OT/IT Convergence in Smart Buildings
Smart buildings integrate operational technology (OT) systems (HVAC, lighting, elevators, access control) with IT networks. This convergence creates attack paths from IT to OT and vice versa, with potential physical safety implications.
Building Management Protocols
BACnet (Building Automation and Control Network)
- Most common building automation protocol
- Often deployed without authentication
- BACnet/IP operates on UDP port 47808
- Attackers can read/write to any BACnet object
Modbus
- Legacy protocol with zero security features
- No authentication or encryption
- Widely used in HVAC and energy management
- Simple to intercept and manipulate
KNX
- European standard for building automation
- KNXnet/IP gateway often exposed to network
- Limited security in base specification
- KNX Secure adds encryption (but rarely deployed)
Attack Scenarios
Physical Disruption
- Manipulate HVAC to create uncomfortable conditions
- Disable access control systems
- Control lighting and elevators
- Trigger fire alarm systems
Data Exfiltration
- OT networks as pivot point to IT networks
- Sensor data revealing occupancy patterns
- Access control logs revealing employee movements
Ransomware
- Encrypt BMS controllers
- Lock building occupants in/out
- Demand ransom for system restoration
Security Recommendations
- Segment OT from IT networks with firewalls and DMZs
- Implement authentication on all BACnet/Modbus devices
- Monitor OT traffic for anomalous commands
- Patch BMS software regularly
- Physical security for OT controllers and network infrastructure
- Incident response plans that include physical safety considerations
Where SuperClue Fits
SuperClue does not assess OT or building-automation protocols such as BACnet or Modbus. Its DAST scanner can test the web interfaces of building management systems that are reachable over HTTP.