iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Segment a building automation system (BAS) as an operational-technology (OT) environment, not as a collection of ordinary office devices. Start by inventorying every controller, server, workstation, gateway and remote-access path; map the communications that are actually required; then place the controls environment behind a deliberately managed boundary from corporate IT. Use a DMZ or equivalent controlled exchange point for necessary data, create smaller OT zones where consequence and function justify them, and enforce and monitor the allowed conduits. A VLAN or firewall may be part of that design, but neither is a complete answer by itself.
The CISA and partner guidance used here is written for OT and industrial-control environments broadly. It does not prescribe one building-specific topology or a mandatory Purdue-level model. Apply the principles with facilities personnel, controls engineers and vendors, because a deny rule or scan that is harmless on an office network can interrupt heating, cooling, access control or life-safety operations.
What does it mean to segment a building automation system?
Segmentation is the deliberate division of networks and systems into security and operational zones, with explicit rules for the traffic that may cross between them. For a BAS, the main division is between corporate IT services and the networks that monitor or control physical equipment. Segmentation also exists inside the OT environment: management servers, operator stations, controllers and subsystem networks may have different exposure, criticality and recovery requirements.
A defensible design answers four questions for every connection:
#1 Best Overall
- User-friendly NAT functionality simplifies network integration
- Hands-free network access control through automatic whitelisting of locally connected devices
- Integrated security features to ensure device and network safety
- Ultra-compact size and robust industrial design suitable for cabinet installation
- Supports secure boot for checking system integrity
- Which asset initiates the connection, and which asset receives it?
- What protocol, port, service and direction are needed?
- What operational purpose and timing does the exchange have?
- What happens to the building if the connection is denied or unavailable?
The objective is not to make the BAS unreachable. It is to make necessary exchanges narrow, visible and change-controlled while preventing an office compromise from becoming an easy path to controllers.
Why should I inventory BAS assets before changing network rules?
Inventory is the foundation of the architecture. CISA and partner agencies describe knowing what you own, where it is, who operates it and what it connects to as a prerequisite for a defensible OT design. An unknown gateway, engineering laptop or vendor modem can defeat an otherwise well-drawn boundary.
Record more than device names
For each item, record its owner, physical location, function, manufacturer and model where known, software or firmware version, support status, network address, dependencies and criticality. Include assets that are often omitted from an IT scan:
- BAS application servers, historians, databases and licensing servers
- Supervisory workstations, operator consoles and engineering stations
- Programmable controllers, field controllers, remote I/O and supervisory gateways
- Switches, routers, serial-to-IP converters, wireless bridges and building-system firewalls
- Interfaces for HVAC, lighting, elevators, generators, energy meters, security or access systems
- Cloud connectors, mobile applications, cellular links and vendor remote-access appliances
- Dual-homed computers, removable-media workflows and maintenance laptops
Classify which assets can change a physical process, which only display data and which provide supporting services. Note safety, environmental, occupancy, regulatory or business consequences if each function is lost or manipulated. If a device cannot be identified, mark the uncertainty and assign an owner to resolve it rather than silently treating it as harmless.
Use the inventory to set priorities
Criticality is not just an IT uptime ranking. A controller serving a laboratory, data room or smoke-control system may deserve a different zone and recovery path from a noncritical comfort system. The inventory should therefore support decisions about isolation, permitted administration, monitoring depth and manual fallback.
How do I map BAS communications and dependencies?
After discovery, create a communication map that shows normal and exceptional flows. CISA monitoring guidance emphasizes identifying communicating devices, protocols and services and establishing a baseline of expected activity. Validate every entry with controls engineers, facilities operators and the supplier responsible for the integration; documentation alone is often stale.
Build a flow register
A useful register has one row per required flow and includes:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- Great Variety of Sizes: 32 Pcs of the most commonly used 15 sizes assorted rubber grommet assortment kit.With retractable box cutter and velcro straps
- High Quality: Rubber washers are made of flexible and durable rubber material, they are of good electric resistance capability.
- Easy To Use: Wire grommets are quicker and easier to install since they can be placed on one side only.
- Wide Range of Applications: Very useful for auto and other projects where wiring cable needs to be run through metal or plastic openings.
