GDS Technology — Built, Wired and Secured podcast banner
Watch on YouTube →
Episodes Secured
Episode 152

The Unseen Risk: Why Your Building's IoT Devices Are a Backdoor to Your Network

October 2, 2026
Key takeaways
  • HVAC, elevators, lighting, cameras, and smart sensors are networked computers that can expand a building’s cyberattack surface.
  • Default passwords, open vendor access, weak segmentation, and inconsistent patching can allow attackers to reach or disrupt building systems.
  • A compromised building automation system can affect tenant comfort, access, security visibility, business continuity, and trust.
  • IT, facilities, property management, vendors, and ownership must share responsibility for operational technology security.
  • The practical starting points are inventorying every connected device, segmenting networks, changing default passwords, patching carefully, and reviewing vendor agreements.
Watch on YouTube Is Your Business Exposed?

Show Notes

The Hidden Attack Surface Inside Modern Buildings

Modern commercial buildings depend on connected systems to control heating, cooling, elevators, lighting, access control, cameras, and other essential operations. These operational technology (OT) and Internet of Things (IoT) devices improve efficiency and convenience, but they also create a digital attack surface that property owners, facilities teams, and IT departments cannot afford to overlook.

In this episode of Built, Wired & Secured, the conversation focuses on why a device that appears harmless—such as a smart thermostat or temperature sensor—can become a pathway into systems carrying sensitive business and tenant data. The discussion also explains why securing building technology requires cooperation between IT, facilities, property management, vendors, and ownership.

Why Building Systems Are Vulnerable

Many building systems were designed first for reliability, uptime, comfort, and energy efficiency. Security controls were often treated as secondary. As these systems became internet-connected and integrated with corporate networks, their risks increased.

  • HVAC controllers, elevators, lighting panels, cameras, thermostats, and other devices may connect to business networks.
  • Some devices retain default passwords or lack strong authentication.
  • Many OT systems are rarely patched because updates can affect critical building operations.
  • Older systems may lack encryption or modern monitoring capabilities.
  • Unrecognized devices can remain on a network without a clear owner or documented purpose.

A device does not have to store sensitive information to create risk. If an attacker can compromise it and use it as a foothold, the device may provide a path toward other systems.

What a Building Cyberattack Can Look Like

The episode uses practical examples to show how a cyber incident can quickly become an operational and business problem. An attacker who gains access to a building automation system could change the temperature, disrupt access control, or interfere with systems tenants rely on every day.

One example involves a smart thermostat connected to building Wi-Fi. An investigation found that someone had accessed its administrative panel using the default password and manipulated the temperature. Although the incident was treated as a prank, the same weakness could have been used for a more damaging intrusion.

Another example involves a building automation system connected to a corporate network for remote monitoring. A vendor left a remote access port open, and a ransomware group used it to reach the system. The building lost control of its HVAC operations for three days. Portable units were needed, security camera access was unavailable, tenants became concerned about their data, and rebuilding confidence took much longer than restoring the technology.

When Cybersecurity Becomes an Operations Issue

The impact of an OT incident is not limited to a server room or IT help desk. A compromised building system can affect comfort, safety, tenant access, business continuity, vendor coordination, and the reputation of the property.

  • HVAC disruption can make a building uncomfortable or unusable.
  • Access control problems can prevent tenants from entering offices.
  • Loss of camera access can reduce visibility during an incident.
  • Unplanned system changes can cascade into broader operational failures.
  • Tenant confidence may take weeks to rebuild after a major disruption.

Because these systems are interconnected, a small change or weak access point can create consequences far beyond the original device.

Shared Responsibility Between IT and Facilities

A recurring theme is that OT security cannot be assigned entirely to one department. Facilities teams understand the equipment, building dependencies, and operational priorities. IT teams understand network security, access management, segmentation, monitoring, and incident response. Property managers and owners control priorities, contracts, and budgets.

