Home / Duct Cleaning / Guide
Building services - technology explained
A building management system - the network that controls a building's ventilation, heating, cooling and more - is, at bottom, a computer system connected to a network. And like any connected computer system, it can be a cybersecurity risk if it is not protected. As building systems become more connected, this is a side of building management worth understanding. Here is the cybersecurity side of BMS explained.
The short answer
A building management system (BMS) controls a building's services - ventilation, heating, cooling, lighting, access and more - through networked controllers and computers. Because it is a connected computer system controlling real physical systems, it has a cybersecurity dimension: if it is not properly secured, it could be accessed or compromised by an attacker, who could then disrupt the building's systems - turning off or misusing the ventilation, heating and other services, or using the BMS as a way into the wider network. This matters because a BMS is often overlooked in cybersecurity - treated as building plant rather than IT - so it can be left less protected than other computer systems, making it a weak point. Securing it means treating it as the networked computer system it is: keeping it updated, controlling access to it, segregating it from other networks appropriately, and applying the same security discipline as any IT system. So the cybersecurity side of a BMS is that it is a connected computer controlling physical building systems, which makes it both a target and a potential entry point - and which is why it needs protecting, not left as an unsecured afterthought.
A BMS is a computer network
The starting point for the cybersecurity side of a building management system is recognising what a BMS actually is: a computer system, connected to a network, that controls the building's services. A BMS uses networked controllers, sensors and computers to monitor and control the ventilation, heating, cooling, lighting, and often access control, fire systems and more - automating and managing the building's plant. So although it is thought of as building services equipment, at bottom it is a computer network - controllers and computers communicating over a network to run the building's systems. That is the key fact behind its cybersecurity dimension.
And crucially, this computer network controls real, physical systems - it does not just process information, it operates the building's plant. The BMS can turn ventilation and heating on and off, adjust their operation, and control other services - it has real-world effects, actuating the building's systems. So a BMS is a computer network with control over physical building services, which is what gives its cybersecurity a significance beyond data: compromising the BMS means gaining control over, or the ability to disrupt, the actual building systems. This combination - a connected computer system that controls real physical plant - is the essence of why a BMS has a cybersecurity side. It is not just an IT system holding data; it is an IT system running the building, which raises the stakes of it being compromised.
What a compromise could do
Because a BMS controls real building systems, a cybersecurity compromise of it could have real consequences - which is why it matters. If an attacker gained access to a poorly secured BMS, they could potentially disrupt the building's systems: turning off or misusing the ventilation (with effects on air quality and comfort), the heating or cooling, the lighting, or other controlled services - interfering with the building's operation. For a building that depends on its systems - a hospital, a data centre, a food premises with critical refrigeration or ventilation - such disruption could be seriously damaging. So one consequence of a compromised BMS is the disruption of the physical systems it controls.
The other significant risk is that a BMS can be a way into the wider network - an entry point for an attacker to reach other systems. Because the BMS is connected to networks, and is often less well secured than other IT (being treated as building plant), it can be a weak point that an attacker uses to gain a foothold and then move to more valuable systems - the corporate network, data systems, and so on. So a compromised BMS is a risk not only for the building systems it controls directly, but as a potential doorway into the organisation's wider IT. Both risks - disrupting the building's physical systems, and providing a route into the wider network - flow from the BMS being a connected computer system that is often under-protected. These are the concrete reasons the cybersecurity of a BMS matters: it is a target for disruption and an entry point for wider attack.
Why a BMS is often overlooked
A particular reason the cybersecurity of a BMS matters is that it is often overlooked - treated as building plant rather than as the IT system it is, and so left less protected than other computer systems. Cybersecurity attention and discipline are typically focused on the obvious IT - the computers, servers and networks that people recognise as IT - while the BMS, thought of as building services equipment managed by facilities rather than IT, can fall between the cracks. It may not be included in the organisation's cybersecurity measures, kept updated, or secured to the same standard, because it is not seen as part of the IT estate to be protected.
This oversight is exactly what makes a BMS a weak point. An unsecured or poorly secured system, overlooked by the security measures applied elsewhere, is a vulnerability - and if that system controls physical building services and connects to the network, it is a significant one. So the tendency to treat the BMS as plant rather than IT is itself part of the risk: it leads to the BMS being less protected than it should be, precisely because its nature as a networked computer system is not recognised. Addressing the cybersecurity of a BMS therefore starts with recognising it as the connected computer system it is, and bringing it within the security discipline applied to IT - rather than leaving it as an overlooked afterthought. The first step to securing a BMS is realising it needs securing, which the tendency to see it as mere plant works against. So understanding that a BMS is IT, and needs IT-level protection, is the key shift.
