Are building management systems such as HVAC and BACnet a cyber risk?

Yes, and an underestimated one. Heating, ventilation, lighting, lifts and access control now run on networked controllers, often speaking BACnet/IP, with remote access for the service company and a cloud app for the facility manager. They are rarely patched, often keep default passwords, and are usually managed by a different team or an outside contractor rather than by IT. An attacker can use them to disrupt the building, or as a quiet foothold to reach the office network if the two are not separated. Ask your facility contractor where the system connects to, who has remote access and how, and put the building controllers on their own network segment with internet access limited to what the vendor really needs. NetSenX reads BACnet/IP from passive capture from the Pro plan and, on every plan, flags beaconing, scanning and unusual outbound volume from those controllers. There is no separate BACnet anomaly alert.

← All 50 questions on OT and IoTAll topics