--- title: Building Management System Cyber Security | MACC description: Hackers are always looking to target BMS building management systems to access companies’ enterprise systems. Click to learn more about BMS cyber security. image: https://info.midatlanticcontrols.com/hubfs/AdobeStock_168660747.jpeg --- [![Mid-Atlantic Controls](https://info.midatlanticcontrols.com/hubfs/Mid%20Atlantic%20Controls%20Jan%202017/Images/logo.png "Mid-Atlantic Controls")](https://www.midatlanticcontrols.com/) Installs Available in VA, MD, and D.C. [Call (804) 262-4923](tel:(804)%20262-4923) - [Home](https://www.midatlanticcontrols.com) - [About](https://www.midatlanticcontrols.com/about/) - [Mission and Vision](https://www.midatlanticcontrols.com/about/mission-and-vision/) - [Industries](https://www.midatlanticcontrols.com/about/industries/) - [Clients](https://www.midatlanticcontrols.com/about/clients/) - [Careers](https://www.midatlanticcontrols.com/about/careers/) - [MACC In The Community](https://www.midatlanticcontrols.com/about/macc-in-the-community/) - [Areas Served](https://www.midatlanticcontrols.com/about/areas-served/) - [BAS Installation](https://www.midatlanticcontrols.com/building-automation-services/bas-installation/) - [Services](https://www.midatlanticcontrols.com/building-automation-services/) - [BAS Installation](https://www.midatlanticcontrols.com/building-automation-services/bas-installation/) - [BAS Upgrades](https://www.midatlanticcontrols.com/building-automation-services/legacy-upgrades/) - [BAS Maintenance](https://www.midatlanticcontrols.com/building-automation-services/maintenance/) - [BAS Engineering](https://www.midatlanticcontrols.com/building-automation-services/building-automation-system-engineering/) - [BAS Project Management](https://www.midatlanticcontrols.com/building-automation-services/bas-project-management/) - [Control Panel Fabrication](https://www.midatlanticcontrols.com/building-automation-services/control-panel-fabrication/) - [Systems](https://www.midatlanticcontrols.com/building-systems/) - [Building Automation Systems](https://www.midatlanticcontrols.com/building-systems/building-automation-systems-bas/) - [Energy Management Systems](https://www.midatlanticcontrols.com/building-systems/energy-environment/) - [Access Control Systems](https://www.midatlanticcontrols.com/building-systems/access-control-video-monitoring/) - [Facility Management Software](https://www.midatlanticcontrols.com/building-systems/data-analysis-visualization/) - [Commercial Security Camera Systems](https://www.midatlanticcontrols.com/building-systems/commercial-security-camera-systems/) - [Total Room Automation](https://www.midatlanticcontrols.com/building-systems/total-room-automation/) - [Smart Room Control Solution](https://www.midatlanticcontrols.com/building-systems/smart-room-control-solution/) - [Products](https://www.midatlanticcontrols.com/building-automation-products/) - [Tridium](https://www.midatlanticcontrols.com/building-automation-products/tridium/) - [Siemens](https://www.midatlanticcontrols.com/building-automation-products/siemens/) - [Distech Controls](https://www.midatlanticcontrols.com/building-automation-products/distech-controls/) - [Honeywell](https://www.midatlanticcontrols.com/building-automation-products/honeywell/) - [JCI Facility Explorer](https://www.midatlanticcontrols.com/building-automation-products/jci-facility-explorer/) - [Cylon Auto-Matrix](https://www.midatlanticcontrols.com/building-automation-products/american-auto-matrix/) - [News](https://info.midatlanticcontrols.com/blog) - [Contact Us](https://www.midatlanticcontrols.com/tech-support/contact-us/) - [Get A Quote](https://www.midatlanticcontrols.com/tech-support/schedule-a-free-consultation/) - [Schedule Service](https://www.midatlanticcontrols.com/tech-support/request-bas-service/) - [Performance Challenge](https://www.midatlanticcontrols.com/tech-support/performance-challenge/) - [FAQ](https://www.midatlanticcontrols.com/tech-support/faq/) [Home](https://www.midatlanticcontrols.com/) [/ News](https://info.midatlanticcontrols.com/blog) / Building Management System Cyber Security # Building Management System Cyber Security July 6, 2022 By [Mid-Atlantic Controls](https://info.midatlanticcontrols.com/blog/author/mid-atlantic-controls) 4 minute read ![building system icons connected over a skyscraper