Latest / NOXTalks / BACnet Secure Connect Explained: The BACnet/SC Migration Guide

Transcript

BACnet Secure Connect Explained: The BACnet/SC Migration Guide · NOXTalks

• 0:07
  SPEAKER_00: Welcome to Knox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
• 0:14
  SPEAKER_00: Today we're diving into a change that's already written into the standards and still missing from most operators' budgets.
• 0:20
  SPEAKER_00: BACnet Secure Connect, the secure way to run BACNET over IP networks.
• 0:26
  SPEAKER_00: Remember when the web moved from HTTP to HTTPS?
• 0:30
  SPEAKER_00: Same websites, same content, but suddenly everything was encrypted and a little padlock appeared in your browser.
• 0:36
  SPEAKER_00: Your building's control network is starting to go through a very similar shift.
• 0:40
  SPEAKER_00: And honestly, it's overdue.
• 0:43
  SPEAKER_00: BACNET was first published as a standard in 1995, built for a friendlier world.
• 0:48
  SPEAKER_00: Classic BACNET RIP uses unencrypted UDP traffic, including broadcast messages for things like discovery, and it doesn't provide modern peer authentication at the protocol level.
• 1:00
  SPEAKER_00: So if an unauthorized device gains the right network access, it may be able to discover controllers, inspect traffic available to it, and send commands to writable points.
• 1:11
  SPEAKER_00: That's a very different security model from what modern IT networks expect, especially with control systems sitting on shared infrastructure, remote vendor access, and cloud connections.
• 1:22
  SPEAKER_00: Enter BACNET Secure Connect or BACNET SC.
• 1:26
  SPEAKER_00: It entered the standard through addendum BJ to the 2016 edition, approved in 2019, and was incorporated into the 2020 edition of Ashri Standard 135.
• 1:37
  SPEAKER_00: Here's the clever part.
• 1:39
  SPEAKER_00: You don't have to redesign your BACNET objects, points, or control logic.
• 1:44
  SPEAKER_00: What changes underneath is the communications layer.
• 1:47
  SPEAKER_00: BACNET SC uses secure WebSockets and TLS with mutual certificate authentication.
• 1:54
  SPEAKER_00: The connection is encrypted, its peers are authenticated, and the messages traveling over it are protected against interception and tampering.
• 2:02
  SPEAKER_00: It's built on the same TLS and certificate technologies that protect secure web services and banking.
• 2:08
  SPEAKER_00: A rogue laptop without a trusted certificate simply can't establish a trusted BACnet SC connection.
• 2:15
  SPEAKER_00: Practical benefits, too.
• 2:17
  SPEAKER_00: Backnet SC fits much more naturally into managed IT networks.
• 2:22
  SPEAKER_00: Secure WebSockets can use familiar firewall policies, commonly including TCP port 443, rather than the broadcast-heavy UDP architecture of traditional BACnet IP.
• 2:34
  SPEAKER_00: And the secure portion doesn't need BBMDs, those broadcast management devices behind so many late-night troubleshooting sessions, though any legacy BACnet IP segments you keep may still need theirs.
• 2:47
  SPEAKER_00: Why plan now?
• 2:48
  SPEAKER_00: Three reasons.
• 2:50
  SPEAKER_00: First, the testing framework has matured.
• 2:52
  SPEAKER_00: Formal BACNET SCC conformance tests were added to Ashray 135.1 through an addendum approved in 2023, now folded into the 2025 edition.
• 3:03
  SPEAKER_00: Specifiers can point to an established testing framework, not just a manufacturer's claim.
• 3:08
  SPEAKER_00: Second, specs are catching up.
• 3:10
  SPEAKER_00: The United States Department of Defense's cybersecurity specification for facility control systems now includes optional language requiring BACNET devices to support Secure Connect, with the sensible instruction to first confirm that it's a project requirement and that multiple vendors can deliver it.
• 3:28
  SPEAKER_00: And its authentication, encryption, and integrity protections align well with security objectives in IEC 62443, though BACNET SC by itself doesn't make a building compliant with that framework.
• 3:43
  SPEAKER_00: Third, procurement has a long tail.
• 3:46
  SPEAKER_00: Controllers you buy today will still be on the wall in 15 years.
• 3:50
  SPEAKER_00: Every BACnet IP-only device you install now is something you may eventually have to isolate, route through a secure gateway, or replace when cybersecurity requirements tighten.
• 4:01
  SPEAKER_00: The good news?
• 4:02
  SPEAKER_00: This isn't rip and replace.
• 4:04
  SPEAKER_00: BACNET SC complements existing BACnet rather than replacing it.
• 4:09
  SPEAKER_00: A rotor can sit between a new secure backbone and your legacy MSTP or BACnet IP segments, so you migrate in phases, head end and supervisory layer first, field devices as they turn over.
• 4:23
  SPEAKER_00: Just remember the legacy side of that router stays legacy and unencrypted.
• 4:28
  SPEAKER_00: Three moves worth making this quarter.
• 4:31
  SPEAKER_00: One, ask your integrator for an inventory.
• 4:34
  SPEAKER_00: Which devices already support BACnet SC through firmware, which need hardware replacement and which never will.
• 4:41
  SPEAKER_00: That list becomes your roadmap.
• 4:43
  SPEAKER_00: Two, write secure connect capability into new specs and modernization scopes.
• 4:49
  SPEAKER_00: It's much cheaper to make it part of today's procurement decision than to discover five years from now that your new controllers can't support it.
• 4:57
  SPEAKER_00: 3.
• 4:58
  SPEAKER_00: Talk to your IT team early because certificates expire and need renewing, and certificate lifecycle management is already familiar territory for most IT teams.
• 5:09
  SPEAKER_00: One last thought.