Any host that can send UDP packets to a BACnet/IP controller can usually discover it, read its points and write new setpoints or commands, because classic BACnet has no authentication or encryption. BACnet (ANSI/ASHRAE Standard 135, also ISO 16484-5) runs heating, ventilation, lighting, access and energy systems in most commercial buildings, hospitals, campuses and data centres. BACnet Secure Connect (BACnet/SC) adds a certificate-authenticated, encrypted datalink built on WebSockets and TLS, but it complements rather than replaces BACnet/IP and MS/TP, so real buildings will run mixed networks for years. This guide explains how classic BACnet is attacked, how BACnet/SC works, how to manage its certificates, how to plan a migration, and what to monitor. It is for building automation engineers, facilities and OT security teams and integrators, and goes deeper than the Building Management System Security Guide.
Key takeaways
- BACnet/IP trusts the network. Discovery, property reads and writes, device restarts and communication control are available to anyone who can reach UDP 47808, so segmentation is the first control everywhere.
- BACnet/SC secures the link, not every decision. It gives mutual certificate authentication and encryption between nodes and hubs; authorisation of what an authenticated device may do arrived later, in addendum 135-2020cp (approved November 2024).
- Every BACnet/SC device is a machine identity. Each needs an operational certificate from a CA the site controls, with issuance, renewal and replacement built into building maintenance.
- Migration is incremental. BACnet/SC routers connect secure segments to legacy BACnet/IP and MS/TP, which stay insecure to anyone with access to them; MS/TP itself cannot be secured by BACnet/SC.
- The hub is the critical asset. In hub-and-spoke designs every message passes through the primary hub, so its availability, failover hub, certificates and placement (on site or in the cloud) need deliberate design.
How classic BACnet works and how it is abused
BACnet models a building as devices containing objects (analog inputs, binary outputs, schedules, trend logs, the device object itself) with properties that clients read and write through standard services. BACnet/IP carries these over UDP 47808; MS/TP carries them over RS-485 serial; BACnet Broadcast Management Devices (BBMDs) forward broadcasts between IP subnets, and foreign device registration lets a remote host join that broadcast domain.
| BACnet service or feature | Legitimate use | Abuse on an unprotected network | ATT&CK for ICS v20 |
|---|---|---|---|
| Who-Is and I-Am | Device discovery | Map every controller, vendor and model in seconds | T0846 Remote System Discovery |
| ReadProperty, ReadPropertyMultiple | Supervisors and dashboards read points | Enumerate points and names to find chillers, air handlers, doors | T0861 Point & Tag Identification |
| WriteProperty with priority array | Operators override setpoints and outputs | Command equipment or override at a high priority so the BMS cannot win | T1692.001 Unauthorized Message: Command Message |
| ReinitializeDevice | Restart a controller during maintenance | Repeated restarts, loss of control | T0814 Denial of Service |
| DeviceCommunicationControl | Silence a device during maintenance | Stop a controller talking to the supervisor | T0815 Denial of View |
| Foreign device registration on a BBMD | Remote workstation joins the BACnet network | An internet host registers and receives broadcasts | T0883 Internet Accessible Device |
| Plaintext on the wire | Simplicity | Sniffing and modification of values | T0842 Network Sniffing, T0830 Adversary-in-the-Middle |
Some controllers support passwords on ReinitializeDevice and DeviceCommunicationControl, but these are shared, sent unencrypted and often left at defaults (T1694.001 Default Credentials). Supervisory platforms that front BACnet networks have their own hardening needs and should be assessed with the vendor's hardening guidance.
How BACnet/SC works
BACnet/SC was introduced by addendum 135-2016bj, approved by ASHRAE and ANSI on 18 November 2019. BACnet International describes it as an encrypted datalink layer for IP networks that uses WebSockets and TLS for peer authentication, message encryption and reliable, connection-oriented communication, over IPv4 or IPv6. Standard BACnet messages run unchanged on top, so applications and objects do not change.
- Hub and nodes: a hub function acts as a central conversation manager. Nodes connect to it and send messages through it, and the hub forwards them to recipient nodes. This removes the need for broadcast and BBMDs.
- Primary and failover hubs: nodes are configured with a primary hub and a failover hub; if they cannot reach the primary they connect to the failover, and switch back when the primary returns.
- Direct connections: nodes can also accept and initiate direct connections to each other, for example for high-volume traffic between a supervisor and a controller.
- Certificates: each node authenticates with a certificate, and connections are mutually authenticated, so only devices with certificates issued by the site's CA can join.
- Addressing: the addendum adds a Device_UUID property and a 6-octet virtual MAC address for BACnet/SC.
- Routers: BACnet/SC routers connect SC networks to BACnet/IP and MS/TP segments, which is how existing devices are kept during migration.
