Episode 33: Why Building Security is Now a Cyber Priority

Christina

When you think about corporate cybersecurity, you probably think about, you know, firewalls, maybe encrypted emails, someone frantically patching a server.

Adam

The usual suspects.

Christina

Exactly. We pour so many resources into protecting that traditional digital perimeter laptops, the cloud, employee phones. But let me ask you. When was the last time you thought about the cyber health of the office building itself? I mean the actual physical structure.

Adam

The thermostat on the wall, the elevator controller.

Christina

The badge reader that lets you in the garage. Yeah. If that sounds like a strange thing to worry about, get ready for a pretty big mindset shift.

Adam

It's a huge one.

Christina

Our deep dive today is based on some fascinating material showing that this overlooked layer, what we call operational technology or OT, isn't just a new attack vector. It has become the primary entry point for cyber breaches.

Adam

The main way in.

Christina

Okay, so let's unpack that. We're diving into the world of building management systems or BMS and all those millions of connected IoT devices in a modern smart building.

Adam

The smart lighting, the cameras, all of it.

Christina

And we're going to figure out why these systems are such high-risk targets, why our normal security tools are totally blind to them, and what needs to be done. The mission today is to understand why securing the building is now, well, a non-negotiable cyber priority.

Adam

And if we connect this to the bigger picture, the whole vulnerability really stems from this uh historical design choice. Oh so building tech HVAC, fire panels, access controls. It was all engineered decades ago for one thing and one thing only uptime. Reliability and uptime. They were never ever designed to be on a hostile internet connected network.

Christina

, so what this means for you, the person listening, is that a compromise of that building management system isn't just, you know, a data leak.

Adam

No, it's a direct threat to safety, to physical operations. You could be looking at power outages, a data center overheating, or just a complete loss of control over your own facility.

Christina

And this isn't theoretical anymore.

Adam

Not at all. The evidence shows this is actively where attackers are starting.

Christina

Historically, these systems flew under the radar. We thought they were safe, right? Maybe they were air gapped or just not seen as valuable.

Adam

Yeah, who's gonna hack a thermostat?

Christina

But the game has totally changed. Our research is, well, it's unambiguous. The majority of corporate breaches now start with a foothold in that OT or IoT layer.

Adam

And what's really fascinating is the reason why is so simple from an attacker's point of view. It's all about access.

Christina

Access, how?

Adam

These devices, these OT and IoT gadgets, they can't run traditional security software. No endpoint detection and response, no EDR agents.

Christina

Ah, so they're invisible.

Adam

They're inherently invisible to the very tools companies pay millions for to defend their laptops and servers.

Christina

So because they can't be monitored, they become this pristine, clean path for an attacker to move laterally.

Adam

It's the digital equivalent of an unlocked side door, exactly. If an attacker gets into a CCTV server, which is almost never monitored, they can just jump straight from that building network over to the main IT network. That jump is everything. And often that CCTV camera, or say a lighting controller, is sitting on the same network segment, the same VLAN, as something critical.

Christina

Like a payroll server.

Adam

A payroll server, an active directory domain controller. For an attacker, it's like walking into a bank's vault by first hacking the vending machine in the lobby. Once you're inside the building's network, you're in the same digital room as the Crown Jewels.

Christina

That is a powerful analogy. The material we looked at breaks down the specific weaknesses into four core categories, and they really show why this problem is just so widespread. So let's start with the first one, which is uh maybe the most shocking. Exposure without realization. I'm talking about systems just sitting on the public internet, wide open.

Adam

This is the low-hanging fruit. It's staggering how many of these systems, BMS controllers, DVRs for cameras, badge readers, are just exposed. And they're often still running default credentials.

Christina

You mean like admin and password?

Adam

Or 1234. We're not talking about complex passwords here.

Christina

And the scale of this is just massive. The researchers use tools like Shodan, which is like a search engine for devices, and found hundreds of thousands of these building systems.