Securing it
Securing a building management system means treating it as the networked computer system it is, and applying the same kind of security discipline as to any IT. This includes keeping the BMS and its components updated, so known vulnerabilities are patched rather than left open; controlling access to it - strong authentication, limiting who can access it, changing default passwords - so it is not easily reached by an attacker; segregating it from other networks appropriately, so that a compromise of the BMS cannot easily spread to the wider network (and vice versa); and generally including it within the organisation's cybersecurity measures and monitoring, rather than leaving it outside them. These are the same principles applied to any IT system, brought to the BMS.
Doing this addresses both the risks: proper security makes the BMS harder to compromise (protecting the building systems it controls) and, through segregation, limits its use as a way into the wider network. It is a matter of extending the organisation's cybersecurity to cover the BMS, closing the gap that treating it as mere plant leaves open. For those responsible for a building's systems, this means working with IT and security to bring the BMS within the security regime - recognising it as a connected computer system that controls real building services, and protecting it accordingly. So the cybersecurity side of a BMS, understood, points to a clear response: secure the BMS as the IT system it is, so that the connectivity and control that make it useful do not also make it an unprotected vulnerability. As building systems become more connected, this becomes more important - a connected BMS controlling more of the building is more valuable to protect, and more damaging if compromised. Recognising and securing the cybersecurity side of the BMS is part of managing a modern, connected building responsibly.
The takeaway
A building management system controls a building's services - ventilation, heating, cooling, lighting and more - through networked controllers and computers, which makes it, at bottom, a connected computer system that controls real physical plant. That is the essence of its cybersecurity side: it is not just an IT system holding data, but one running the building, so compromising it means gaining control over, or the ability to disrupt, the actual building systems. If a poorly secured BMS were compromised, an attacker could disrupt the ventilation, heating and other services, or use the BMS as a way into the wider network - both real risks flowing from it being a connected computer that is often under-protected.
That under-protection is a key part of the problem: a BMS is often overlooked, treated as building plant rather than the IT system it is, so it falls outside the security discipline applied elsewhere and becomes a weak point. Addressing it starts with recognising the BMS as a networked computer system, and securing it as such - keeping it updated, controlling access, segregating it appropriately, and bringing it within the organisation's cybersecurity measures. As building systems become more connected, this matters more, not less. So the cybersecurity side of a building management system is that it is a connected computer controlling physical building services - a target and a potential entry point - which is why it needs protecting like any IT system, rather than being left as an unsecured afterthought.
Questions
That a BMS is, at bottom, a connected computer system controlling real physical building services - ventilation, heating, cooling and more - so if it is not properly secured, it could be compromised by an attacker who could then disrupt those systems or use the BMS as a way into the wider network. It is an IT system running the building, which gives it a cybersecurity dimension beyond just data.
Two main risks. An attacker could disrupt the building's systems - turning off or misusing the ventilation, heating, cooling or other controlled services - which for a building that depends on its systems could be seriously damaging. And the BMS can be a way into the wider network, an entry point for an attacker to reach other, more valuable systems, especially as it is often less well secured than other IT.
Because it is often overlooked - treated as building plant rather than the IT system it is - so it can fall outside the organisation's cybersecurity measures, not kept updated or secured to the same standard as other computer systems. That oversight makes an unsecured, network-connected system that controls physical services a significant vulnerability, precisely because its nature as IT is not recognised.
By treating it as the networked computer system it is and applying IT security discipline: keeping it and its components updated to patch vulnerabilities; controlling access (strong authentication, limiting access, changing default passwords); segregating it from other networks appropriately so a compromise cannot easily spread; and including it in the organisation's cybersecurity measures and monitoring rather than leaving it outside them.
Because building systems are becoming more connected - a BMS controlling more of the building, connected to more networks, is both more valuable to protect and more damaging if compromised. As connectivity increases, the cybersecurity side of the BMS becomes more significant, so recognising and securing it is part of managing a modern, connected building responsibly, rather than leaving a growing vulnerability unaddressed.
Not directly - the BMS may control the ventilation, but keeping the physical ductwork clean and performing is separate, hands-on work that a BMS does not do. So the cybersecurity of the BMS and the physical maintenance of the systems it controls are two different things: the BMS manages the systems' operation, while cleaning and maintenance keep the physical plant working. Both matter for a well-run building, but they are distinct.
A BMS may control the ventilation, but keeping the physical system clean and performing is separate, hands-on work. We clean and maintain the ductwork the BMS manages, the physical side of a well-run system.