Later addenda that matter for security
| Addendum | Approved | What it adds | Why it matters |
|---|---|---|---|
| 135-2016bj | 18 November 2019 | BACnet/SC datalink, Annex YY, Device_UUID, SC error codes, 6-octet VMAC | The base specification |
| 135-2020cd | 31 August 2021 | TLS 1.3 cipher suite application profile for BACnet/SC | Defines the cipher suites devices must offer, so interoperability does not force weak choices |
| 135-2020cc | 21 January 2022 | BACnet/SC configuration support, procedure for replacing certificates, network port configuration BIBBs | Makes certificate renewal and replacement a standard operation rather than a vendor-specific one |
| 135-2020cs | 28 June 2024 | Certificate Authority Requirements Interchange File Format | Lets a site describe its CA requirements in a standard file for integrators and tools |
| 135-2020cp | 29 November 2024 | Authentication and authorization, with changes to BACnet/SC, the Device object and BIBBs | Moves beyond "authenticated device can do anything" to controlled permissions |
The bacnet.org addenda list shows a BACnet 2024 edition heading. Check which edition and addenda each product claims, because a device that implements only 135-2016bj will not support standard certificate replacement or authorisation.
Certificates and identity for BACnet/SC
BACnet/SC turns every controller, router, hub and supervisor into a certificate-bearing machine identity. BACnet International's own journal identifies certificate creation and deployment as a challenge and an added administrative cost, and in buildings this is often the part nobody owns.
| Decision | Options | Guidance |
|---|---|---|
| Who runs the CA | Building owner, integrator, BMS vendor, corporate PKI team | The building owner should own the CA or contract it explicitly, so changing integrator does not mean losing control of every device identity |
| CA hierarchy | One CA per site, per estate, or an intermediate from the corporate PKI | A dedicated OT or building issuing CA keeps building devices separate from IT trust |
| Key generation | On device or by a tool | Prefer on-device key generation so private keys are never exported |
| Validity and renewal | Short or long lifetimes | Balance renewal effort against risk; track expiry so a certificate lapse does not stop a chiller plant. Use the 135-2020cc replacement procedure where supported |
| Revocation | Remove from hub trust, revoke at CA | Know how to evict a single stolen or decommissioned device without reissuing the site |
| Handover | Integrator keeps CA, or hands over | Make CA keys, certificate inventory and procedures a contract deliverable |
See the Machine Identity, PKI and Certificate Lifecycle Guide and the Certificate Expiry Outages Guide. Supervisor and analytics platforms that read BACnet data also hold service credentials and API keys; inventory them as NHIs. See the Identity for OT Environments Guide.
BACnet/SC or another control: choosing per segment
| Option | Protects against | Does not protect against | Best fit |
|---|---|---|---|
| Segmented BACnet/IP | Remote attackers outside the BMS zone | Any host inside the zone, including a compromised supervisor or a laptop plugged into a cabinet port | Interim state for every legacy site |
| BACnet/IP over a VPN | Interception across shared or wide-area networks | Spoofing by devices inside each end of the tunnel | Linking buildings over carrier networks before SC is available |
| BACnet/SC | Unauthenticated devices joining, sniffing and tampering on SC links | Misuse by an authenticated device until authorisation (135-2020cp) is implemented; legacy segments behind routers | New builds, refurbished backbones, cloud-connected and multi-site estates |
| Physical protection of MS/TP | Casual access to field buses | Anyone with cabinet access | All field controllers, alongside locked enclosures and tamper seals |
In practice a building will use all four at once. The aim is that every path from an untrusted network to a controller passes through either a BACnet/SC authentication point or a monitored, restricted segment boundary, and that the remaining insecure segments are small, physically protected and known.
Designing a BACnet/SC network
- Hub placement: BACnet International's journal describes two common patterns: hub and BACnet/SC router inside the building firewall, or hub in the cloud with a router inside the building. An on-site hub keeps control local if the internet link fails; a cloud hub simplifies multi-site connectivity but makes the provider's platform part of your control path.
- Failover: always configure a failover hub on separate hardware, and test failover and failback during commissioning.
- Segmentation still applies: put BACnet/SC nodes, legacy BACnet/IP segments and MS/TP trunks in separate zones, and allow only hub and router connections between them. See the OT Network Segmentation Guide.
- Legacy segments: BACnet/IP and MS/TP behind a router remain insecure to anyone with access to them. Physically protect MS/TP trunks and controller cabinets, and use VPNs where BACnet/IP must cross shared networks.
- Remote access: integrator and vendor access to the BMS goes through an approved, MFA-protected remote access path, not a foreign device registration from the internet. See the OT Third-Party and Integrator Access Guide.
Migration planning
Few buildings can replace every controller at once. Plan BACnet/SC as a staged migration aligned with refurbishment and controller lifecycle.
- Inventory: list every BACnet device, its datalink (IP or MS/TP), firmware, vendor, and whether it supports BACnet/SC and which addenda. Discovery with Who-Is from an authorised workstation, compared with the BMS database, usually finds forgotten devices. See the OT Asset Visibility Guide.
- Remove internet exposure: close any UDP 47808 exposure and foreign device registration from outside the building network immediately; this needs no new technology.
- Segment the existing BACnet/IP network: separate it from IT and guest networks and restrict which hosts may send writes and restarts.
