Tim Bauer
FachsprechpartnerSolution Architect for OT and BAS security
Tim Bauer is an independent consultant and Solution Architect for OT and BAS security. His work focuses on the intersection of IT, OT, building automation, and security.
Building automation without blind spots
secnostic registered trademark connects building automation, building management systems, and technical building services in a dependable OT view. Facilities, IT, and security teams can see assets, communication paths, remote access, vulnerabilities, and ownership without unnecessarily touching live building functions.
For facilities, building services, IT, security, and property portfolios.
See what controls a building and who can reach it
NIST explicitly classifies building automation systems as operational technology. The BSI recommends starting with remote-maintenance access, IT crossings, and the device inventory; its INF.14 implementation guidance adds segmentation, roles, and protected building-automation networks.
What this covers
Building automation is operational technology: NIST SP 800-82 explicitly includes building automation systems in OT and names HVAC, electrical systems, lighting, and access control among the examples. The BSI INF.14 module places information security across the planning, implementation, and operation of building automation.
The BSI security information recommends identifying remote-maintenance access, IT crossings, and the device estate early. For the communication layer, ISO 16484-5 specifies a data communication protocol for HVAC/R and other building systems. Section 71a of the German Building Energy Act sets requirements for specified non-residential buildings. Applicability must be assessed for each building; secnostic supplies context and evidence but replaces neither the BMS nor a conformity assessment.
Management servers, automation stations, gateways, sensors, and actuators connect HVAC, energy, lighting, access, and other building disciplines. In existing buildings, BACnet, KNX, Modbus, M-Bus, proprietary interfaces, remote maintenance, and cloud connections meet divided responsibilities. Without current shared context, dependencies, changes, and risks across buildings, IT, and suppliers remain hidden.
Outcomes
- a current building and portfolio view of BMS, automation, and field components
- traceable communication paths, IT crossings, remote maintenance, and supplier access
- prioritization of vulnerabilities and EOL/EOS by building, discipline, and operational impact
- faster routing of incidents and security findings to the accountable person
- dependable documentation for risk assessment, modernization, and applicable assurance requirements
Four blind spots in building operations
The technical function is visible, but inventory, access paths, and ownership are often split across several disciplines.
Remote access without an owner
A permanent or forgotten supplier path remains risky when purpose, approval, and ownership are missing.
Plans without operating reality
Retrofits, gateway replacements, and supplier changes cause documentation and the actual estate to diverge.
Legacy technology on a flat network
Long-lived components and older communication need tightly controlled crossings when modern safeguards are unavailable.
A finding without building impact
A vulnerability becomes actionable only when its building, discipline, dependency, maintenance window, and owner are known.
In practice, four building situations
Each situation starts with an observable signal or an existing source and ends with an accountable person.
- NoticeAn observation or import shows a previously unknown device or a new connection.
- Place itThe asset is mapped to its building, room, discipline, zone, and communication partners.
- AssessVersion, exposure, dependency, and intended function are reviewed together.
- AssignFacilities, IT, or the accountable integrator takes ownership of the clarification.
- ApprovePurpose, time window, supplier, and accountable person are set before access starts.
- ReconcileThe permitted path is compared with known gateways, accounts, and communication relationships.
- ObserveNew IP devices or connections during the window become visible without actively querying field devices.
- CloseActivity, changes, and the end of access remain traceably documented.
- Find matchesVendor, model, software, or firmware state is reconciled with the estate.
- Clarify impactBuilding, discipline, dependent function, and maintenance window provide operating context.
- DecidePatching, replacement, segmentation, or compensation is agreed with the operator.
- TrackDecision, exception, owner, and review date remain documented on the asset.
- IngestA suitable event from BMS, monitoring, network, or security tooling is received.
- Add contextAffected building, discipline, asset, dependencies, and owner are added.
- RoutefocusAlert hands the event to the right group, shift, or on-call rotation.
- RecordAcknowledgment, escalation, and handling history remain traceable.
From network signal to building context
The secnostic registered trademark sensor observes approved IP segments passively. BMS exports, network data, and maintenance records add dormant or serial components; active queries run only after technical approval.
secnostic registered trademark inventory connects devices to buildings, disciplines, communication paths, lifecycle, and owners. The secnostic registered trademark platform governs tenants, roles, and access to secnostic registered trademark applications. focusAlert routes suitable operational and security events, but does not replace certified fire, evacuation, or safety alerting.
Which product modules are involved
The modules play different roles in the deployment: observation, inventory, platform governance, and handover to the right people.
secnostic inventory
models buildings, disciplines, BMS servers, controllers, gateways, field components, lifecycle, owners, dependencies, and evidence.
secnostic sensor
observes approved BMS and building IP networks passively and reports new devices or communication changes; controlled enrichment runs only after approval.
secnostic platform
governs organizations, tenants, roles, and access to secnostic registered trademark applications, not direct access to field devices.
focusAlert
routes suitable BMS, monitoring, or security events to accountable people and keeps acknowledgment and escalation traceable.
FAQ
Key questions before a first scoping conversation.
Does secnostic replace the BMS or building control system?
No. The BMS remains responsible for control, regulation, and visualization. secnostic registered trademark adds technical asset, communication, risk, and ownership context.
Can the environment be discovered without interrupting operations?
The starting point is passive-first. Dormant, serial, or unobserved components may require additional exports, documentation, or approved queries. Active discovery is therefore never assumed by default.
Which systems belong in scope?
The scope can include management and engineering systems, automation stations, controllers, gateways, network components, sensors, actuators, meters, and remote-maintenance paths. Safety systems are included only where real interfaces exist.
Does secnostic make BACnet or KNX secure automatically?
No. Visibility and context show where segmentation, access controls, secure protocol variants, or replacement are needed. Technical protection must be implemented in the relevant building automation system.
Does the solution automatically meet GEG, IEC 62443, NIS2, or BSI requirements?
No. secnostic registered trademark can support evidence for assets, communication, measures, and ownership. Applicability and conformity must be assessed for the specific organization and system.
Start building automation with a dependable scope
We start with one building, campus, discipline, or remote-maintenance scope and show which operating and risk data is already usable.
Discuss the BACS scope