- Packaging Includes:2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs)(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),2-3/8''Drill Hole(2 Pcs),2''Drill Hole(2 Pcs),1-9/16''Drill Hole(2 Pcs),1-3/8''Drill Hole(2 Pcs),1-3/16''Drill Hole(2 Pcs),1''Drill Hole(2 Pcs),7/8''Drill Hole(2 Pcs),13/16''Drill Hole(2 Pcs).With retractable box cutter and velcro straps
- Source and destination asset, zone and physical site
- Direction, protocol, port or service, and whether the exchange is persistent, periodic or on demand
- Business or operational purpose, such as trend export, alarm notification, time synchronization or identity lookup
- Data sensitivity and whether the flow can issue commands or only read values
- Availability requirement, outage behavior and an accountable owner
- Vendor, cloud or enterprise dependency, including how the path is authenticated
Capture flows that occur only during commissioning, firmware updates, alarm escalation or emergency support. Record vendor remote access separately from routine telemetry. A rule that is “temporary” but never removed is an unreviewed conduit.
Observe before you restrict
Use passive discovery, switch telemetry, firewall logs and controller documentation where available. Avoid broad active scanning until the controls team confirms that a device can tolerate it; older controllers and fragile protocols may react badly to aggressive probes. Compare observed traffic with the documented register, investigate unexplained destinations and decide whether each discrepancy is a legitimate exception, an obsolete rule or an unauthorized bridge.
How should I separate the corporate network from the BAS?
Place a meaningful security boundary between corporate IT and building OT. CISA and partner advisories recommend isolating control networks from business networks, eliminating unregulated communication and using a DMZ or equivalent architecture when exchanges are necessary. The boundary should have an owner, documented rules, logging and a tested change process.
Use a DMZ for controlled exchanges
A BAS DMZ is an intermediate network in which exchange services terminate before data reaches either side. Examples might include a reporting broker, a replicated historian, a patch or file-transfer staging service, or a controlled remote-access jump host. The exact services depend on the facility; do not place a controller directly in the DMZ merely because it needs to send data.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDesign the permitted paths so that:
- IT clients do not initiate arbitrary sessions to controller networks.
- OT devices do not receive unsolicited inbound internet traffic.
- Only named services and destinations are allowed, with direction and ports explicit.
- Credentials, certificates and administrative sessions terminate at managed systems rather than being passed through blindly.
- Logs from the boundary are retained and reviewed by people who understand both network and building operations.
Where a one-way export is sufficient, use a mechanism that prevents the receiving side from issuing commands. If two-way interaction is operationally required, document why, constrain it to the smallest service set and define how it will be disabled during an incident.
Do not mistake physical separation for complete security
An air gap can be undermined by a maintenance laptop, removable media, a wireless bridge or a dual-homed workstation. Conversely, a routed boundary can be strong when rules, authentication, monitoring and operating procedures are maintained. Assess actual paths and human behavior, not only the diagram.
Should a building management system be on its own VLAN?
Usually, BAS traffic should not share an unrestricted broadcast domain with office users, but a VLAN alone is not equivalent to a reviewed security boundary. A VLAN separates Layer 2 traffic; it does not automatically prevent routing, credential misuse, administration from a compromised host or an undocumented wireless path.
| Component or approach | What it can provide | What must still be designed |
|---|---|---|
| VLAN | Logical separation and smaller broadcast domains | Inter-VLAN firewall policy, routing controls, administrator access, monitoring and protection against trunk or dual-homed mistakes |
| Firewall or ACL boundary | Explicit allow/deny rules, logging and protocol or port filtering | Accurate flow requirements, safe rule changes, capacity, failover and support for BAS protocols |
| Gateway or broker | Terminates and mediates a defined data exchange | Correct data direction, authentication, patching, failure behavior and assurance that it cannot become a command path |
| DMZ | Intermediate location for shared services and controlled conduits | Service hardening, separate administration, monitoring and a rule that prevents it becoming a flat transit network |
Choose the combination that your inventory, risk assessment and vendor requirements support. Test the design with facilities staff before enforcing deny rules, and document why each route exists.
How do I create zones inside the building OT network?
