Risks of an outdated BAS and how to fix them

By Marc Bertolin, Channel Sales Manager, Johnson Controls

Running an outdated building automation system exposes your facility to cybersecurity vulnerabilities, unexpected hardware failures, rising maintenance costs, operational inefficiencies and regulatory non-compliance. You can mitigate these risks through regular component assessments, robust patch management, strategic hardware and software upgrades, layered cybersecurity controls and ongoing vendor engagement.

Increasing reliance on a BAS to control building functions helps you achieve key goals, but the risks of an outdated BAS also become more pronounced.

Your BAS provides insights and enables efficient control of HVAC, lighting, fire and security systems while also driving toward reduced emissions, greater energy efficiency and improved resource management. However, as with any technology, BAS components can become outdated, leading to vulnerabilities, system failures, increased maintenance costs and diminished performance.

Here's a closer look at these risks as well as proactive measures to address them.

Risks of running an outdated building automation system

Security vulnerabilities

Outdated BAS hardware and software can be more susceptible to cyber threats such as malware and ransomware. And software that no longer receives security patches and updates opens your system to unauthorized access. While BAS-related cybersecurity breaches aren't as widely publicized as those in other sectors, they do occur and can threaten your people, assets and data.

System instability

Aging hardware components may fail unexpectedly, leading to downtime and disruptions. Compatibility issues between outdated software and newer hardware or protocols can also cause system instability and malfunctions.

Operational inefficiencies

Outdated hardware and software impede BAS functionality, resulting in suboptimal performance. This can manifest as erratic system behavior, increased energy use and compromised occupant comfort, undermining the very objectives of building automation.

Limited functionality

Outdated BAS software may not support modern features and functionalities, making your BAS less able to adapt to changing building needs, organizational requirements and industry standards. This can hinder energy efficiency initiatives and integration with emerging technologies.

Increased maintenance costs

Maintaining and supporting obsolete hardware and software can require specialized expertise, and replacement parts may be scarce or expensive. Extended downtime for maintenance and repairs can also result in productivity losses, tenant dissatisfaction and financial strain.

Non-compliance

The lifecycle of a BAS can be anywhere from 10 to 30 years. Over that time, most software and hardware components reach end of life/end of support, as do associated operating systems from companies like Microsoft. An out-of-date BAS is unlikely to meet organizational IT policies and may also be out of compliance with industry policies or government regulations.

How to mitigate outdated BAS risks

IT professionals and facility managers can take the following steps to mitigate the risks of outdated BAS components.

1. Regular assessment and inventory

Periodically assess BAS components to identify outdated hardware, software and tools. Maintain a current inventory of all BAS assets, including their age, manufacturer and support status.

2. Implement robust patch management

Make sure you regularly deploy security updates and patches for BAS software and firmware. Most IT departments subscribe to software maintenance to ensure they're using supported revisions for enterprise-level software and networks. Consider software maintenance agreements from your BAS system providers. And make sure you're on vendors' notification lists for security vulnerabilities and updates, to stay on top of fast-changing technology, risks and revision releases.

3. Upgrade or replace obsolete components

Prioritize the upgrade or replacement of outdated BAS hardware and software to mitigate security risks and improve system performance. Evaluate newer solutions that offer enhanced features, compatibility and support for industry standards.

4. Enhance cybersecurity

Implement layered controls such as firewalls, intrusion detection systems and network segmentation. Follow industry best practices for securing BAS networks and endpoints, including regular security audits and employee training. Product-specific measures like encryption using TLS, FIPS140-2 (Federal Information Processing Standard) for validating the effectiveness of cryptographic hardware/software, cyber health dashboards and blocking unused ports help further protect your system.

5. Stay informed and engage with vendors

Stay on top of industry trends, regulatory changes and emerging building automation technologies. Engage with BAS vendors and industry associations to access resources, training and support for maintaining and upgrading BAS components.

FAQs

How often should you audit your building automation system for outdated components?

You should assess BAS components at least annually to identify outdated hardware, software and tools. Maintain a current inventory of all BAS assets including their age, manufacturer and support status. More frequent reviews may be warranted if your system is approaching end-of-life milestones or if your vendor issues security advisories.

What is the typical lifecycle of a building automation system?

The lifecycle of a BAS can be anywhere from 10 to 30 years. Over that time, most software and hardware components reach end of life or end of support, as do associated operating systems from companies like Microsoft. Planning for phased upgrades throughout the lifecycle helps avoid the compounding risks of running unsupported components.

How does an outdated BAS affect building cybersecurity?

Outdated BAS hardware and software can be more susceptible to cyber threats such as malware and ransomware. Software that no longer receives security patches opens your system to unauthorized access. Layered defenses including firewalls, intrusion detection systems, network segmentation and encryption help to mitigate these risks.