IoT & Smart Device Security
Smart Building & BMS Security
The French fridge attacks were a building-automation failure: Modbus-speaking controllers, managed over the internet, running EOL firmware. HVAC, lighting, access control, and refrigeration across offices, retail, and facilities share the same DNA, decades-old protocols (Modbus, BACnet) designed before networks were hostile, now reachable from anywhere.
Key points
- Inventory every BMS controller, protocol, firmware version, and network path.
- Remove all BMS admin interfaces from the public internet, no exceptions.
- Segment OT networks from IT with firewalled conduits and monitored crossings.
- Patch where vendors support it; plan replacement where they don't.
- Change default credentials on every controller, gateway, and HMI panel.
- Monitor for abnormal commands (setpoint swings, forced cycles) as security events.
- Clarify ownership: BMS is often managed by contractors, not IT, assign responsibility in writing.
- Exercise physical-impact scenarios: what happens if HVAC, access, or refrigeration is hostile-controlled?
Field note
Get the BMS ownership answer in writing: IT, facilities, or contractor. Every unowned controller defaults to unpatched, and 'we thought they handled it' is the industry's most expensive sentence.
Frequently asked questions
What are Modbus and BACnet?
Building-automation protocols from the 1980s–90s with no built-in authentication or encryption, secure only behind isolation.
Who manages our BMS?
Often a facilities contractor or the equipment vendor, which is why these systems miss IT patch cycles entirely.
Did the fridge attack involve BMS protocols?
Yes, the Danfoss controllers speak Modbus, and their internet-facing admin panels were the entry path.
What's the US exposure?
Facilities analyses warn the same legacy-protocol exposure exists widely in American buildings using BACnet.
How Kinetikatech helps with iot & smart device security
You shouldn't have to become an expert in iot & smart device security: Fridges, cameras, controllers, and building systems were never designed for the hostile internet, we secure them anyway. That's exactly what 24/7 Server Monitoring and Server Management is for, setup, hardening, monitoring, and a human on call day and night.