privilege.
A device, account, or network connection should receive the access necessary to perform its job, rather than broad access that might be convenient but unnecessary.
Applying that principle to network traffic reduces the number of available pathways through the system.
Sophisticated security architecture loses much of its value when devices still use default credentials.
Controllers, servers, gateways, and other devices may ship with standard usernames and passwords. If those credentials remain unchanged, anyone who knows the defaults and can reach the device may have an easy way inside.
Identity management extends beyond changing default passwords.
Organizations also need to consider individual user accounts, appropriate permissions, password management, multi-factor authentication where supported, and removal of accounts that are no longer required.
Shared administrative credentials make it harder to determine who performed an action. Excessive permissions give users access they do not need. Old contractor or employee accounts can remain as forgotten entry points.
The same least privilege principle that applies to network communication applies to users.
Remote access is valuable in building automation.
A technician can diagnose a problem without traveling to the facility. A vendor can support installed equipment. Facility teams can reach systems from outside the building.
The security problem occurs when that convenience creates direct exposure.
Control devices should not simply be placed on the public internet where their interfaces can be discovered and continuously probed.
Remote connectivity should instead pass through a controlled, authenticated, and encrypted entry point.
Vendor access deserves the same attention.
Third-party connections should not become permanent, unmonitored pathways into the controls network simply because they are convenient. Organizations need to know who can connect, when they can connect, what they can access, and when that access should be removed.
Asset inventory is easy to overlook because it does not sound like a security technology.
It is also foundational.
You cannot protect a device you do not know exists.
Without an accurate inventory, teams may not know which controllers are installed, which software versions they use, whether updates are available, or whether outdated equipment remains connected.
Patching building automation systems also requires different considerations than patching an office computer.
Controllers and supervisory systems may operate continuously. Updates can require downtime. Changes may need to be tested before deployment to make sure they do not interfere with building operations.
That operational reality does not eliminate the need for patching. It creates the need for a managed process involving inventory, assessment, testing, scheduling, and documentation.
Prevention is only one part of cybersecurity.
Organizations also need the ability to recognize unusual activity.
Logs can provide records of login attempts, configuration changes, network connections, and other events. Monitoring turns those records into useful information by looking for behavior that differs from normal operation.
Building automation has an advantage in this area.
Control networks can be highly predictable. The same controllers often communicate with the same supervisory systems in consistent patterns.
When normal behavior is well understood, unexpected communication can become easier to identify.
That only works when someone is paying attention to the information being collected.
Cybersecurity discussions can become focused entirely on software and networks, but physical access remains part of the same security model.
Someone who can enter an unsecured mechanical room, open a control enclosure, or connect directly to an available network port may gain access from inside the boundaries that other security controls were designed to protect.
Mechanical rooms, telecommunications spaces, panels, network ports, keys, and badge access therefore belong in the cybersecurity conversation.
Physical and digital security meet at the controller.
Building automation professionals do not need to memorize cybersecurity standards to benefit from the way they organize security thinking.
The Purdue Model provides one useful way to visualize control environments. It separates physical processes, controllers, supervisory systems, operational systems, enterprise systems, and external networks into levels.
The security value comes from thinking carefully about the boundaries between those levels and controlling how communication moves between them.
IEC 62443 provides another framework relevant to industrial automation and control systems, including concepts such as zones and conduits.
The NIST Cybersecurity Framework provides a broader lifecycle built around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
Together, these models reinforce an important point. Cybersecurity is not one firewall, password policy, or network diagram. It includes knowing what you have, protecting it, detecting problems, preparing a response, and being able to restore operations afterward.
The modern BAS sits between operational technology and information technology.
Controls professionals understand physical processes, sequences of operation, equipment dependencies, commissioning, and the operational consequences of taking systems offline.
IT and cybersecurity professionals understand network architecture, threats, identity management, monitoring, and defensive technologies.
Neither knowledge set replaces the other.
A technically secure design that ignores building operations can create operational problems. A controls design that ignores cybersecurity can create unnecessary exposure.
The strongest approach brings both disciplines into the same conversation early enough that security becomes part of the system design rather than something added after commissioning.
Connected buildings require building automation professionals to think beyond sequences, controllers, sensors, and actuators.
They also need to understand networks, boundaries, identity, remote connectivity, visibility, and risk.
The encouraging part is that improving building security does not always require exotic technology. Many vulnerabilities begin with fundamentals that were overlooked, including unchanged credentials, unnecessary network exposure, uncontrolled remote connections, flat networks, forgotten accounts, and incomplete asset inventories.
That makes security a discipline of consistency as much as technology.
Understand how the network works. Know what is connected. Define which communication is necessary. Control access. Monitor what happens. Maintain the system over time.
As building automation continues to become more connected, cybersecurity will become increasingly inseparable from good controls engineering.
Listen to Episode 558 of the Smart Buildings Academy Podcast for the complete discussion of IP security fundamentals and how they apply to the systems building automation professionals design, install, and maintain.
For a deeper discussion and insights from the field, listen to this episode on the Smart Buildings Academy podcast.