When each group assumes the issue belongs to someone else, gaps remain. Facilities may not know how to secure a network, while IT may not know which controller is critical to keeping the building operational. The solution is a partnership rather than a handoff.

  • IT should explain the security risks and available controls.
  • Facilities should identify devices, dependencies, and operational constraints.
  • Property management should coordinate the teams and understand business impact.
  • Ownership should recognize that OT security is part of protecting the asset and its tenants.

Practical Steps to Secure Building IoT and OT

  1. Inventory every connected device. Walk the building and document thermostats, controllers, cameras, smart sensors, lighting systems, elevators, coffee machines, and other connected equipment. You cannot protect what you do not know exists.
  2. Segment the network. Building systems should not share an unrestricted network with tenant data or core business systems. Separate VLANs and appropriate access controls can limit how far an attacker moves after compromising a device.
  3. Change default passwords. Default credentials are an easily preventable weakness. Every device should use unique, strong credentials and controlled administrative access.
  4. Patch carefully and consistently. OT updates should be tested and scheduled during appropriate off-hours. Security cannot be ignored, but updates must be planned so they do not unexpectedly interrupt building operations.
  5. Review vendor agreements. Installation and maintenance contracts should include cybersecurity requirements, remote-access controls, patching expectations, and responsibilities for protecting building systems.
  6. Bring IT and facilities together. Establish a recurring conversation about connected devices, risks, changes, maintenance windows, and incident response.

Protecting the Digital Heart of the Building

Securing a commercial property now involves more than locks, cameras, and physical access controls. The systems that make a building comfortable, efficient, and operational are computers connected to networks—and they need the same thoughtful security planning as other technology assets.

The starting point does not have to be complicated. Conduct an OT security assessment, identify unknown devices, separate critical systems from tenant data, eliminate default credentials, and create a shared plan between facilities and IT. These steps help protect tenants, operations, reputation, and the long-term value of the property.

Listen to the Full Episode

Listen to this episode of Built, Wired & Secured for a practical discussion about building IoT, operational technology, network segmentation, vendor access, ransomware risk, and the collaboration required to secure modern commercial properties.

Deeper dive

The Unseen Risk: Why Building IoT Devices Can Become a Backdoor

When people think about cybersecurity in a commercial building, they often think about email accounts, laptops, servers, and tenant data. Those systems deserve attention, but they are not the only technology connected to the network. The HVAC controller, smart thermostat, lighting panel, elevator system, camera, or temperature sensor may also create an entry point for an attacker.

That is the central concern explored in this episode of Built, Wired & Secured: building systems that were installed to improve comfort, efficiency, and convenience can create serious cybersecurity exposure when they are connected without adequate controls.

Building Systems Are Computers, Too

Operational technology, or OT, includes the systems used to monitor and control physical operations. In a commercial property, that can include heating and cooling, elevators, lighting, access control, cameras, and building automation platforms.

Many of these systems were originally designed around reliability. Facilities teams needed equipment to run consistently, respond to environmental conditions, and support building operations. As remote monitoring and smart-building capabilities expanded, these systems became connected to the internet and to wider business networks.

Connectivity creates benefits, but it also changes the risk. A smart thermostat is not just a thermostat if it has an administrative interface, network access, and remote connectivity. A temperature sensor is not just a sensor if it shares a network with sensitive business systems. Each connected device must be treated as part of the organization’s technology environment.

Why OT Devices Can Be Easy Targets

Connected building systems often have characteristics that make them difficult to secure. Some use default passwords. Others may not support strong encryption or modern authentication. Patching can be inconsistent because an update may affect equipment that controls a critical building function.

There is also an ownership problem. Facilities teams know which systems keep the building running, but they are not necessarily cybersecurity specialists. IT teams understand networks, access control, and incident response, but they may not know every device installed in a mechanical room or tenant space. When neither team has complete visibility, an unrecognized device can remain connected without a clear security plan.

The result is an invisible attack surface. A device may appear minor, but it can provide an attacker with a foothold. From there, the attacker may attempt to move toward other systems or disrupt building operations.

