Cybersecurity for building automation

A modern building automation system is a network of small computers connected to the same infrastructure as everything else in the building. That makes it convenient to run and, if left unprotected, easy to attack. Most of the protection comes from a few well-known measures: separate the BAS network, control every route in from outside, and keep the system's accounts and software in good order.

Why building systems are a target

Building automation was designed for reliability and convenience, not security. Older protocols assume that anything on the network can be trusted. Controllers stay in service for many years, often with their original passwords and firmware. Contractors install remote access tools so they can respond to calls without driving to site, and those connections are sometimes left open long after the project ends. Search engines exist that index devices exposed on the internet, and building controllers regularly appear in them.

The consequences can be serious. An attacker who reaches the BAS may be able to shut down heating in winter and freeze coils, overheat a server room, disrupt pressurization in a laboratory or healthcare space, or simply lock operators out and demand a ransom. The BAS can also be a way in to the rest of the organization: in one widely reported breach, attackers entered a large retailer's corporate network using credentials stolen from its HVAC contractor.

Separate the BAS network

The single most effective measure is segmentation. The BAS should sit on its own network segment, usually a VLAN, with a firewall controlling what can pass between it and the office network and the internet. The firewall's default should be to block, with only the specific connections the system needs allowed through. No BAS device should be directly reachable from the internet. Our guide to VLANs and network segmentation covers the mechanics.

Segmentation also protects in the other direction. If an office computer is infected with ransomware, a firewall between the office network and the BAS stops it spreading to the controllers that keep the building running. Where building systems share switches and cabling with IT, as described in our guide to converged networks for building systems, segmentation is what keeps them separate in practice.

Control every route in

Remote access is the most common way into building systems, so treat it as a process with an owner, not a piece of software a contractor installs. Every connection from outside should go through the organization's VPN or a managed remote access service, with multi-factor authentication, individual named accounts and logging. Vendors should not have permanently connected modems, remote desktop tools or cloud links that bypass IT.

Harden the system

• Keep an inventory of every controller, server, workstation, gateway and network device in the BAS, with its location, software version and owner.
• Change default passwords on every device and use individual accounts, with each user given only the access they need.
• Keep software current. Agree with the controls contractor how firmware and software updates are tested and applied, and how often.
• Turn off what is not used: unused services, web interfaces, accounts and network ports.
• Use encrypted connections to servers and workstations, and consider BACnet Secure Connect for new work. Our guide to BACnet and Modbus explains the protocols.
• Back up controller programs and the server database, keep a copy offline, and test that a restore works.
• Log and review logins, configuration changes and alarms, and send logs to a place an attacker cannot easily erase.
• Lock up the hardware. Controller panels and network cabinets in public or shared spaces should be locked.

Where to start in an existing building

For a building whose BAS has grown over the years without much attention to security, a sensible order of work is:

1. Find out what is exposed. Ask IT to check whether any BAS device or workstation can be reached from the internet, and close those routes first. Record what was found and what was changed.
2. List every remote access route. Include contractor tools, modems, cloud services and shared accounts. Remove the ones nobody can justify and move the rest behind the VPN.
3. Build the inventory. Walk the mechanical rooms and network closets with the controls contractor and record each device, its address, software version and password status.
4. Change default and shared passwords, and store the new ones where the owner, not only the contractor, can retrieve them.
5. Segment the network. Move the BAS onto its own VLAN behind a firewall, one area at a time if needed, testing that alarms and trends still work after each move.
6. Set up the routine: backups, update schedule, log review and an annual check of accounts and access.

None of these steps needs new controllers, and together they remove most of the easy ways in. Replacing old, unsupported equipment can then be planned as part of normal capital renewal.

Standards and responsibilities

The ISA/IEC 62443 series of standards addresses security for industrial automation and control systems, and its ideas, such as dividing a system into zones joined by controlled conduits, apply well to buildings. Many organizations also map BAS security to the same framework they use for IT. Whatever framework you use, decide who is responsible for what:

Plan for a bad day as well. If the BAS is compromised or has to be taken off the network, operators should know how to run critical equipment in hand or at local controls, and who to call. A short written procedure, practised once, is worth far more than one written during an incident.

Questions to ask your controls contractor

• How do you access our system remotely today, and who has those credentials?
• Which devices still have default passwords, and when were they last updated?
• Where are the backups, and when was a restore last tested?
• What will you need from our IT group to put the BAS on its own segment?

How ehZee can help

We include cybersecurity in BAS design from the start: network segmentation and firewall requirements agreed with your IT group, a controlled remote access approach, hardening and documentation requirements in the specification, and review during construction. See our building automation system design service.

Common questions