Organize OT assets by function, criticality, consequence and operational necessity, then define the conduits between zones. CISA guidance recommends this risk-based approach but does not prescribe a universal building diagram.
Use design prompts, not a fixed template
Depending on the facility, discussions may include separate zones for:
- Supervisory servers and databases
- Operator and engineering workstations
- Controllers and field networks
- Distinct building subsystems or sites with different vendors
- High-consequence equipment that needs tighter administration and monitoring
- Services such as time, identity or software distribution that support OT without controlling it
Do not split systems merely to create more boxes. A zone is useful when it reduces consequence, limits an attack path or makes an operational policy enforceable. If a vendor requires several controllers to communicate freely, record that dependency and consider whether the group belongs in a dedicated zone rather than weakening every other boundary.
Define conduits and approvals
For each inter-zone path, specify source, destination, protocol, direction, owner, justification, expiry or review date and logging requirement. Establish who can approve an exception and how facilities personnel are notified. Denied traffic should be visible enough to reveal a broken dependency without overwhelming operators with benign noise.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow do I enforce and monitor the segmentation?
Enforcement can use firewalls, access-control lists, VLANs, gateways and other controls appropriate to the system. The control is effective only when it reflects the approved flow register and is monitored for drift.
Baseline normal traffic
Collect an observation period that covers ordinary occupancy, unoccupied hours, scheduled maintenance and known alarm or failover conditions. Baseline communicating devices, protocols, services, destinations and timing. CISA’s ICS/OT monitoring considerations call for asset discovery, expected-traffic baselines and alerts for suspicious connections and unnecessary services.
Rank #4
- MOXA EDR-810-2GSFP Industrial Secure Router Switch with 8 10/100BaseT(X) ports, 2 1000BaseSFP slots, 1 WAN, Firewall/NAT, -10to60C -- NO VPN --
Alert on changes that matter
- A new device, route, service or external destination appears.
- A controller or workstation initiates a connection outside its approved conduit.
- An administrative protocol is used from an unexpected host or at an unusual time.
- Configuration, firmware, firewall or access-control rules change without a recorded work order.
- Repeated denied connections suggest a broken dependency or attempted lateral movement.
- A device that was thought to be isolated acquires a second interface or wireless association.
Tune alerts with controls personnel so that a genuine plant condition is not buried in false positives. Retain enough context to reconstruct who changed a rule, which account was used and what the building was doing at the time.
How should vendor and remote access work?
Inventory every approved remote-access and monitoring method, including supplier portals, cellular modems, VPNs, remote desktop tools and cloud integrations. Keep control devices behind managed firewalls and do not expose them directly to the public internet.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Provide suppliers with a named, approved path that has limited scope, strong authentication, time-bounded authorization and reviewable activity. Prefer access to a managed jump host or broker rather than a permanent route into controller networks. Disable the path when the work is complete, record the change and review logs with the vendor and facilities owner. If a legacy system cannot support modern authentication, compensate with isolation, strict scheduling, supervision and a documented exception.
How do I validate segmentation without interrupting building operations?
Operational continuity must be part of the design, not a post-change hope. CISA guidance calls for impact analysis, attention to IT/OT interdependencies and the ability to continue operating when one environment is unavailable.
- Review dependencies. Walk the proposed rules with controls engineers, facilities operators, safety personnel and affected IT owners. Identify commands, alarms, time sources, identity services, backups and reporting that would fail.
- Classify the consequence. Decide whether a blocked path could affect occupant safety, equipment protection, environmental conditions, regulatory records or only convenience.
- Stage the change. Use a maintenance window, a reversible rule set and out-of-band access. Where possible, begin with logging or alert-only behavior before denial.
- Test normal and abnormal cases. Verify operator logins, alarms, schedules, trend collection, manual controls, failover and recovery. Include loss of the DMZ service and loss of corporate identity or time services.
- Define rollback. Keep a documented, authorized way to restore the previous route without creating an uncontrolled permanent exception.
- Exercise continuity. Confirm who can operate equipment if the corporate network, BAS server or remote-support path is unavailable. Test manual procedures and backup communications where applicable.
