BAS cybersecurity for the tech in the mechanical room

• BACnet/SC Capture LabNew

  A Wireshark-style capture window. Learn what BACnet Secure Connect looks like on the wire, decrypt it with a TLS key log, and find expired certificates, untrusted CAs, firewall drops, TLS inspection, idle timeouts, failover and duplicate VMACs.

• Security Audit LabNew

  Walk a simulated building: its network, supervisor, controllers, router and remote access. Find the gaps, pick remediations that fix them without breaking the building, and verify.

• BAS Troubleshooter: security and BACnet/SC paths

  On a real site? Describe the concern and it asks one question at a time, including what to do first if you think a system has been compromised. Works offline.

1. Nothing reachable from the internet. No port forwards to the supervisor or controllers. Remote access
2. The BAS has its own network. A separate VLAN with a firewall and an allow-list of named flows. Segmentation
3. One controlled remote path. VPN or approved gateway, individual accounts, MFA, time-limited vendor access. Remote access
4. No factory passwords. Unique credentials in a vault, unused accounts disabled. Accounts
5. Named accounts, least privilege. No shared admin; people who left are removed. Accounts
6. A supported, patched supervisor. Unused services off, no email or browsing on it. Hardening
7. Backups you’ve restored. Off the box, an offline copy, controller programs included. Hardening
8. Logs and correct clocks. Audit logging on, time synced, so an incident can be reconstructed. Hardening
9. A clean service laptop. Encrypted, per-tech logins, passwords in a vault, not a spreadsheet. Accounts
10. A plan for the bad day. Who to call, how to keep plant safe, how to isolate without wiping evidence. The first hour

Do this work with the owner’s written permission and their IT team involved. Don’t scan or test networks you aren’t authorised to.

• BACnet/SC: The Conversation IT Is About to Force

  What BACnet Secure Connect changes for building automation technicians: hubs, certificates, network architecture, and how it differs from BACnet/IP in the field.

• How BACnet/SC Actually Works: Hubs, Nodes, Certificates and the Connection SequenceNew

  A field-level walk through BACnet Secure Connect: hub function and hub connector, primary and failover hubs, VMAC and UUID, the TLS 1.3 and WebSocket connection sequence, BVLC-SC messages, and how broadcasts and legacy devices get through.

• BACnet/SC Certificates for Controls Techs: CSRs, CAs, Expiry and RenewalNew

  Key pairs, certificate signing requests, the site CA, operational and issuer certificates, who should run the CA, renewal planning, clock problems and what an expired or wrong-CA certificate looks like on a BACnet/SC site.

• Troubleshooting BACnet/SC When You Can't Read the TrafficNew

  How to diagnose BACnet Secure Connect faults when the traffic is encrypted: the connection-pattern method in Wireshark, a symptom table from DNS failures to duplicate VMACs, device SC status, TLS inspection and useful display filters.

• Planning a BACnet/SC Rollout Without Breaking the BuildingNew

  A practical plan for introducing BACnet Secure Connect on a live site: hub and failover placement, the firewall rules to request, DNS or IP in hub URIs, the certificate plan, phased migration through routers, commissioning checks and handover documentation.

• Segmentation and Firewall Rules: How to Talk to IT About the BAS NetworkNew

  Why a flat network is the biggest risk to a building automation system, what traffic the BAS actually needs, and how to write a firewall rule request IT can approve.

• Remote Access to a BAS Without Opening the Building to the InternetNew

  Why port forwarding to a supervisor or controller is the worst option, and how VPN with MFA, approved remote-access gateways, jump hosts and time-limited vendor access compare.

• Why BACnet/IP and Modbus Have No Security (and What You Do About It)New

  Why BACnet/IP and Modbus TCP carry no authentication or encryption, what that means for anyone who can reach UDP 47808 or TCP 502, and the compensating controls that protect them.

• Default Passwords, Shared Logins and the Accounts Nobody OwnsNew

  Default credentials on controllers, supervisors and routers, shared admin logins, named accounts and roles, least privilege, removing ex-staff and old contractors, and a clean handover.

• Hardening a BAS Supervisor and Its Controllers: A Field ChecklistNew

  A field checklist for hardening a BAS supervisor and its controllers: patching, end-of-life operating systems, unused services, HTTPS, tested backups with an offline copy, removable media, allow-listing, time sync and logging.

• IEC 62443 and NIST in Plain Language for BAS TechsNew

  What the main IEC 62443 parts, NIST SP 800-82 Rev. 3 and the NIST Cybersecurity Framework 2.0 are for, what zones, conduits and security levels mean, and how to answer a spec that asks for 62443 compliance honestly.

• Think the BAS Has Been Compromised? The First HourNew

  The signs a building automation system may have been compromised, and what a field technician should do in the first hour: keep equipment safe, isolate at the boundary, preserve evidence, call the owner's IT contact and hold off on restoring.

• BAS Port and Protocol Reference

  Every port the BAS needs, for firewall requests and allow-lists.

• BACnet Config Checker

  Paste a device list; finds duplicate instances and MACs, network number conflicts and BBMD needs.

• Can These Two Devices Talk?

  Same subnet or router required, and what that means for discovery.