Legacy BACnet Poses Security Threat to Building Systems

Legacy building automation protocols, particularly BACnet, are exposing HVAC and other systems to increasing cyber threats, according to a recent analysis by cybersecurity firm Armis Labs. This growing concern is critical for construction and architecture executives as it affects the operational integrity and security of facilities.

What Happened
Armis Labs has highlighted that nearly 73% of facilities still employ building automation systems that are susceptible to ransomware attacks, largely due to the legacy BACnet standard. Introduced in the 1990s, BACnet was designed without security protocols, as the systems were not originally networked. However, these systems are now vulnerable as they have become connected and integrated into organizational networks. A notable incident occurred in August with Shared Health in Manitoba, Canada, where hackers seized control of the hospital's elevators, HVAC monitoring, and security systems, severely disrupting operations.

The use of AI is further compounding the issue, as it accelerates hackers' ability to identify and exploit vulnerabilities. Armis Labs, now a part of ServiceNow, notes that AI-driven vulnerability research is decreasing the time between discovering a flaw and weaponizing it. Despite the growing threat, patching these vulnerabilities remains a slow process due to the critical nature of building operations, which cannot simply be taken offline for updates.

What This Means for Your Business
For AECM industry professionals, the implications are significant. The reliance on outdated protocols like BACnet exposes facilities to potential operational disruptions and financial losses. This vulnerability necessitates a reassessment of current security measures and the integration of more robust cybersecurity protocols. Organizations must consider investing in modernizing their infrastructure to meet current security standards, which could involve substantial upfront costs but offer long-term protection and operational continuity.

Moreover, with 91% of systems communicating over insecure protocols, there is an urgent need for compliance with cybersecurity frameworks such as the Cybersecurity Maturity Model Certification (CMMC) and adherence to NIST guidelines. These measures are crucial for maintaining business continuity and safeguarding against the increasing threat landscape.

What US Operators Should Watch
Facility managers and decision-makers should track developments in cybersecurity regulations and standards closely. As threats evolve, there may be impending federal mandates requiring the upgrade of legacy systems. Keeping abreast of these changes will be essential to ensure compliance and avoid potential penalties. Additionally, with the acquisition of Armis Labs by ServiceNow, there may be new solutions emerging in the market for securing building automation systems. Monitoring these advancements could provide opportunities for strategic investments in cybersecurity enhancements.

Source: Facilities Dive

Partner Insight  ·  VisioneerIT

The increasing reliance on legacy building automation systems highlights the critical need for robust cybersecurity measures in the AECM sector. Organizations must prioritize compliance with frameworks like CMMC to safeguard their operations against evolving threats.

Explore VisioneerIT Cybersecurity →