Top 10 OT Security Configurations for HVAC and Building Management Systems

When cybersecurity professionals discuss the convergence of Information Technology (IT) and Operational Technology (OT), the conversation inevitably gravitates toward manufacturing floors and power grids. Yet, one of the most porous attack surfaces in the modern enterprise sits quietly on the roof and in the basement: the Heating, Ventilation, and Air Conditioning (HVAC) and Building Management Systems (BMS).

The infamous 2013 retail breach that compromised 40 million credit cards began not with a sophisticated zero-day in a point-of-sale system, but with stolen credentials from an HVAC vendor. Fast forward to today, and the threat landscape has grown exponentially more complex. Driven by IoT integration and cloud analytics, the global Building Automation System (BAS) market is projected to reach up to $220 billion by 2032.

Modern HVAC systems are hyper-connected networks of Programmable Logic Controllers (PLCs), edge sensors, and cloud gateways. Because legacy protocols like BACnet and Modbus were engineered for reliability rather than security, they inherently lack encryption and authentication. According to recent data, 88% of OT networks struggle with detection and response, and over one-third of manufacturing breaches come from unpatched software or devices.

To stop threat actors from weaponizing your climate control against your corporate network-or holding physical civic operations hostage-facilities must implement rigorous, OT-specific defenses. Here are the top 10 critical security configurations for modern HVAC and BMS deployments.

Best 10 OT Security Configurations for HVAC/Control Systems

1. Implement Strict Micro-Segmentation (The Purdue Model)

Do not allow your HVAC controllers to sit on a flat corporate IT network. Apply the Purdue Enterprise Reference Architecture to segment your BMS. Your supervisory controllers and historian databases (Level 3) must be strictly separated from corporate IT (Level 4/5) via a Demilitarized Zone (DMZ), and field devices like variable frequency drives (Level 1) should be completely isolated from everything except their direct controllers.

2. Deploy Deep Packet Inspection (DPI) for OT Protocols

Standard IT firewalls operate at the IP and port levels, which is insufficient for a BMS. If port 47808 (default for BACnet) is open, an IT firewall will blindly pass all BACnet traffic. You must configure DPI firewalls capable of dissecting industrial protocols. This allows you to write granular rules-for example, permitting a workstation to read a temperature sensor via BACnet, but blocking a write command that attempts to alter the setpoint.

3. Transition to BACnet/SC (Secure Connect)

Legacy BACnet transmits data in plaintext, making it trivial for an attacker to eavesdrop on building metadata, spoof devices, or inject malicious commands. Where possible, configure and upgrade your infrastructure to BACnet/SC. This modern standard eliminates the reliance on insecure UDP broadcasts and mandates TLS 1.3 encryption and certificate-based authentication for all device-to-device communication.

4. Enforce Zero Trust Network Access (ZTNA) for Third-Party Vendors

HVAC maintenance requires vendor access, but traditional VPNs grant broad network visibility. Research indicates that 42% of manufacturers experienced a breach via third-party/vendor access, yet over half neglect pre-access review of vendors. Replace vendor VPNs with ZTNA. Configure policies so that an external mechanical contractor is authenticated, verified, and granted access only to the specific IP address of the chiller or supervisory software they are contracted to maintain, with all sessions monitored and recorded.

5. Disable Unused Ports, Services, and Default Credentials

HVAC controllers often ship with embedded web servers, FTP, and Telnet enabled by default for ease of setup. Conduct a rigorous hardening sweep. Disable all unencrypted management protocols (force SSH/HTTPS), shut down unused physical ethernet ports on the PLCs, and eradicate factory-default credentials-which are widely cataloged on platforms like Shodan and easily exploited.

6. Implement Passive Asset Discovery

You cannot protect what you cannot see, but active IT scanning tools (like Nmap) can easily crash fragile, legacy HVAC controllers, causing physical downtime. Configure passive anomaly detection sensors connected to a SPAN port or network tap. These tools analyze mirrored traffic to build a real-time inventory of all BMS assets and baseline normal communication patterns without injecting disruptive packets into the OT environment.

7. Establish Compensating Controls for Unpatchable Legacy Assets

You will inevitably encounter a 15-year-old chiller controller that runs on an outdated, vulnerable OS and cannot be patched without breaking the manufacturer’s warranty. Instead of accepting the risk, configure strict compensating controls. Isolate the asset behind a dedicated protocol gateway, lock down its MAC address on the switch port, and restrict its communication strictly to the master BMS server.

8. Harden the BMS Supervisory Workstations

The Windows machines running your BMS software are prime targets. If these workstations are compromised, the attacker essentially gains the keys to the entire physical building. Remove these workstations from general Active Directory pools, restrict their outbound internet access entirely, disable USB ports via Group Policy, and deploy an OT-aware Endpoint Detection and Response (EDR) agent.

9. Secure the Physical and Edge Perimeter

Cybersecurity in OT is deeply intertwined with physical security. A highly secured network is useless if an attacker can walk into a utility closet and plug a laptop directly into a field controller. Configure port security (802.1X) on all edge switches to prevent unauthorized devices from connecting, and ensure that all physical cabinets housing smart HVAC gateways are alarmed and monitored.

10. Align Incident Response to AIC, not CIA

Configure your Security Operations Center (SOC) playbooks to reflect the realities of the physical world. While IT prioritizes Confidentiality, OT must prioritize Availability, Integrity, and Safety (AIC). If an anomaly is detected on the HVAC network, automated IT responses (like immediately isolating a sub-network) might cause life-safety systems-such as surgical room air-handling or data center cooling-to fail. Incident response must be co-engineered by both the cyber team and the facility engineers.

Conclusion

As buildings become smarter and the push for energy efficiency drives deeper cloud integration, the BMS is transitioning from a mechanical afterthought to a tier-one digital asset. Securing HVAC systems requires abandoning the illusion of the “air gap” and applying rigorous, continuous, and OT-native engineering configurations to bridge the divide between bits, bytes, and physical infrastructure. By addressing legacy protocol vulnerabilities, enforcing strict segmentation, and managing third-party risk, organizations can defend their physical environments against an increasingly sophisticated cyber threat landscape.