Securing a BMS: the questions to ask at design stage

A building management system is a computer system connected to the building network. It drives heating, ventilation, sometimes lighting and blinds. Yet in most specifications, cyber security amounts to a couple of lines — or nothing at all. The French BACS decree is accelerating BMS deployment across the tertiary stock, so it is worth asking the right questions at design stage, while the choices are still open and cost almost nothing.

Why this matters now

Older systems were isolated: a proprietary bus, a local supervision workstation, no outside connection. Three changes broke that.

• IP replaced proprietary buses. BACnet/IP and Modbus TCP put the BMS on the same kind of network as office IT.
• Maintenance moved to remote access. Operator and installer want to reach the supervisor without travelling — which means a door from outside.
• Device count exploded. Controllers, gateways, communicating sensors, meters: each with its own firmware and its own credentials.

None of these protocols was designed with security in mind. In their common versions, BACnet and Modbus neither encrypt traffic nor authenticate whoever sends a command. That is not a flaw in implementation: it is their original design, from a time when the network was physically closed.

Six questions to ask at design stage

1. Is the technical network separated from the office network?

The most important question, and the cheapest to address in design. The BMS belongs on a dedicated network — a separate VLAN at minimum, with explicit filtering rules between the two. A compromised office workstation must not be able to reach a controller.

For the specification: the BMS package states the addressing plan, the dedicated VLAN and the flows allowed towards the rest of the network. This has to be coordinated with the low-current package and with the client's IT department — usually where it stalls, because nobody claims ownership.

2. Is anything exposed directly on the internet?

The answer must be no. A supervisor or controller reachable from a public address will eventually be found: specialised search engines continuously index industrial equipment left accessible, and a BMS controller shows up like anything else.

For the specification: no device in the BMS package is directly reachable from the internet. Remote access goes exclusively through an encrypted tunnel, with two-factor authentication.

3. How does the maintainer get in?

The point operations imposes and design forgets. The installer will need remote access; with no provision made, they will improvise one — a 4G router behind a controller, remote-desktop software on the supervision workstation. Those bypass everything built elsewhere.

For the specification: the remote access method is defined at design stage, with a named account per person, connection logging, and a revocation procedure at the end of the contract.

4. What happens to default accounts and passwords?

Controllers and gateways ship with publicly documented credentials. On a rushed handover, they stay. Add to that a shared account for the whole operations team and the manufacturer account of the maintainer.

For the specification: handover includes evidence that every default account has been changed or disabled, and a named list of active accounts. A shared account makes traceability impossible — when a wrong command stops an air handling unit, nobody knows who sent it.

5. Who updates firmware, and when?

A controller installed today will run for fifteen years. Its firmware will receive fixes — if someone applies them. In practice, updates are neither in the maintenance contract, nor budgeted, nor scheduled, because they mean briefly stopping a control loop in service.

For the specification: the maintenance contract explicitly covers vulnerability monitoring for installed equipment and an annual intervention window for updates, outside critical periods.

6. What happens if the BMS goes down?

As much a design question as a security one. If the supervisor is unavailable, equipment should keep running in degraded mode rather than stop. Local autonomous control on critical plant prevents an IT incident from becoming a heating outage.

For the specification: the behaviour of each device on loss of communication with the supervisor is described, and verified at handover.

What this changes in practice

None of these six points requires specialist skill to be asked. They require being written at the right time. Handled at design stage, they cost a few lines of specification and one coordination meeting. Handled after handover, they mean reworking the network architecture of a live installation.

The engineering firm's job is not to design the building's cyber security — that belongs to the client's IT department or a specialist. It is to make sure the question was put to someone, and that the answer is written down.

In short

• A dedicated BMS network, separated from office IT, with explicit flows.
• No device directly exposed on the internet.
• Remote access planned at design stage, or it will be improvised.
• Named accounts, no default passwords left at handover.
• Updates covered by the maintenance contract.
• A defined degraded mode for every critical device.

Six questions, six lines of specification. Little compared with the cost of asking them three years after handover.