8.4 IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
Key Takeaways
- The Internet of Things (IoT) brings cheap, networked sensors and edge devices to buildings, enabling granular submetering, occupancy sensing, and equipment monitoring that older hard-wired BAS could not afford.
- Cloud- and web-based BAS platforms give a CEM remote, multi-site access through browsers and mobile apps, centralizing analytics and dashboards but shifting data custody to the vendor.
- Expert systems are rule-based AI that encode human diagnostic knowledge into if-then fault rulesets, complementing the machine-learning FDD of Section 8.3 with transparent, auditable logic.
- BAS cyber-security risk grows as OT (operational technology) converges with IT; defenses include network segmentation, hardened protocols, default-password elimination, encryption, access control, and patching.
- Because building controls increasingly touch safety and life-safety systems, a compromised BAS can disable ventilation, lock out chillers, or trigger alarms—cyber-security is an operational-continuity issue, not just a data issue.
IoT, Cloud-Based BAS, Expert Systems, and Cyber-Security
The Building Automation Systems of Section 8.1 ran on dedicated controllers and proprietary networks. The CEM Body of Knowledge now adds a connected layer: the Internet of Things (IoT), Web/Cloud-Based Systems, Expert Systems, and Cyber-Security. These four topics reshape how a CEM collects data, runs analytics, and protects the buildings they manage.
The Internet of Things in Buildings
IoT refers to networks of inexpensive, internet-protocol-addressable sensors and edge devices. In a building, IoT delivers capabilities the legacy BAS could not:
- Granular submetering at the panel or equipment level without running new control wiring.
- Wireless occupancy and CO₂ sensors that feed demand-controlled ventilation and lighting.
- Equipment-mounted vibration, current, and temperature sensors for condition-based maintenance.
- Edge computing that pre-processes data locally to cut bandwidth and latency.
IoT's value is resolution at low cost: a CEM can suddenly see loads and conditions that were invisible when every sensor needed a home-run cable. The trade-off is data volume, wireless reliability, and a much larger attack surface.
Web- and Cloud-Based Systems
Cloud- and web-based BAS platforms move storage and analytics off the facility's on-prem server and into a hosted environment. A CEM accesses them through a browser or mobile app. Benefits:
- Remote, multi-site access from a single dashboard—a CEM managing a portfolio sees every building in one pane.
- Centralized analytics (the cloud is where the ML of Section 8.3 usually runs).
- Easier updates and scalability—no on-site server to maintain.
- Energy Information Systems (EIS) that aggregate meter data, weather, and occupancy into benchmarking and anomaly alerts.
Risks include data custody (the vendor holds the data), internet dependency (a WAN outage blinds the operator), and subscription cost over the asset's life. The CEM weighs these against the operational savings—typically cloud wins for multi-site portfolios, on-prem for a single critical facility.
Expert Systems
An expert system is a branch of AI that encodes a human expert's knowledge as a rule base—a set of transparent if-then rules applied by an inference engine. In buildings, expert systems typically drive rule-based fault detection and diagnostics (FDD):
IF supply-air temperature > setpoint + 3°F AND chilled-water valve > 80% open AND outside-air temperature < 70°F THEN likely chiller capacity loss—investigate.
Expert systems contrast with the machine-learning FDD of Section 8.3, which learns patterns from data rather than from written rules. Each has strengths:
| Approach | Strength | Weakness |
|---|---|---|
| Expert (rule-based) | Transparent, auditable, encodes known physics | Only finds faults someone thought to write a rule for |
| Machine-learning | Finds novel/complex patterns | Opaque "black box," needs training data, harder to audit |
Mature FDD platforms blend both: rules catch the known faults fast and explainably; ML catches the subtle, novel ones. The CEM should know which engine is firing a given alert before acting on it.
Cyber-Security for Building Automation
As OT (operational technology—the BAS) converges with IT, building controls inherit IT's attack surface. A compromised BAS is not merely a data breach: it can disable ventilation, lock out chillers, shut down lighting, or trigger life-safety alarms. Cyber-security is therefore an operational-continuity concern, not just an IT concern.
Attack Surfaces
- Exposed protocols: BACnet and Modbus were designed for reliability, not security. BACnet default port 47808 and unauthenticated Modbus can be scanned from the internet if the network is exposed.
- Default and shared passwords on controllers and gateways.
- Unpatched firmware with known vulnerabilities.
- The IT/OT boundary: an attacker who breaches the corporate IT network may pivot into the BAS if the two are not segmented.
Hardening Measures
A CEM or their controls partner should enforce:
- Network segmentation between IT, guest, and OT/BAS networks; place the BAS behind a dedicated VLAN and firewall.
- Protocol hardening—BACnet/SC (Secure Connect) for encryption and authentication, or secure Modbus gateways; never expose a BAS port directly to the internet.
- Credential hygiene—eliminate default passwords, enforce unique per-device credentials, use role-based access.
- Encryption of data in transit (TLS) and at rest.
- Patching and lifecycle management—track firmware versions and apply vendor patches; plan for controllers that can no longer be patched.
- Monitoring and logging—audit who changed setpoints and when.
- A response plan that includes the operational consequences of a control-system compromise.
Frameworks such as the NIST Cybersecurity Framework (Identify-Protect-Detect-Respond-Recover) and ISA/IEC 62443 for industrial automation adapt cleanly to building OT. The CEM's role is not to run the firewall, but to ensure cyber-security is specified in BAS procurements, verified in commissioning, and maintained over the asset's life.
The Connected Layer in Context
IoT feeds the data, the cloud aggregates and analyzes it, expert systems and ML turn it into actions, and cyber-security keeps the whole stack trustworthy. Together with the BAS architecture (8.1), control strategies (8.2), and FDD/AI analytics (8.3), this completes the Building Automation and AI domain the CEM must master.
What distinguishes an expert system from a machine-learning FDD model?
Why is BAS cyber-security an operational-continuity issue rather than just an IT issue?
Which hardening measure most directly addresses the risk of an attacker pivoting from corporate IT into the building automation network?