BACnet — standardized as ASHRAE 135 and ISO 16484-5 — is the dominant communication protocol for commercial building automation, controlling HVAC, lighting, fire alarms, access control, and energy management systems. But the base BACnet/IP protocol has a fundamental security problem: it has no authentication, no encryption, and no mechanism to prevent unauthorized devices from reading or writing building system parameters. Any device with network access to UDP port 47808 can issue BACnet commands to any controller on the network (OT Security Wire).
The vulnerability: unauthenticated BACnet/IP
In the base BACnet/IP protocol, operations like Who-Is (device discovery), ReadProperty (reading sensor values), WriteProperty (writing setpoints and operational parameters), and ReinitializeDevice (remotely rebooting a controller) require no authentication. An attacker with network access can read from or write to HVAC, fire suppression, lighting, and access control systems without credentials. Shodan regularly surfaces tens of thousands of BAS devices with internet-accessible management interfaces, the majority of which require no authentication or use default credentials (OT Security Wire).
The 2013 Target breach demonstrated the real-world consequences. Initial access occurred through a third-party HVAC vendor's remote-access credentials. The contractor maintained building systems — not point-of-sale infrastructure — but lateral movement followed from the HVAC management network to the payment-card network, compromising 40 million credit cards (OT Security Wire). At the 2024 Black Hat conference, security researchers highlighted a BACnet-to-ransomware attack path where adversaries exploited an unauthenticated BACnet/IP port on an HVAC controller to pivot into the central Building Management System, ultimately encrypting its database and disabling ventilation (IJISRT).
| Feature | BACnet/IP (Legacy) | BACnet/SC (Secure) |
|---|---|---|
| Authentication | None | Mutual TLS (mTLS) with X.509 certificates |
| Encryption | None — plaintext, readable by packet sniffers | TLS 1.3, 128/256-bit ECC |
| Transport | UDP broadcast on port 47808 | WebSockets over TCP, hub-and-spoke |
| Device discovery | Broadcast (Who-Is/I-Am) | DNS-based, no broadcasts |
| Trust model | Perimeter (VLAN/firewall only) | Zero Trust (every device authenticated) |
| Standard | ASHRAE 135 (base) | ASHRAE 135-2020, Annex AB |
The solution: BACnet Secure Connect
BACnet Secure Connect (BACnet/SC) is a security addendum to the BACnet protocol, defined in Annex AB of ASHRAE 135-2020. It uses TLS 1.3 — the same encryption standard used for online banking — with X.509 certificate-based authentication. All connections are mutually authenticated: both endpoints must complete TLS validation of the other before they can communicate. BACnet/SC eliminates broadcasts, supports DNS for name resolution, and uses a hub-and-spoke topology where a primary hub authenticates devices before they join the network (ASHRAE; OT Security Wire).
ASHRAE describes BACnet/SC as providing "cybersecurity inherently, equal to what is currently achieved using VPNs," eliminating the need for extra VPN equipment and the risky practice of placing unprotected devices directly on the internet (ASHRAE). BACnet/SC is backward-compatible with existing BACnet deployments — BACnet/IP and BACnet/SC traffic can coexist on the same network, though devices using different variants cannot directly communicate and require a router or gateway (Veridify).
Adoption gap.Legacy controllers from the 2000s and 2010s generally will not receive BACnet/SC firmware updates and cannot participate in secure communication without replacement. Adoption is growing primarily in new installations and system refreshes. Existing BACnet/IP installations are expected to operate without authentication for years or decades, depending on capital refresh cycles. Where legacy and BACnet/SC devices coexist, protocol translation or gateway devices are recommended rather than operating a flat unauthenticated network (OT Security Wire).
NIST classifies building automation as operational technology
NIST Special Publication 800-82 Revision 3, published September 28, 2023, explicitly classifies building automation systems as operational technology (OT) and applies industrial control system security frameworks to them. The guide covers OT system topologies, typical threats, vulnerabilities, and recommended security safeguards and countermeasures. It expanded scope from industrial control systems to include building automation, transportation, physical access control, and environmental monitoring (NIST CSRC). NIST also developed a quick-start infographic for resource-constrained BACS owners and operators, outlining immediate, actionable security steps (NIST).
Practical hardening checklist
For facilities with legacy BACnet/IP systems that cannot yet upgrade to BACnet/SC, network architecture is the primary defense:
- Segment the network: Place BAS on a dedicated VLAN, isolated from corporate IT with default-deny firewall rules. Only explicitly defined management workstations should have permitted routes.
- Eliminate internet exposure: Audit UDP 47808 exposure using Shodan or Censys against your own IP ranges. No BACnet device should be directly internet-accessible.
- Secure remote access: Require VPN through a jump host with multi-factor authentication. Eliminate direct remote access to the BAS VLAN.
- Inventory all devices: Document every BACnet controller, its firmware version, and known vulnerabilities. Enable anomaly detection.
- Disable unused services: Close FTP, Telnet, and unused network ports. Update firmware regularly.
- Plan for BACnet/SC: Engage your BMS vendor on their BACnet/SC roadmap. Specify BACnet/SC support in new equipment procurement.
ASHRAE Guideline 13, Specifying Building Automation Systems, includes a section addressing cybersecurity requirements for new BAS projects (NIST).
Naming a product or manufacturer in this article is for identification purposes only and does not constitute an endorsement by HVAC Zone Inc. We are a multi-brand dealer and remain neutral on brand preference.
Concerned about your building automation system's cybersecurity posture? Request a consultation — we'll assess your BACnet network architecture, identify exposure risks, and recommend a hardening plan tailored to your facility.