Cyber-Physical Attack Surface of Building Automation Systems: A Review of Threats and Compensating Controls

Abstract

Building automation systems govern heating, ventilation, lighting, shading, and access in modern facilities. They grew out of a tradition of environmental control in which security was a side issue at best, and they are now routinely joined to IP networks, to remote service access, and to cloud analytics, while the trust model of their field protocols has not kept pace. The consequence of a successful attack is not confined to data. It is a change in the physical state of the building and in the conditions of its safe use. This paper reviews the cyber-physical attack surface of building automation across the management, automation, and field levels, compares the security properties of four dominant field protocols and of the secure protocol variants now published, and asks which compensating controls reach the level where they are needed. The method is a narrative review of peer-reviewed literature, protocol standards, European and Polish law, and primary vulnerability and incident records, selected against stated criteria and weighted toward the period 2023 to 2026. A widely repeated incident case is re-examined against its primary source, which does not support the account that circulates. The review finds that published evidence is dominated by vulnerability demonstrations rather than documented operational harm; that secure variants of the major protocols now exist, so the binding constraint has moved from protocol design to the installed base; and that European building law is placing automation into a large part of the non-residential stock on a fixed schedule while addressing its cybersecurity in a single clause. No value reported here comes from the author's own measurement. Comparative assessments are expert judgments calibrated against documented events and are labeled as such.