Adam

Worldwide. Just accessible. You don't have to get past a proxy or anything. You just log in.

Christina

So an attacker doesn't need a zero-day exploit. They don't need to send a phishing email.

Adam

No, they just run a scan, find a login prompt, and try admin and admin. It's an instant foothold with almost zero effort. Okay.

Christina

So weakness number two builds right on that. Outdated and unpatchable software.

Adam

Right. So once the attacker is in, they find firmware that, in some cases, hasn't seen an update in years, sometimes decades.

Christina

Unlike our phones, which get updates constantly.

Adam

Exactly. These building systems, they get installed and they might just run for 10, 15, even 20 years without being touched. And vendors, they often stop supporting these devices long before they're actually taken out of service.

Christina

So you have a critical device, maybe it's controlling the temperature in a server room, but it's running software from 2005 that can never be updated.

Adam

Which creates a permanent security problem. Any known vulnerability for that old firmware, we call them CVEs, is just permanently exploitable. And if there are hard-coded credentials the vendor put in, you can't even remove them.

Christina

Wow. Okay, that leads right to the third weakness: the IT/OT bridge for attackers. This is where the vulnerability turns into a disaster.

Adam

This is the pivot. The OT device is just the doorway. The attacker uses that foothold to then scan and map the real target, the corporate IT network.

Christina

So they get into a smart light controller.

Adam

Or a CCTV camera, and then they use that device's trusted connection to look for more valuable targets. We've seen examples where attackers got in through a smart printer or I'm not kidding, a smart kettle.

Christina

A smart kettle. That's whole that is terrifyingly real. It really drives home the point that every single connected device is a potential threat. You're not just securing servers anymore.

Adam

You're securing everything that's plugged into the wall.

Christina

And the fourth weakness explains why they go to all this trouble. High value environments.

Adam

Precisely. These aren't small-time targets. We're talking about the infrastructure for hospitals, major airports, critical government facilities, universities, global supply chains. Interrupting these places doesn't just cost money. It can threaten patient safety. It can halt a manufacturing line. The impact is immediate and is physical. That's exactly what a high-stakes attacker wants.

Christina

So to really hammer this point home, let's focus on the heart of it all. The building management system, the BMS, that's the real brain of the building, isn't it?

Adam

It is. It controls everything from the fire alarms to the fresh air supply. And if a BMS is compromised, the consequences are severe and they are frighteningly physical.

Christina

An attacker could basically operate the building against its owners?

Adam

They can. They can manipulate air handlers to overheat a data center. They can disable physical security alarms. They could unlock doors across an entire campus.

Christina

Or shut down critical cooling systems.

Adam

Causing massive immediate disruption. And they could hide their tracks too. They could make it look like a simple building fault or an equipment malfunction. So it just looks like an operational problem, not a sophisticated cyber attack.

Christina

And here's the kicker, right? Because these BMS networks are often sitting right next to the IT networks.

Adam

Where they're loosely connected. A compromise in one very quickly becomes a compromise in the other. The two worlds are totally intertwined now.

Christina

It sounds like facility managers and CISOs are finally having to agree on something. Physical risk and cyber risk are the same problem.

Adam

They are one and the same.

Christina

Okay, so if the risks are this high and the vulnerabilities are so exposed, why haven't our traditional IT security tools fixed this? If you have sophisticated EDR on every laptop, why is the thermostat still wide open?

Adam

That brings us to the three fundamental failures of trying to use IT security products in an OT world. They were just designed to solve a completely different problem.

Christina

Okay, what's failure number one?

Adam

It's the one we touched on earlier. Inability to install endpoint agents. IT security is almost entirely built on having a piece of software, an agent on the device itself.

Christina

But you can't install an agent on a CCTV camera.

Adam

Or a smart sensor or a fire panel or an HVAC controller. They just don't have the right operating system or the memory or the power. They can't support it.

