Can a hacked heating or access-control system be used to reach our office network?

Yes, if the two share a network or the rules between them are loose. Building systems are often installed by a contractor on the same switches and address range as the office, or with a convenient route so that the facility manager can open the control software on an office PC. An attacker who gets in through the building system's remote access or a weak controller can then reach office computers as if from inside. Check where the building controllers and their server sit, whether they can reach office hosts and whether office hosts can reach them; usually only one management station needs to. Separate them with a firewall or a VLAN with strict rules, and route the contractor's remote access through your own gateway. On a monitored segment, NetSenX flags scanning and lateral movement from a building controller towards office hosts on every plan, so a controller that starts exploring the network stands out.

← All 50 questions on OT and IoTAll topics