The Business Impact Goes Beyond IT

A cyberattack against building technology can quickly become a tenant and operations issue. If an attacker gains access to a building automation system, they may be able to manipulate temperatures or interfere with other controls. If access control is affected, tenants may not be able to enter their offices. If cameras become unavailable, property teams may lose important visibility during an incident.

The episode describes a smart thermostat that was accessed using a default password. The person changed the temperature repeatedly as a demonstration of what was possible. The immediate event was disruptive, but the underlying weakness could have supported a much more serious attack.

Another example involved a building automation system connected to a corporate network for remote monitoring. A vendor left a remote access port open, and a ransomware group found it. The system was encrypted, leaving the property without normal HVAC control for three days. Portable units were needed, camera access was unavailable, and tenants became concerned about their data. Even after the system was restored, rebuilding tenant trust took weeks.

These examples show why OT security should be viewed as business continuity planning. A building that cannot regulate temperature, manage access, or provide expected security functions may be unable to operate normally, even if traditional business servers remain available.

Security Cannot Be Assigned to One Department

One of the most important points from the discussion is that responsibility must be shared. Facilities, IT, property management, vendors, and ownership each have information or authority that the others need.

Facilities teams understand equipment, dependencies, maintenance schedules, and the operational consequences of an outage. IT teams understand network architecture, segmentation, authentication, monitoring, and response procedures. Property managers coordinate the building and tenant relationship. Owners approve budgets and set expectations for risk management.

This is not a reason to pass responsibility from one group to another. It is a reason to create a working partnership. IT cannot secure devices it does not know exist, and facilities cannot be expected to manage cybersecurity controls without support. The teams need a shared process for identifying devices, evaluating risk, approving remote access, planning maintenance, and responding to incidents.

Five Practical Steps for Building OT Security

1. Create a complete inventory

Start by walking the building and documenting every device that connects to a network. Include obvious systems such as HVAC controllers, cameras, elevators, and lighting panels, but also look for smart sensors and smaller connected equipment. Record the device owner, purpose, location, network connection, vendor, remote-access method, and business impact if it fails.

2. Segment building systems

Building automation should not sit on the same unrestricted network as tenant data or core business systems. Network segmentation, including separate VLANs and controlled traffic between environments, can reduce the ability of an attacker to move laterally after compromising an IoT or OT device.

3. Replace default credentials

Changing default passwords is one of the simplest and most frequently overlooked security improvements. Administrative credentials should be unique, protected, and limited to authorized users. Remote access should be reviewed rather than left permanently enabled for convenience.

4. Patch with an operational plan

Patching remains essential, but OT updates must be handled carefully. Test updates before deployment, understand dependencies, and schedule changes during appropriate maintenance windows. Preventive maintenance is safer than waiting for an emergency, but security work should not introduce an unplanned operational outage.

5. Put cybersecurity requirements in vendor agreements

Vendors that install or maintain building systems can have significant access to the environment. Agreements should define security expectations, remote-access controls, patching responsibilities, authentication requirements, and what happens when a vendor relationship ends. A single open vendor connection can create substantial exposure.

Start with Visibility and Collaboration

Building cybersecurity does not have to begin with a complicated transformation project. It can begin with a meeting between IT and facilities, followed by a structured inventory and a review of network connections. Property managers and owners should participate because the risk affects tenants, operations, reputation, and the value of the property.

The objective is not to make facilities teams into cybersecurity professionals or to make IT responsible for operating every piece of building equipment. The objective is to combine their expertise so that connected systems are known, appropriately separated, maintained, and monitored.

Modern buildings are increasingly digital. That means securing a property requires more than protecting the front door. It also requires protecting the systems that regulate the environment, control access, support safety, and keep tenants productive.

For a deeper discussion of building IoT risks, ransomware exposure, network segmentation, and the shared responsibility between facilities and IT, listen to this episode of Built, Wired & Secured. A practical OT security assessment can be the first step toward understanding what is connected and closing the gaps that matter most.