Operational Technology and Building Automation

Lesson 7.1

What OT Actually Means

Operational Technology (OT) refers to hardware and software that monitors and controls physical equipment, processes, and infrastructure. It is the technology that makes things happen in the physical world.

BAS is unambiguously OT. When a BAS controller fails, something stops working in the physical world.

SCADA: Supervisory Control and Data Acquisition. The industrial term for what BAS calls a head end or supervisor.

The IT/OT Divide

For most of BAS history, IT and OT were completely separate. That separation is now largely gone in new construction.

The benefit: Data from the building can flow to enterprise systems. Remote access becomes straightforward.

The risk: A BAS system on the corporate network is accessible from anywhere on that network. Most BAS equipment was designed when physical access was the only assumed attack vector.

The tension: IT wants aggressive patching and replacement cycles. OT systems are often 20-year investments that cannot be easily updated.

Cybersecurity Basics for BAS

Default credentials are a real attack vector: The majority of BAS controllers ship with default usernames and passwords. Change them at installation.

Open ports and services: Controllers often run web servers, Telnet, FTP. Close ports that are not needed.

Network segmentation: The BAS network should be on its own VLAN, separated from the corporate data network.

What an actual attack looks like: There have been documented cases of ransomware encrypting JACE controllers and Niagara supervisors.

The Field Tech's Role

You set the first line of defense: When you commission a controller, you decide what the password is and whether the default Telnet port stays open.

You are often the only person who understands both sides: IT staff don't understand BAS controllers. Facility managers don't understand network topology. You can bridge these gaps.

Change management matters: Unplanned changes cause outages. Ask before you update firmware. Test during off-hours. Document what you did.

Remote access is not zero-risk: Use strong unique passwords. Do not share credentials.

# PART 2: ACCESS CONTROL TRACK