Every October, organizations across the globe mark Cybersecurity Awareness Month — a time to focus on digital safety, threat awareness and proactive protection. For Cimetrics, a pioneer in building automation and secure building systems, this month offers a powerful opportunity to spotlight how infrastructure, devices and networks in buildings must also be defended like traditional IT systems. 

Cimetrics: A Legacy of Secure Building Automation 

Since its founding, Cimetrics has been at the forefront of the building automation industry — developing the widely-used BACnet protocol stack, advancing network diagnostics, and most importantly, embedding cybersecurity into building systems. Our “Secured by Cimetrics™” (SbC) framework is designed to ensure that building automation systems (BAS) are defended against modern cyber threats — aligning OT (Operational Technology) with traditional IT security practices.

Why Cybersecurity Matters in Buildings 

While many organizations focus on IT infrastructure, building automation networks have quietly evolved into critical assets — controlling HVAC, lighting, security and IoT devices across facilities. Cimetrics emphasizes that as these systems become more connected, they also become more vulnerable. This tendency highlights that the BAS attack surface is real and must be managed with the same rigor as enterprise networks.  

This month we would like to give you some tips on

Securing BACnet/IP and BACnet/SC Networks 

As building systems become smarter and more connected, they also become more exposed. From HVAC to lighting to energy management, modern buildings rely on BACnet/IP and BACnet/SC (Secure Connect) for interoperability. But with connectivity comes risk—and protecting these networks is now essential to operational resilience. 

Cimetrics has long championed secure building integration through innovations like Secured by Cimetrics™ (SbC) products, and here are expert-backed tips to help you strengthen your BACnet infrastructure. 

1. Upgrade to BACnet/SC for Built-In Security 

BACnet/SC uses TLS encryption and certificate-based authentication to secure communications. When possible: 

• Migrate BACnet/IP segments to BACnet/SC gradually. 

• Deploy secure hubs and certificate management devices such as Cimetrics SbC4000 to manage connections and certificates. 

• Assign unique certificates to every device using a trusted CA such as Cimetrics SbC4000 or BACCARI tool from BACnet International. 

2. Segment Networks to Reduce Risk 

Keep automation systems separate from corporate IT or guest networks. 

• Use dedicated VLANs or subnets for BACnet traffic. Separate networks with routers or BNSDs such as Cimetrics SbC3100. 

• Limit broadcast domains to essential devices. 

• Implement firewalls and BACnet routers with strict access rules. Cimetrics devices have firewall functions. 

3. Control Access and Permissions 

Access control is key: 

• Restrict write access to authorized users. 

• Enforce strong, unique credentials. 

• Disable default or unused accounts. 

• Review permissions and audit logs regularly. 

4. Harden BACnet Routers and Devices 

Routers and controllers are prime targets: 

• Change default credentials immediately. 

• Disable unused services (HTTP, FTP, Telnet). 

• Apply firmware updates as soon as they’re available. 

• Enable device logging and forward alerts to a monitoring system. 

5. Monitor Continuously 

Use diagnostic and analytics tools (like in Cimetrics SbC4000) to: 

• Detect anomalies in BACnet traffic. 

• Identify unauthorized devices. 

• Monitor certificate validity and connection integrity. 

6. Manage Certificates Carefully 

In BACnet/SC environments: 

• Use a site certificate authority (CA) such as Cimetrics SbC4000 to issue and renew credentials. 

• Regularly revoke expired or compromised certificates. 

• Securely back up CA keys and maintain documentation. 

7. Secure Remote Access 

• Use VPNs or secure remote gateways for off-site management. 

• Disable legacy tunneling or unrestricted broadcast forwarding. 

8. Train Integrators and Facility Teams 

Human error is a major risk factor. 

• Provide training on BACnet/SC, encryption, and access control. 

• Conduct regular security reviews and configuration checks. 

9. Keep Systems Patched and Updated 

• Maintain an asset inventory of all connected devices. 

• Apply patches and firmware updates promptly. 

• Replace end-of-life equipment that lacks secure firmware support. 

10. Prepare for Incidents 

Even the best systems face threats. Plan ahead: 

• Create a response plan for network issues and intrusions. 

• Keep secure backups of configurations and firmware. 

• Test recovery and rollback procedures regularly. 

Building a Safer Future 

Cybersecurity isn’t a one-time project—it’s a continuous process. Whether you’re an OEM vendor embedding automation logic, a system integrator deploying new networks or a facility manager overseeing daily operations, Cybersecurity Awareness Month reminds us: security doesn’t happen by chance. With Cimetrics’ approach, the building itself becomes a part of the resilient infrastructure — not just a passive environment. 

This October, let’s commit to smarter buildings and stronger defenses. Because when the physical and digital converge, so must the protection. 

Contact us to learn how we can help you with securing your network.