Building Automation System Cybersecurity: Protection Strategies and Best Practices

Building Automation System Cybersecurity Overview

Building Automation Systems (BAS) have evolved from isolated pneumatic controls to networked digital systems, creating significant cybersecurity exposure. Modern BAS typically connect to corporate IT networks, cloud platforms, and remote access systems, requiring comprehensive security architectures.

Threat Landscape

Common Attack Vectors

Notable CVEs (2024-2025)

BACnet Secure Connect (BACnet/SC)

Overview

BACnet Secure Connect (ASHRAE Addendum bj-2020) provides native encryption and authentication for BACnet communications, replacing the inherently insecure BACnet/IP broadcast model.

Architecture

┌─────────────────────────────────────────────────────┐
│                  BACnet/SC Hub                       │
│         (TLS 1.3 Termination Point)                 │
└──────────┬──────────────┬──────────────┬────────────┘
           │              │              │
    ┌──────▼──────┐ ┌─────▼─────┐ ┌──────▼──────┐
    │ Controller  │ │Controller │ │ Workstation │
    │   (Node)    │ │  (Node)   │ │   (Node)    │
    └─────────────┘ └───────────┘ └─────────────┘

Key Features

Implementation Requirements

Certificate Infrastructure:

• CA hierarchy for device certificates
• Certificate revocation list (CRL) management
• Automated certificate renewal

Network Requirements:

• Outbound WebSocket (TCP 443) from devices to hub
• Hub requires public certificate from trusted CA
• Firewall rules for hub-to-hub federation

Vendor Support (as of 2025)

Zero Trust Architecture for BAS

Principles

1. Never trust, always verify: No implicit trust based on network location
2. Least privilege access: Minimum permissions for each function
3. Assume breach: Design for containment when compromise occurs

Implementation Layers

Layer 1: Network Microsegmentation

┌─────────────────────────────────────────────────────────┐
│                     IT Network                           │
└────────────────────────┬────────────────────────────────┘
                         │ Firewall
┌────────────────────────▼────────────────────────────────┐
│                   DMZ / Jump Host                        │
└────────────────────────┬────────────────────────────────┘
                         │
    ┌────────────────────┼────────────────────┐
    │                    │                    │
┌───▼───┐          ┌─────▼─────┐        ┌────▼────┐
│ AHU   │          │   VAV     │        │ Chiller │
│Segment│          │  Segment  │        │ Segment │
└───────┘          └───────────┘        └─────────┘

Layer 2: Identity-Based Access

• Service accounts per application
• Multi-factor authentication for human access
• Time-limited credentials

Layer 3: Continuous Verification

• Behavioral analytics for anomaly detection
• Session re-authentication
• Device health attestation

Recommended Architecture

Network Security Best Practices

Segmentation Guidelines

VLAN Structure:

Firewall Rules

Minimum Required Rules:

# Allow BACnet/SC to hub
ALLOW TCP/443 FROM BAS-Controllers TO BACnet-Hub

# Allow engineering workstation
ALLOW TCP/47808 FROM BAS-Mgmt TO BAS-Controllers

# Block all other BAS traffic
DENY ALL FROM BAS-* TO ANY

Wireless Security

• WPA3-Enterprise for wireless BAS devices
• Dedicated SSID for BAS, isolated from corporate WiFi
• 802.1X authentication with RADIUS

Vulnerability Management

Patch Management Process

1. Inventory: Maintain asset list with firmware versions
2. Monitor: Subscribe to vendor security bulletins
3. Assess: Evaluate patch applicability and risk
4. Test: Validate patches in lab environment
5. Deploy: Scheduled maintenance windows
6. Verify: Confirm successful patching

Scanning Considerations

CISA Guidelines Compliance

Key Requirements

1. Asset Inventory: Document all BAS devices and software
2. Network Architecture: Maintain current network diagrams
3. Access Control: Implement role-based access
4. Monitoring: Deploy continuous monitoring
5. Incident Response: Documented BAS-specific IR procedures

Compliance Checklist

• Default credentials eliminated
• Network segmentation implemented
• Encryption enabled (BACnet/SC or VPN)
• Logging enabled and retained 90+ days
• Backup and recovery tested
• Incident response plan documented
• Staff trained on BAS security

Monitoring and Detection

Key Indicators of Compromise

SIEM Integration

Recommended Log Sources:

• BAS controller authentication events
• Configuration change events
• Network firewall logs
• BACnet/SC hub connection logs

Incident Response

BAS-Specific Considerations

1. Life safety priority: Maintain fire, smoke, and egress systems
2. Manual override capability: Document bypass procedures
3. Isolation procedures: Network segmentation for containment
4. Evidence preservation: Controller logs, network captures

Recovery Procedures

1. Verify backup integrity before restoration
2. Rebuild from known-good images rather than cleaning
3. Reset all credentials including embedded passwords
4. Validate system operation before returning to production

References

• CISA: Securing Building Automation Systems
• ASHRAE Addendum bj to Standard 135-2020 (BACnet/SC)
• NIST SP 800-82: Guide to ICS Security
• ISA/IEC 62443: Industrial Automation Security