Latest / NOXTalks / Your BAS Runs on Networking

Transcript

Your BAS Runs on Networking · NOXTalks

• 0:07
  SPEAKER_00: Welcome to Knox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
• 0:14
  SPEAKER_00: Today we're diving into why your BAS runs on networking now.
• 0:18
  SPEAKER_00: Whether the org chart admits it or not, Smart Buildings Academy has been pretty direct lately, with a recent run of episodes on IP addressing, MS slash TP wiring, BAC Net SC, IP networking, and power monitoring.
• 0:33
  SPEAKER_00: That sequence is a signal.
• 0:35
  SPEAKER_00: When graphics stop updating, alarms hang, or controllers vanish, the root cause is often not bad controls, it's the network underneath them.
• 0:44
  SPEAKER_00: And this gets missed because cyber grabs the headlines, while the boring stuff gets ignored.
• 0:49
  SPEAKER_00: IP plans, VLANs, time sync, certificate ownership, remote paths, and who actually owns the switch port.
• 0:58
  SPEAKER_00: NIST made this much more explicit in SP 800-82R3 when it expanded the scope from traditional industrial control systems to operational technology, and it specifically lists building automation systems and physical access control systems as OT.
• 1:16
  SPEAKER_00: That matters because BAS is no longer just a convenience layer, it's part of core operations.
• 1:22
  SPEAKER_00: Here's a fun one.
• 1:24
  SPEAKER_00: BACNET SC is not just BACNET but safer.
• 1:27
  SPEAKER_00: BACNET International says it uses WebSockets and TLS for peer authentication, encryption, and reliable connection-oriented communication, and it can run on IPv4 or IPv6.
• 1:40
  SPEAKER_00: It also says the need to use standardized IP network infrastructure for building tech is increasing.
• 1:46
  SPEAKER_00: In other words, BAS traffic is starting to behave a lot more like managed certificate-backed network traffic, and that's not theoretical.
• 1:55
  SPEAKER_00: BACNET International now has a cybersecurity acceleration program and a certificate authority reference tool because certificate handling has become a real integration task.
• 2:05
  SPEAKER_00: Another fun fact: NIST treats time discipline like an operations and security issue, not a housekeeping detail.
• 2:14
  SPEAKER_00: It says OT environments should use a common time across devices, that multiple time sources can reduce clock error and provide backup, and that non-authenticated NTP is susceptible to spoofing and should sit behind the firewall.
• 2:28
  SPEAKER_00: NIST also says time synchronization makes root cause analysis more efficient because logs line up across systems.
• 2:36
  SPEAKER_00: So, yeah, NTP belongs on the same maintenance calendar as belts, filters, and battery checks.
• 2:43
  SPEAKER_00: If the clocks drift, your troubleshooting drifts right along with them.
• 2:47
  SPEAKER_00: Then there's segmentation.
• 2:49
  SPEAKER_00: NIST says OT networks can be separated physically or logically with VLANs, and that properly configured segmentation helps enforce policy and isolate traffic.
• 3:00
  SPEAKER_00: CISA adds two very practical warnings.
• 3:03
  SPEAKER_00: Map communication pathways between zones, including data flows and protocols, and don't assume segmentation stays intact just because it looked good at turnover.
• 3:14
  SPEAKER_00: CISA says accidental breaks in segmentation are common, its OT goals call for continuous IT and OT collaboration, and it recommends encryption where feasible for OT communications that reach remote or external assets.
• 3:29
  SPEAKER_00: NIST also says the ability to disconnect or disable remote access becomes critical as more OT systems become remotely accessible.
• 3:38
  SPEAKER_00: So, put it on a VLAN is not a finished plan.
• 3:42
  SPEAKER_00: It's just the opening move.
• 3:43
  SPEAKER_00: So the takeaway is pretty simple.
• 3:45
  SPEAKER_00: Keep one authoritative BAS network map with IP ranges, ports, certificates, NTP sources, and named owners.
• 3:54
  SPEAKER_00: Put certificate renewal dates on the same calendar as preventive maintenance.
• 3:59
  SPEAKER_00: Review every remote connection path quarterly with facilities and IT together.
• 4:04
  SPEAKER_00: And when something goes offline before you swap hardware, ask what changed in the address plan, the VLAN, the time source, the certificate, or the remote path.
• 4:16
  SPEAKER_00: Because in modern buildings, networking is not extra BAS knowledge anymore.
• 4:20
  SPEAKER_00: It is core operating knowledge.