Why BACnet Needed a Security Overhaul
BACnet/IP, the dominant transport for building automation since the 1990s, was designed for isolated facility networks where security was an afterthought. It relies on UDP broadcasts and multicasts, has no built-in encryption, and authenticates devices only by IP address — a trivial spoofing target. As buildings connect to enterprise IT networks and cloud services, the attack surface has expanded dramatically. Vulnerabilities disclosed by researchers (including unauthenticated write access to BACnet devices on internet-exposed port 47808) have pushed the industry toward a proper security architecture.