representing the importance of BMS cyber security](https://info.midatlanticcontrols.com/hs-fs/hubfs/AdobeStock_168660747.jpeg?width=3840&name=AdobeStock_168660747.jpeg) Hackers, cybercriminals, and other malicious actors are increasingly targeting building systems to access companies’ critical enterprise systems. Keep reading to learn why building management system cyber security is the new front line in protecting companies from online attacks. ## **Mind the Door: BMS Building Management System Cyber Security** Smart building technology is meant to open the door to increased safety and energy efficiency. At the same time, increasingly complex interconnected systems offer new pathways for criminals, terrorists, and state-sponsored hackers to access information or even hijack control of systems. Here’s why upgrading your building management system’s (BMS) cyber security is critical. ### **Front and Center** Savvy facilities managers have long known that connecting more of their building’s systems to the Internet comes with a higher risk of malicious intrusions. Until now, however, that risk has been seen as a threat mainly to the building itself. Operators worried that hackers would be able to set off alarms, open doors, turn off lighting or ventilation, or even access surveillance systems. While very serious, an even greater risk is that hackers gain access to your occupant’s corporate networks, making it possible to: -    Steal assets or data -    Seize control of systems and demand ransoms, or -    Disrupt essential operations and services.   A study by the [Harvard Business Review](https://iiot-world.com/cybersecurity/facility-managers-guide-to-building-systems-and-cybersecurity/) found that 60% of cybersecurity breaches at publicly traded companies in 2017 were through computer systems belonging to suppliers and contractors of the companies, up from 25% in 2010. Many of those systems are by definition tied directly to BMS infrastructure. Separately, a study by [Kaspersky Labs](https://memoori.com/37-8-of-smart-building-automation-systems-were-attacked-in-h1-2019-kaspersky-reports/) of 40,000 servers used for building automation operations found that 37.8% of these computers had been targeted by malware, phishing, or ransomware attacks. These findings put you, as a building owner or facilities manager, front and center in the cybersecurity war, with increased responsibilities and added liabilities. ### **Hackers’ Paradise** This increased exposure is being driven by a number of trends, including: - **The Internet of Things (IoT)**—more individual devices, often with inadequate security or known vulnerabilities, are directly connected to the Internet. - **Increased automation**—BMS systems are connecting previously siloed functions to allow control of multiple systems through a single interface. - **Open-source systems**—Devices from different vendors can increasingly be accessed and controlled using open system standards such as OpenADR. - **Cloud computing**—More and more companies’ critical systems and data are being stored and operated remotely by third-party contractors. - **Higher safety and efficiency standards**—Ironically, increased security concerns, as well as the climate crisis, are driving increased integration of smart building technology, increasing touchpoints between BMS infrastructure and corporate enterprise systems. ### **Playing With a Full Stack** A recent paper by the Department of Energy’s [Pacific Northwest National Laboratory](https://www.energy.gov/eere/buildings/articles/challenges-and-opportunities-secure-buildings-cyber-threats) (PNNL) has highlighted the risk posed by the increased integration of operational technology and information technology. The paper also laid out a reference architecture showing how systems interrelate. This “stacked” architecture model includes: - **Levels 0-1:** Basic control and automation equipment such as smoke or temperature sensors, thermostats, elevator motors, and sprinklers. - **Level 2-3:** Local and building-wide controllers and subnets automating large parts of a building’s processes. - **Levels 4-5:** Company-specific IT systems holding sensitive data as well as the routers, VPN portals, and mail servers connecting these with remote and cloud-based resources. The paper suggests that level 3.5, where high-level building OT