Do not apply routine office patching or vulnerability scanning schedules to controllers without confirming vendor and operational tolerance. Coordinate maintenance, test in a representative environment when feasible and record the result.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What commonly undermines BAS segmentation?
- Unknown assets: A forgotten gateway or engineering laptop creates a path the design never evaluated. Reconcile passive discovery with the inventory.
- Overbroad “temporary” rules: Time-limit exceptions and require an owner and review date.
- Flat OT after the perimeter: Separation from IT does not stop lateral movement between controllers and workstations. Add internal zones where consequence justifies them.
- VLAN-only designs: Verify routing, firewall policy, trunk configuration and administration paths.
- Direct internet exposure: Remove public reachability from control devices and mediate supplier access.
- Unobserved conduits: Monitor wireless, cellular, serial gateways, removable media and dual-homed machines.
- Rules that ignore operations: A technically strict policy can create unsafe conditions if it blocks alarms, schedules or manual fallback. Validate with the people who run the building.
- Stale diagrams: Renovations, new tenants, cloud services and vendor changes can silently invalidate an old boundary.
How do I keep the design current?
Treat segmentation as an operating process. Maintain the asset inventory, diagrams, flow register, zone owners and exception approvals in a controlled system. Reassess after equipment replacement, building renovation, network redesign, supplier change or new cloud integration.
Recommended Free Tools
Schedule periodic reviews of firewall and ACL rules, remote-access accounts, certificates, vendor paths and monitoring coverage. Compare observed traffic with the approved baseline and investigate devices that bridge segments unexpectedly. Include segmentation checks in change management and procurement so a new “smart” subsystem cannot be connected before its dependencies and recovery behavior are understood.
Best Value
- 8+2G all-in-one firewall/NAT --- NO VPN-------/router/switch
- Build up secure remote access tunnel / Protect critical assets by stateful firewall
- Inspect industrial protocol with PacketGuard technology / Easy network setup with network address translation (NAT)
- RSTP/Turbo Ring redundant protocol enhances network redundancy / -40 to 75°C operating temperature range
- Security features based on IEC 62443 / NERC CIP / Check firewall settings with intelligent SettingCheck feature
Which option should a facility choose?
There is no universally correct appliance or topology in the cited guidance. Compare candidate designs against the same practical criteria:
| Decision criterion | Questions to ask |
|---|---|
| Boundary strength | Can the design prevent unapproved sessions and make the permitted paths unambiguous? |
| Protocol control | Can it allow the BAS protocols and directions actually required without opening broad ranges? |
| Visibility | Are asset discovery, flow logs, configuration changes and alerts available to the people who respond? |
| Compatibility | Does it work with existing controllers, serial links, vendor support requirements and failure modes? |
| Operational impact | Can rules be tested, rolled back and maintained without interrupting building services? |
| Maintainability | Can owners keep the inventory, diagrams, approvals and exceptions accurate over time? |
A generic OT firewall may be a reasonable product category, but buying an appliance alone does not secure a BAS. Check protocol support, throughput, management, support lifecycle and compatibility with the installed control system, then integrate the device into the documented architecture and monitoring process.
Frequently Asked Questions
Can a BAS share the same physical switches as office IT?
It can be possible when traffic is logically separated and the switching, routing, management and physical access are controlled, but shared hardware increases the consequences of configuration mistakes. Base the decision on the required boundary, failure modes and vendor support rather than on cabling convenience.
What data should a BAS send to corporate analytics?
Send only the measurements, alarms or reports that have a defined business purpose, preferably through a broker or export service in the controlled exchange zone. Separate read-only telemetry from any path that can issue commands, and document retention, authentication and outage behavior.
How often should segmentation rules be reviewed?
Review them on a scheduled basis defined by your risk program and whenever equipment, tenants, vendors, software, cloud integrations or network routes change. The important test is whether observed traffic still matches the approved inventory and flow register, not a calendar interval alone.
What should operators do if the BAS server is isolated during an incident?
Use the facility’s documented continuity procedure: confirm which local or manual controls remain available, how alarms are observed, who has authority to operate equipment and how conditions are recorded. Exercise that procedure before an incident so isolation does not become an improvised operational decision.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