- Stand up the PKI and hubs: issuing CA, primary and failover hubs, certificate inventory and renewal procedure, before the first device migrates.
- Migrate the backbone first: supervisors, routers and IP controllers on the building backbone move to BACnet/SC; MS/TP field buses stay behind BACnet/SC routers.
- Specify BACnet/SC in new work: require BACnet/SC with BTL listing, support for 135-2020cd and 135-2020cc, the site's CA requirements (135-2020cs format where tools support it), and authorisation under 135-2020cp as products appear.
- Retire BBMDs: as segments move to BACnet/SC, remove BBMD and foreign device configurations that are no longer needed.
Testing and rollback: pilot on one plant room or floor with the BMS vendor, confirm alarms, schedules and trends still work through the hub and routers, test hub failover and certificate replacement, and keep the previous BACnet/IP configuration available to restore within the maintenance window.
Single building vs estate: a single office building may run one on-site hub pair and one issuing CA managed by the facilities team with integrator support. An estate of hospitals or campuses should standardise hub placement, run a central building CA with per-site intermediates, and track certificates across sites with the same tooling used for other machine identities.
Detection and measurement
- On legacy BACnet/IP: WriteProperty to critical points from hosts other than the supervisor, ReinitializeDevice and DeviceCommunicationControl requests, Who-Is sweeps from unknown hosts, and new foreign device registrations on BBMDs.
- On BACnet/SC: failed TLS connections to hubs (unknown or expired certificates), new node identities, unexpected direct connections, and hub failover events.
- Certificates: certificates approaching expiry and certificates not in the inventory.
- Behaviour: override priorities set high on equipment that should be under automatic control, and setpoint changes outside occupancy patterns.
Feed these into the SOC or an OT monitoring platform; see the OT Network Security Monitoring Guide.
Metrics: BACnet devices reachable from the internet (target zero); percentage of IP backbone traffic on BACnet/SC; devices with certificates expiring in the next 60 days without a scheduled renewal (target zero); unauthorised write or restart attempts per month on legacy segments; percentage of new controllers procured with BACnet/SC.
Framework mapping
| Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | Threat (ATT&CK for ICS v20) |
|---|---|---|---|
| BACnet/SC TLS between nodes and hubs | SC-8 | PR.DS-02 | T0842, T0830 |
| Device certificates and mutual authentication | IA-3, SC-17 | PR.AA-03 | T1692.001 |
| Building CA and certificate lifecycle | SC-12, IA-5 | PR.AA-01 | T0830 |
| Authorisation (135-2020cp) and write restrictions | AC-3 | PR.AA-05 | T1692.001, T0814 |
| Segmentation, no internet exposure, BBMD control | SC-7 | PR.IR-01 | T0883, T0846 |
| Device inventory | CM-8 | ID.AM-01 | T0846, T0861 |
| Monitoring of BACnet traffic and hubs | SI-4 | DE.CM-01 | T0815, T0832 |
Common failure patterns
- Exposed BBMDs: a BBMD reachable from the internet accepts foreign device registration, putting an outside host on the building's broadcast network.
- "BACnet/SC ready" without a plan: devices bought with BACnet/SC capability but commissioned on BACnet/IP because nobody set up the CA and hubs.
- The integrator owns the CA: certificates issued from an integrator's laptop CA, so the owner cannot renew or revoke without them.
- Single hub: no failover hub configured, so a hub outage silences the building's control traffic.
- Forgotten legacy segments: secure backbone, but MS/TP trunks and BACnet/IP islands left reachable from tenant or IT networks.
- Default device passwords: restart and communication control passwords left at vendor defaults on controllers that are still on BACnet/IP.
No live NHI Mgmt Group breach page covers an internet-exposed BACnet incident, so none is linked here.
Practitioner checklist
- Confirm no BACnet device or BBMD is reachable from the internet and remove foreign device registrations from outside the building network.
- Inventory every BACnet device with datalink, firmware and BACnet/SC and addenda support.
- Segment BACnet/IP from IT, guest and tenant networks and restrict which hosts may write or restart devices.
- Set up an owner-controlled building CA with certificate inventory, renewal and revocation procedures before migrating.
- Deploy primary and failover hubs on separate hardware and test failover.
- Migrate the IP backbone to BACnet/SC first and keep MS/TP behind BACnet/SC routers with physical protection.
- Specify BACnet/SC with BTL listing and support for 135-2020cd, 135-2020cc and, as available, 135-2020cp in all new procurement.
- Make CA keys, certificate inventory and hub configuration a contract handover deliverable.
- Monitor writes, restarts, BBMD registrations, hub connection failures and certificate expiry.
Standards and references
- BACnet Committee: BACnet Addenda (135-2016bj, 135-2020cc, cd, cp, cs)
- ASHRAE: BACnet, Standard 135
- BACnet International: BACnet Secure Connect
- BACnet International: BACnet/SC, The Big Picture (BI Journal 18)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology Security
- MITRE ATT&CK for ICS: Unauthorized Message: Command Message
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Building Management System Security Guide · Industrial Protocol Security Guide · OT Security Guide