Chapter 3 — Networks and protocols in building systems
Lesson map
Lesson 03 published. Map, example, EX011.
flowchart TD
N0["Learning outcomes"]
N1["3.1 Field and supervisory layers"]
N2["3.2 Trust by default"]
N3["3.3 Where the networks meet"]
N4["3.4 What an analyst does"]
N5["3.5 Wireless"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX011"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["3.1 Field and supervisory layers"]
N2["3.2 Trust by default"]
N3["3.3 Where the networks meet"]
N4["3.4 What an analyst does"]
N5["3.5 Wireless"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX011"]
[Learning outcomes]
|
v
[3.1 Field and supervisory layers]
|
v
[3.2 Trust by default]
|
v
[3.3 Where the networks meet]
|
v
[3.4 What an analyst does]
|
v
[3.5 Wireless]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX011]
Learning outcomes
You will (1) describe how BMS controllers communicate; (2) explain why building protocols are often unauthenticated; and (3) identify where building networks touch the hospital network.
3.1 Field and supervisory layers
Sensors and actuators connect to field controllers by wire. Controllers talk to each other and to the BMS server over a building network. Common protocols include BACnet, usually carried over UDP on port 47808 as BACnet/IP, and Modbus/TCP for some plant such as chillers. Many devices also offer a web interface for configuration.
At Millbrook the BMS sits on VLAN 300, and the theatre air-handling controllers report to it over BACnet/IP. The chiller may use Modbus/TCP. Record which protocol each device uses in the inventory, because it decides what a firewall rule must allow and what monitoring can see.
3.2 Trust by default
Like many industrial protocols, classic BACnet and Modbus deployments accept commands from anything that can reach them. A laptop on the same network can usually read every point and often write setpoints. Secure variants exist but are not yet common in installed buildings.
That means the network boundary is the main control. If a corporate PC or a contractor's laptop can reach VLAN 300, it can probably read theatre temperatures and change setpoints without a password. Treat any path into the building network as a path to the equipment, and design rules on that assumption.
3.3 Where the networks meet
The BMS workstation may sit on the hospital's corporate network so estates staff can reach it from offices. Contractors add remote access for support. Lifts may have their own cellular link to the manufacturer. Each meeting point is a place an attacker on the hospital network could step into building control.
At Millbrook the most important meeting point is BMS-WS, which sits on both the building VLAN and the corporate network. Each such point should be listed with its owner and purpose. The later chapters on remote access and segmentation start from this list, so missing a route here means missing it there too.
3.4 What an analyst does
Ask the estates team and contractor for a network drawing; compare it with switch and firewall configuration held by the network team; never scan building controllers to find out. Some old controllers crash under scans.
Record which source supplied each fact, and mark anything seen only on a drawing as unconfirmed until it is checked against switch or firewall data. Where the sources disagree, ask the contractor and the network team together. Some answers will need a visit to a plant room, booked through estates.
3.5 Wireless
Some sensors report over wireless links to gateways. Ask where each gateway connects and who manages its keys.
A wireless gateway can be an unlisted way into the building network, and its keys may never have been changed since installation. Record each gateway in the inventory with its location, the network it connects to, who holds its keys and when they were last changed. Treat a gateway that reaches VLAN 300 as part of the BMS zone. Ask the contractor for this list in writing.
Worked example (synthetic Millbrook)
The contractor's drawing shows the BMS on VLAN 300, with the workstation BMS-WS dual-homed: one network card on VLAN 300, one on the corporate VLAN. Aisha notes that BMS-WS bridges corporate and building networks — anyone who compromises it reaches every controller — and adds it to her risk list.
Synthetic case — Millbrook. VLANs and hosts are invented.
Errors and limits
Protocol names and ports vary by installation; confirm with the integrator. A drawing does not prove what is cabled.
Exercises
- EX011 — Two layers. Describe the field and supervisory layers of a BMS. Rubric: 3 = sensors/actuators wired to controllers; controllers and server on building network; 2 = partial; 1 = one; 0 = none.
- EX012 — BACnet trust. What can a laptop on VLAN 300 typically do with BACnet/IP controllers? Rubric: 3 = read points and often write setpoints without authentication; 2 = read only; 1 = vague; 0 = none.
- EX013 — Dual-homed workstation. Why is BMS-WS's second network card a risk? Rubric: 3 = bridges corporate to building network bypassing firewall; compromise reaches controllers; 2 = partial; 1 = speed; 0 = none.
- EX014 — Meeting points. Name three places where Millbrook building networks may meet other networks. Rubric: 3 = dual-homed workstation, contractor remote access, lift cellular link (or similar); 2 = two; 1 = one; 0 = none.
- EX015 — No scanning. Give two reasons Aisha does not scan building controllers to map them. Rubric: 3 = old controllers can crash; not authorised/risk to clinical areas; better sources exist; 2 = one; 1 = "slow"; 0 = none.
Synthesis
Building controllers trust whoever reaches them, so every point where building and hospital networks meet matters.
Continue studying — chapter 03 of 12
← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →