When it comes to selecting the right building management systems, new research cautions facility managers to choose carefully, as the overwhelming majority of them are prone to serious vulnerabilities.
Cyber-physical systems (CPS) protection company Claroty has unveiled new research on the threats that face building management systems (BMS) and building automation systems (BAS).
Compiled by the company’s cybersecurity vulnerability and threat research team, Team82, the report analysed nearly half a million BMS across more than 500 CPS organisations.
It found 75 percent of organisations have BMS affected by known exploited vulnerabilities (KEVs).
Among KEV-affected organisations, 51 percent are hit by KEVs that are also linked to ransomware and are insecurely connected to the internet.
Within those organisations, two percent of devices contain the same level of risk, meaning that devices essential to business operations are operating at the highest level of risk exposure.
The need to closely monitor threats to BMS
BMS is used in many facilities of varying sizes, including commercial real estate, retail, hospitality, and data centres, to operate systems such as HVAC, lighting, energy, elevators and security systems.
Any cyber threat to the BMS can have crippling effects on the facility grinding its most basic operations to a halt.
“Oftentimes, BMS and BAS are being operationalised on the network without thinking about the cybersecurity implications,” Claroty chief strategy officer Grant Geyer said.
“What’s being gained in efficiency and convenience might be coming at a real risk if not effectively secured – for instance, the cooling of data centres or refrigeration of perishable goods in retail, which are critical systems to abruptly be taken offline if compromised.”
Claroty says that by taking an exposure management-based approach and focusing on the unique needs and challenges of CPS environments, organisations can identify, assess and prioritise the riskiest devices.
To effectively tackle potential attack paths on the system, Team82’s State of CPS Security 2025: Building Management System Exposures report suggests that facility managers must understand how different building management assets within their network communicate and where they shouldn’t. They should then leverage network protection tools, such as firewalls, to control, monitor and segment communication pathways.
It adds that as these management systems become increasingly “smarter,” organisations must adopt a security framework that offers cybersecurity decision-makers and asset owners with a clear assessment of their security posture, as well as a remediation plan mapped out by risk management specialists.
Read more: Honeywell introduces AI-powered building management software
