The Attack Surface Hiding in Plain Sight
Every smart building initiative adds intelligence to building systems. Few ask the follow-up question: what attack surface are we creating? The convergence of operational technology and information technology in commercial buildings has produced a cybersecurity landscape that neither traditional IT security teams nor facility operators are equipped to manage alone. The result is an expanding attack surface that most organizations do not even know exists.
Unpatched BAS
Attacks Since 2020
Building Breach
In legacy buildings, the BMS ran on proprietary protocols over isolated networks. A Tridium Niagara controller spoke BACnet to VAV boxes on a dedicated subnet that never touched the corporate LAN. Security was achieved through obscurity and air gaps. That model is gone. Modern smart buildings connect BMS to cloud analytics platforms, push IoT sensor data through enterprise networks, and expose building control APIs to third-party optimization vendors. Each integration point is a potential attack vector.
Why OT/IT Convergence Creates Unique Vulnerabilities
The fundamental challenge is that building OT systems were designed for reliability, not security. BACnet, Modbus, and LonWorks protocols transmit commands in plaintext. Controllers run embedded firmware that may not support encryption or authentication. Many BMS systems still operate on Windows XP or Windows 7 embedded platforms that no longer receive security patches. When these systems connect to IP networks for cloud analytics and remote monitoring, they inherit every vulnerability that IT security teams have spent decades learning to mitigate — except the OT teams managing them often lack that security expertise.
The attack taxonomy is straightforward but alarming. Reconnaissance through exposed BACnet discovery services reveals building topology. Lateral movement from compromised IoT sensors to BMS controllers exploits flat network architectures. Command injection through unprotected BACnet write services can alter setpoints, disable safety interlocks, or trigger equipment damage. Data exfiltration from occupancy sensors reveals building usage patterns with intelligence value. Ransomware that encrypts BMS controllers can render buildings uninhabitable.
The Regulatory Pressure Building Beneath the Surface
The regulatory landscape is shifting faster than most building operators realize. The EU's NIS2 Directive, effective since October 2024, explicitly includes building management systems in critical infrastructure sectors that require cybersecurity risk management and incident reporting. Singapore's Cybersecurity Act amendments extend coverage to building automation in designated critical information infrastructure. In the US, CISA's cross-sector performance goals now reference building control systems alongside traditional SCADA/ICS environments.
For CRE operators in APAC, the convergence of cybersecurity regulation and smart building adoption creates a compliance burden that will only grow. The operators who build security architecture into their smart building deployments now — network segmentation, encrypted protocols, identity management for devices, continuous monitoring — will avoid the far more expensive retrofit that regulation will eventually mandate.
A Practical Framework for Building Cyber-Resilience
The framework for securing converged OT/IT building environments follows four layers. First, network segmentation: place building OT on dedicated VLANs with firewalls controlling all traffic between OT, IT, and cloud zones. Second, device identity: implement certificate-based authentication for all controllers and IoT endpoints, treating each device as an identity requiring lifecycle management. Third, protocol security: deploy BACnet Secure Connect (BACnet/SC) where supported, or tunnel legacy protocols through encrypted overlays. Fourth, continuous monitoring: deploy network detection tools that understand building protocols and can identify anomalous commands — a BACnet write to a safety interlock at 2 AM should trigger an alert, not just a log entry.
The organizations getting this right treat building cybersecurity as a core competency, not an IT afterthought. They embed security requirements into vendor procurement, mandate penetration testing of building networks, and maintain incident response plans that account for the physical consequences of cyber attacks on building systems. The smart building of the future is not just intelligent — it is resilient.