Christina

So if your entire security strategy relies on those agents, you're walking into a building where maybe 70 or 80% of the connected devices are completely invisible.

Adam

It's like having a security guard who only watches the main front door while every window, service entrance, and fire exit is just wide open.

Christina

That's a perfect analogy. Okay, what's the second hurdle?

Adam

The second one is inconsistent or non-existent logs. Even if we could see the devices, a lot of these older OT systems, they produce little to no useful log data. And when they do, it's in some weird proprietary format. Your SIEM, the tool that's supposed to collect and analyze all your security logs, it can't understand the data coming off a 15-year-old access panel. So even if a device is acting suspiciously, the evidence is just lifted in translation. Another huge blind spot.

Christina

And the third failure sounds like the most important one. It's about the attack itself. Attackers skip malware.

Adam

Exactly. The attacker is exploiting these buildings, they rarely need to drop a malicious file that an antivirus would flag. They don't need it.

Christina

They just use the inherent flaws.

Adam

The default credentials, the old vulnerabilities we talked about, abusing normal network protocols to move around. All of these activities happen in the network, between devices, not necessarily on the endpoint itself.

Christina

And traditional security is looking for bad files on the endpoint.

Adam

So it misses the entire attack chain that's happening right there on the network fabric.

Christina

So what does this all mean for, say, a property manager or the CISO or an MSP serving them? It means the belief that your building is secure because your laptops are secure is a dangerous fantasy.

Adam

Your security tools are literally looking in the wrong place, leaving the physical backbone of your business completely exposed.

Christina

Which means you have to totally change your strategy. Our sources propose moving from that endpoint-centric model to what they call full spectrum security, protecting IT, OT, and IoT altogether.

Adam

And since you can't install agents, the solution has to be agentless. It has to be network-centric. This means using passive and active analysis to get full visibility of the network. You need to classify every single device, what it is, what it does, what firmware it's running all, without touching the device itself.

Christina

That's the key, isn't it? Passive monitoring. You're just listening to the traffic between systems, what we call east-west traffic.

Adam

That's right. Not just what's coming in and out of the building, but how the systems are talking to each other.

Christina

And you're looking for weird behavior.

Adam

Correct. We're looking for behavioral anomalies. If a camera suddenly starts talking to an IP address in a country it never has before, that's a red flag. If an HVAC controller starts running unusual network commands, that's an anomaly.

Christina

So the platform is looking for signs that an attacker is inside and trying to move around.

Adam

Operating between devices, which bypasses the whole malware problem. You're not looking for bad files, you're looking for bad behavior.

Christina

Like spotting when a building system tries to pivot over to the IT side, that crucial lateral movement.

Adam

And this has to be continuous. It requires 24/7 monitoring of these systems and a rapid response, ideally from a security operations center, a SOC, that actually understands OT environments.

Christina

And for any MSPs listening, this whole approach, it has to be built to scale, right?

Adam

If you're managing a portfolio of 50 office buildings or a huge university campus, you need a multi-tenant architecture that lets you see and manage security across that whole dispersed estate from one central place.

Christina

So to sort of synthesize all this, the explosion in these OT and IOT breaches, it's logical.

Adam

It makes perfect sense. Attackers are targeting buildings because the devices are old and unpatchable, the security is weaker, the networks are flatter, and crucially, hitting the physical infrastructure has an immediate catastrophic business impact.

Christina

The lesson here feels paramount. The MSPs, the facility managers, the CISOs who recognize this shift now, they're the ones who are going to stand out.

Adam

Absolutely. The client assumes their physical building is protected. The industry has to prove that security extends beyond the laptop screen.

Christina

All the way to the thermostat, the door controller, and the fire panel.

Adam

Which leaves us with an important question for you to mull over. If the digital perimeter of a company now demonstrably includes its physical infrastructure, the environmental controls, the power systems, the elevators, how fundamentally does the regulatory and insurance definition of critical infrastructure need to change to catch up with this new reality?