Introduction to BACnet Secure Connect

Building automation systems (BAS) have seen numerous advancements in technology in recent years. Increased building connectivity and a drive toward accomplishing smart building applications has led to a convergence of operational technology (OT) and IT networks. Cybersecurity threats now extend beyond the typical purview of IT. If not managed properly, the convergence of IT networks with less secure OT networks, such as Heating Ventilation & Air Conditioning (HVAC), lighting, energy metering, security, and access control can increase security risks and leave smart buildings vulnerable to cyberattacks. Increased connectivity also means a higher exposure to cybersecurity threats, which has brought the focus of IT and cybersecurity professionals to OT systems security. The value of connected building systems is clear, but the trade-off is that managing and decreasing the attack surface is more challenging than ever.

While we observe a growing number of cyber attacks with digitalization and increased connectivity, organizations respond with layered defense mechanisms. However, OT networks are often ignored when it comes to enhancing security. Operational technology is the backbone of a functioning building. Enhancing security of OT systems means providing protection of the availability, integrity, and safety of the mechanical equipment that makes essential building functions possible. In addition to protecting operational infrastructure, incorporating OT system security into a holistic security approach can close attack vectors and drastically decrease the possibility of cybersecurity threats originating in the OT space.

The new BACnet Secure Connect (BACnet/SC) data link layer is a significant update to the BACnet standard which brings enhanced cybersecurity and IT acceptance to operational technology (OT) networks. BACnet/SC is still BACnet. It maintains the well-known interoperability between vendors who are BACnet-compliant, as well as compatibility to existing and future versions of BACnet by use of BACnet routing. A step-by-step approach to upgrading existing systems should be taken to ensure a smooth transition and protect building owners’ current automation system and security investments. Technically, several different BACnet Internetworking topologies are possible thanks to BACnet routing. However, strategically, the most important components for starting with BACnet/SC are the workstation and the system controllers because they are most likely to be accessible on networks with higher exposure, such as enterprise IT networks, and there is less pressure to secure networks deep inside the building for now.

Properly secured networks require security-conscious organizational culture and dedicated personnel. With the advent of BACnet/SC, IT and OT professionals will need to work together closely to deploy secure smart building automation networks that leverage BACnet/SC. With BACnet/SC, previously separated OT networks, such as HVAC, energy, lighting, access control, and fire, can converge and IT best practices, including monitoring, and management with best cybersecurity practices can be implemented on these new secure OT networks.

Realistically, it will take time for building automation systems to be completely upgraded and for the industry to fully realize the benefits of BACnet/SC systems. It is important to approach secure building infrastructure in a step-by-step manner and implement upgrades to BACnet systems over time.