By Will Curtis, Head of Network Engineers Design and Deploy
Introduction
Building Management Systems (BMS) play a pivotal role in running contemporary buildings. They oversee heating, ventilation and air conditioning, lighting, energy monitoring, and often integrate with systems like access control and fire safety devices.
Traditionally, they operated as closed systems designed for ease of handling and reliability. Cybersecurity was rarely a design priority because the assumption was simple: the supporting network would remain locked down and inaccessible to outsiders.
That assumption is no longer true.
BMS networks are now a rapidly growing area of interest within cybersecurity as buildings become smarter and more connected.
The Expanding Attack Surface
Modern smart buildings incorporate a multitude of digital systems. Beyond physical controls, today’s environments include IoT sensors, digital signage platforms, energy optimisation tools, and cloud‑based analytics services.
To support these capabilities, BMS networks are frequently integrated with:
- Corporate IT networks
- Remote management systems
- External service providers
Each new connection increases the attack surface. Remote access has become the norm for vendors and maintenance engineers. While this improves operational productivity, it also introduces multiple potential gateways into sensitive systems.
If left exposed, these connections can open building infrastructure to external cyber risks.
Legacy Protocols and Design Assumptions
Many building systems still rely on decades‑old protocols.
Technologies such as BACnet and Modbus were created to prioritise reliability and interoperability — not security.
Encryption, authentication, and secure device identity were not central design considerations.
In some environments, these protocols still operate on flat networks with minimal segmentation or monitoring. This can allow unauthorised devices to communicate with building systems or intercept network traffic.
As connectivity increases, these legacy assumptions create new and significant cybersecurity challenges.
BMS Attacks and Their Impact on Operations
Unlike traditional IT systems, BMS networks interact directly with the physical environment.
If an attacker gains access, the consequences extend far beyond data — they can interfere with critical building systems.
Potential impacts include:
- Disrupting heating or cooling systems
- Manipulating environmental controls
- Interfering with energy management systems
- Causing operational disruption in critical facilities
Even less severe incidents can still affect occupant comfort, safety, and business continuity.
The risk is especially pronounced for organisations with large estates or environments of critical importance.
Improving Network Architecture
While replacing legacy building systems may help reduce risk, architectural improvements can often make a bigger and more immediate difference.
Network segmentation remains the most effective control.
Separating BMS networks from corporate infrastructure reduces the impact of failures or security incidents.
Secure remote access is another essential factor.
Instead of granting direct access, organisations should adopt controlled solutions such as:
- Jump hosts
- Multi‑factor authentication
- Session logging
This improves oversight of external access. Monitoring is also critical. Visibility into network traffic enables operators to detect unusual patterns and address security risks early.
Embedding Security in Smart Infrastructure
As buildings continue to embrace connected technologies, cybersecurity becomes an essential component of modern infrastructure. Organisations responsible for building operations must begin treating BMS networks as critical infrastructure – not isolated control systems.
By adopting advanced network design practices such as segmentation, controlled access, and continuous monitoring, risks in connected environments can be significantly reduced. Cybersecurity is increasingly becoming a foundational part of smart building design.
In an evolving technological landscape, securing BMS networks will be vital for engineers and operators across all sectors.
Author:
Will Curtis, Head of Network Engineers Design and Deploy
Trust Systems.
