Category
Protocols
BACnet, Modbus, OPC UA, MQTT...
The IT Department's BMS Audit Checklist
A BMS that is ready for go-live answers six IT-audit questions cleanly: no inbound ports, encrypted transit, segmented OT/IT networks, device certificates, monitorable payloads, and no BACnet exposed to the internet. Pre
Is BACnet/IP Safe to Expose to the Internet?
BACnet/IP has little native security, so exposing it directly to the internet makes controllers easily discoverable and abusable. The safe approach is to keep BACnet/IP on an isolated subnet and reach it only through a s
What Are X.509 Certificates in Building Systems?
X.509 certificates give each gateway a cryptographic identity that the broker verifies before allowing a connection, so a fake device cannot impersonate a real gateway. They are the authentication pillar of a secured BMS
What Is TLS Encryption in a BMS?
TLS 1.2/1.3 encrypts all BMS data in transit, so anyone intercepting packets on the network sees only scrambled bytes, and message authentication ensures tampered packets are rejected. It is the privacy-and-integrity pil
Why Outbound-Only (Port 8883) Beats Open Firewall Holes
An outbound-only design has the gateway dial out over TCP 8883 (MQTT over TLS), so no inbound firewall ports need opening and there is no VPN or port-forwarding to maintain. IT approves it easily because it adds no attac
What Is OT/IT Network Segmentation?
Network segmentation isolates the OT or BACnet subnet from the IT and office network, with a dual-homed gateway as the only controlled crossing point. It stops an infected office device from reaching every building contr
MQTT-over-TLS vs BACnet/SC — The Courier Analogy
BACnet/SC secures each device with its own certificate, meaning 200 controllers need 200 certificates to manage. MQTT over TLS uses one trusted gateway certificate to secure all of them over a single outbound port, with
What Is Defense-in-Depth in a BMS?
Defense-in-depth splits a BMS into zones — field, edge gateway and cloud — so a breach at one layer does not compromise the whole building. Each layer contains the next, using outbound-only connections and a single guard
OT vs IT Security — Why Buildings Are Different
OT security prioritises uptime and determinism while IT security prioritises confidentiality and patching, and buildings sit where the two cultures collide. Securing a BMS means bridging both without letting either break
Why Does a BMS Need Cybersecurity?
Modern building management systems are IP-connected and often internet-adjacent, which turns a building network into an attack surface and a possible route into the corporate network. Cybersecurity, built as defense-in-d
What Is OPC UA Pub/Sub?
OPC UA Pub/Sub decouples data producers from consumers over brokered (MQTT) or broker-less (UDP) transport, so one source can feed many consumers with low latency at scale. It complements the client-server model for many
OPC UA in SCADA & Industry 4.0
OPC UA serves as the interoperability backbone of Industry 4.0, connecting sensors, SCADA, MES and cloud with a single secure, modelled standard. It provides the semantic, edge-to-cloud data flow that smart factories and
OPC UA vs OPC Classic (DA)
OPC Classic (DA) relied on Windows COM/DCOM, making it fragile, platform-locked and firewall-hostile; OPC UA replaced it with a platform-independent, secure, firewall-friendly transport. UA is the migration path off DCOM
What Is an OPC UA Gateway in a BMS?
An OPC UA gateway maps field protocols like BACnet and Modbus into OPC UA objects, bridging OT field data up to IT and enterprise systems. It models tags as self-describing objects and secures the crossing between networ
How Secure Is OPC UA? Built-In Security
OPC UA builds security into the stack: X.509 certificates for authentication, plus signing and encryption modes at the session layer. Security is part of the protocol rather than an add-on, which is why auditors accept i
What Is the OPC UA Information Model?
The OPC UA information model uses nodes, references and types to make data self-describing and navigable, so a value carries its name, type, unit and relationships. It is what makes OPC UA suitable for digital twins and
What Is the OPC UA Client-Server Model?
In the OPC UA client-server model, servers expose data and clients connect to browse, read, write and subscribe to it. Understanding who serves and who subscribes is essential to configuring sessions, subscriptions and s
OPC UA vs Modbus
Modbus is register-level and simple, carrying raw numbers that need manual mapping; OPC UA carries self-describing, typed objects where meaning travels with the data. Modbus wins on simplicity, OPC UA on rich, secure str
OPC UA vs BACnet — Which for Building Automation?
BACnet is building-native and simple; OPC UA is industrial-grade, modelled and secure. Choose BACnet for straightforward building services and OPC UA where the building converges with industrial systems or demands richer
What Is OPC UA?
OPC UA is a vendor-neutral, secure, service-oriented protocol with a rich information model, designed to move data between industrial and building systems on any platform. It brings modelled, self-describing, secure data
Don't see your question on Protocols?
✦ Ask the AI BMS Mentor →