BACnet

BACnet (Building Automation and Control Networking protocol) is a communication standard used to connect and control building-automation equipment: HVAC systems, lighting, access control, fire and life-safety systems, and other building management hardware. BACnet/IP, the version that runs over standard IP networks on UDP port 47808, inherited the same trust assumption as other older industrial protocols — that the network it runs on is isolated and trusted — so it has no built-in authentication or encryption. A BACnet device reachable from the internet can typically be queried or commanded by anyone who finds it, which matters for buildings whose automation network wasn’t deliberately segmented away from general internet access. OPC UA, a newer industrial protocol sometimes used alongside BACnet in modern buildings, was designed with authentication and encryption as built-in options instead — the same no-built-in-security pattern shows up in other industrial protocols like Modbus/TCP. The BACnet Committee (ASHRAE SSPC 135), which developed and maintains the standard, publishes its updates, corrections and interpretations, UDP port 47808 is the one IANA’s service names and port numbers registry lists for BACnet/IP, and AdminKit’s guide on BACnet/IP exposure walks through checking whether a building’s automation network is reachable from outside. NIST SP 800-82r3, the federal guide to operational technology security, treats building automation systems — HVAC, fire, lighting, physical access control — as a type of OT in their own right and states that its recommendations can be used as a reference to protect them.

AdminKit groups bACnet under its machine protocols cluster — browse the AdminKit glossary index for other related terms.