processes interface with external and enterprise IT systems, is critical, and should be treated as a cybersecurity “demilitarized zone “ (DMZ) — meaning that it be shielded from both internal and external systems by firewalls and that it includes only servers that provide services to both layers. ### **Points of Entry** The PNNL paper also identifies several points in this architecture that are at particular risk and that should be hardened or secured against unauthorized access. These include: - Any device with a routable IP address - Serial to ethernet connections that bypass enterprise firewalls - Cellular gateway services that bypass hardwired cybersecurity requirements, and - Servers that share OT and IT data. In fact, any system that shares information that was previously siloed poses a potential threat.  For example, sophisticated HVAC or access control systems that use video surveillance to optimize climate control or deploy elevators could also be used to track the movement of key employees, providing valuable information for targeted “spear-phishing” scams. ## **Welcome to the Front Line** Consider the example of a typically connected process management unit. This unit alone could use remote connections to allow it to: - Send and receive utility grid signals such as OpenADR to optimize energy use - Integrate with cloud-based regulatory and energy monitoring service - Provide access, comfort, and location services through occupant's cellular devices, and - Provide vendor monitoring and fault detection, sometimes through their own cellular or cloud-based networks. Each of these separate integrations represents an access point for malicious actors to not only hijack control of aspects of your building management system but to potentially access sensitive corporate data or operations systems. Your building’s systems must be integrated, up-to-date, and secure. ## **MACC Supports BMS Integration to Improve Cyber Security** Legacy BMS components that have been connected to the cloud without updating security protocols pose a particular cybersecurity risk. MACC can help you upgrade existing systems to fully secure and integrated infrastructure that is both safe and [future-ready](https://info.midatlanticcontrols.com/blog/future-proof-bms-with-new-hardware). Despite the risks, increased BMS integration, standardization and interoperability are not going away. In fact, using these tools right is the best way to guarantee your building’s security. Click below for more on BMS integrations and services to meet your cyber security needs. [![Learn More About Protecting Your BMS](https://no-cache.hubspot.com/cta/default/2761924/aef84eb8-1c1e-4630-9dd1-1250eab7dba4.png)](https://cta-redirect.hubspot.com/cta/redirect/2761924/aef84eb8-1c1e-4630-9dd1-1250eab7dba4) [Request a Consult](https://www.midatlanticcontrols.com/tech-support/schedule-a-free-consultation/) [![](https://info.midatlanticcontrols.com/hubfs/2018/04/MACC-ebook-section-vertical-02.jpg)](https://info.midatlanticcontrols.com/ebooks/what-facility-managers-need-to-know-about-bas) [![Building Automation Systems (BAS)](https://info.midatlanticcontrols.com/hs-fs/hubfs/Mid%20Atlantic%20Controls%20Jan%202017/Images/f1a.png?width=72&height=57&name=f1a.png)](https://www.midatlanticcontrols.com/building-systems/building-automation-systems-bas/) **[BUILDING](https://www.midatlanticcontrols.com/building-systems/building-automation-systems-bas/)** **[AUTOMATION](https://www.midatlanticcontrols.com/building-systems/building-automation-systems-bas/)** MACC provides engineering and install services related building automation and control systems. [Learn More](https://www.midatlanticcontrols.com/building-systems/building-automation-systems-bas/) [![Legacy Upgrades & Integration](https://info.midatlanticcontrols.com/hs-fs/hubfs/Mid%20Atlantic%20Controls%20Jan%202017/Images/f3a.png?width=72&height=57&name=f3a.png)](https://www.midatlanticcontrols.com/building-automation-services/legacy-upgrades/) [**LEGACY**](https://www.midatlanticcontrols.com/building-automation-services/legacy-upgrades/) **[UPGRADES](https://www.midatlanticcontrols.com/building-automation-services/legacy-upgrades/)** MACC helps customers extend the life of the an existing Building Automation System. [Learn More](https://www.midatlanticcontrols.com/building-automation-services/legacy-upgrades/) [![Service & Maintenance](https://info.midatlanticcontrols.com/hs-fs/hubfs/Mid%20Atlantic%20Controls%20Jan%202017/Images/f4a.png?width=72&height=57&name=f4a.png)](https://www.midatlanticcontrols.com/building-automation-services/maintenance/) **[SERVICE &](https://www.midatlanticcontrols.com/building-automation-services/maintenance/)** **[MAINTENANCE](https://www.midatlanticcontrols.com/building-automation-services/maintenance/)** Optimize equipment and streamline facility management with scheduled maintenance. [Learn More](https://www.midatlanticcontrols.com/building-automation-services/maintenance/) [BLOG CATEGORIES](https://info.midatlanticcontrols.com/blog) - [News](https://info.midatlanticcontrols.com/blog/topic/news) - [Building Automation Systems](https://info.midatlanticcontrols.com/blog/topic/building-automation-systems) - [Press](https://info.midatlanticcontrols.com/blog/topic/press) - [MACC](https://info.midatlanticcontrols.com/blog/topic/macc) - [building automation system](https://info.midatlanticcontrols.com/blog/topic/building-automation-system) - [building control](https://info.midatlanticcontrols.com/blog/topic/building-control) - [Energy Management Services](https://info.midatlanticcontrols.com/blog/topic/energy-management-services) - [building automation control](https://info.midatlanticcontrols.com/blog/topic/building-automation-control) - [building automation](https://info.midatlanticcontrols.com/blog/topic/building-automation) - [Tridium](https://info.midatlanticcontrols.com/blog/topic/tridium) - [multi-system integration](https://info.midatlanticcontrols.com/blog/topic/multi-system-integration) - [BAS Maintenance](https://info.midatlanticcontrols.com/blog/topic/bas-maintenance) - [BAS service](https://info.midatlanticcontrols.com/blog/topic/bas-service) - [Cost Reduction Facts & Figures](https://info.midatlanticcontrols.com/blog/topic/cost-reduction-facts-figures) - [Siemens](https://info.midatlanticcontrols.com/blog/topic/siemens) - [building data analytics](https://info.midatlanticcontrols.com/blog/topic/building-data-analytics) - [non-proprietary building automation system](https://info.midatlanticcontrols.com/blog/topic/non-proprietary-building-automation-system) - [smart building](https://info.midatlanticcontrols.com/blog/topic/smart-building) - [Environmental Impact](https://info.midatlanticcontrols.com/blog/topic/environmental-impact) - [building automation technology](https://info.midatlanticcontrols.com/blog/topic/building-automation-technology) ## OUR CLIENTS ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/Federal-Reserve-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/VCU-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/10/VA_DGS-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/UR-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/SunTrust-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/Capital-One-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/Bon-Secours-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/Wells-Fargo-Logo.png) ![](https://www.midatlanticcontrols.com/wp-content/uploads/2018/09/Anthem-Logo.png) - - - - - - © 2026 Mid-Atlantic Controls Corp. :: 8511 Oakview Ave., Richmond, VA 23228 :: [Privacy Policy](https://www.midatlanticcontrols.com/privacy-policy/) :: Web Design & Marketing by [WebStrategies](https://www.webstrategiesinc.com/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Organization", "name" : "Mid-Atlantic Controls Corp.", "url" : "https://www.midatlanticcontrols.com/" }, "dateModified" : "2022-07-06", "datePublished" : "2022-07-06", "description" : "As smart buildings become more interconnected, Mid-Atlantic Controls highlights how upgrading and securing building management systems (BMS) is essential to protect against cyber threats targeting both building operations and corporate networks.", "headline" : "Building Management System Cyber Security", "image" : "https://info.midatlanticcontrols.com/hs-fs/hubfs/AdobeStock_168660747.jpeg?width=1920&name=AdobeStock_168660747.jpeg", "mainEntityOfPage" : { "@id" : "https://info.midatlanticcontrols.com/blog/building-management-system-cyber-security", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://info.midatlanticcontrols.com/hubfs/Mid%20Atlantic%20Controls%20Jan%202017/Images/logo.png" }, "name" : "Mid-Atlantic Controls Corp." } } ```