Your building doesn’t need to be on the internet

Today, buildings run on software. Ventilation, heating, cooling, access control: when it all works, nobody notices, and that’s exactly the point. But the systems that keep a building comfortable and running can also become a risk, if they can be reached from the internet.

This is not an IT problem in the usual sense

When a building system is compromised, the consequences go beyond data. They can be physical and financial: a refrigeration system that stops working, stock that has to be thrown away, an indoor climate that can’t be controlled. Building control systems manage real things like temperature, air and doors. And the most common protocols, BACnet and Modbus, were designed for closed networks and have no login of their own.

This isn’t just theory. Investigations and incidents across Europe have shown thousands of building and industrial control systems visible on the open internet, many with no protection beyond a username and password, and attackers taking control of refrigeration in supermarkets.

The password is not protection

Many people assume a strong password is enough. It is not, and national cyber security authorities say the same. Passwords leak and get shared between contractors, and software has vulnerabilities. The important question is simpler: does the system need to be reachable from the internet at all?

Our answer is no. Building systems should be protected, not exposed.

How we build it

• No open ports. iBOS Nexus sits in the building and only makes outbound, encrypted connections. There is nothing to find for anyone scanning the internet.
• No VPN sprawl. All remote access goes through iBOS Connect: one platform instead of a patchwork of VPNs, remote desktops and open ports.
• The right person, the right system. Mandatory two-factor authentication, SSO and role-based access.
• Full traceability. Every sign-in and change is logged.
• Tested hardware. Nexus is UL and CE certified and penetration tested.

Five things to do now

1. Find out which systems in your portfolio are exposed to the internet.
2. Close direct exposures and open ports.
3. Require two-factor authentication for all remote access.
4. Replace or isolate equipment that no longer receives security updates.
5. Bring remote access together in one solution with a log, so you know who has had access.

A building that is reachable isn’t necessarily a building that has been hacked. But the door is ajar, and you can close it today.