Skip to content
EDWartens UK

Free course · Cybersecurity

Cybersecurity for Building Automation: BMS and BACnet

Secure the building management systems you design, install or run: real building hacks, BMS network architecture and its weak points, hardening controllers and front ends, secure design with zones and conduits, BACnet Secure Connect, defence in depth for BACnet/IP, secure vendor remote access and zero trust.

See the modules

Free to learn. Verifiable certificate £19 when you pass the final exam (optional, VAT included).

Level
Intermediate
Modules
9
Video
8 hours
Price
Free

Outcome

What you will be able to do

Explain how buildings have been attacked and why the BMS can be a way into the business; describe a BMS network from management to field level and find its weak points; harden controllers, servers and workstations; design a secure BMS with zones, conduits and security requirements in the specification; explain and plan BACnet Secure Connect with its hubs and certificates; secure existing BACnet/IP systems in depth; design secure vendor remote access; and plan the move to authenticated, authorised and audited BACnet.

  • Explain how buildings have been hacked and why a BMS can be a way into the business
  • Describe BMS architecture and find the weak points in BACnet, Modbus and MS/TP networks
  • Harden controllers, servers and accounts in the building's priorities
  • Design a secure BMS with IEC 62443 zones, conduits and specification clauses
  • Explain and plan BACnet Secure Connect with hubs and certificates
  • Secure existing BACnet/IP systems in depth
  • Design secure, time-limited vendor remote access
  • Plan authorisation, audit logging and a phased migration

Software

None required. Wireshark (free) is useful for looking at BACnet traffic on a test network you own.

Hardware

None. A spare BACnet controller on a bench network makes the hardening exercises more real.

Syllabus

9 modules

Each module has video lessons, notes and a short quiz. The final exam closes the course.

  1. 1Buildings that got hacked4 lessons
  2. 2How a BMS network is built, and where it is weak2 lessonsLab
  3. 3Cyber security for building automation1 lesson
  4. 4Designing a secure building management system1 lessonLab
  5. 5BACnet Secure Connect3 lessons
  6. 6Securing BACnet systems in depth1 lessonLab
  7. 7Segmentation, remote access and zero trust3 lessonsLab
  8. 8Where BACnet security is going1 lesson
  9. 9Final Assessment1 lesson

How it works

How this course works

  1. Watch the video lessonsOne module at a time, at your own pace.
  2. Take the module quizA short quiz at the end of each module shows what stuck.
  3. Keep your notesWrite in My notes beside each module and ask the trainer if you are stuck.
  4. Practise in the labOptionalTry a task from the module in the EDWartens Lab, in your browser.
  5. Sit the final examPass it once you have been through the modules.
  6. Certificate, if you want oneOptionalPaid, and only after you pass. Anyone can check it online.

EDWartens Lab

Practise this in the EDWartens Lab

Map a plant network, find the odd device and set deny-by-default firewall rules in the Lab's OT security simulator.

Works alongside Cybersecurity for Building Automation: BMS and BACnet. The Lab is ot security practice in your browser: no install, no hardware, free to use. Sign in as a learner and it opens with your account.

Open the free lab See the Lab
OT security: Defend a plant network.

Levels to try with this course

Optional. Skip it whenever you like: it never blocks your progress or your certificate.

Why practise in a lab

Technical work is judged on what you can do: wiring, commissioning, finding a fault. Doing a task yourself teaches more than watching it a second time, and a lab lets you try it safely before you meet real equipment. It does not replace working on real hardware.

  • Practise safely, so a mistake costs nothing.
  • The lab checks your work like a site test, so you know when it is right.
  • Free, in your browser, with nothing to install.

Certificate

An optional certificate when you pass

Learning is free. Pass the final exam and you can have a certificate for £19, including VAT, with a number employers can check online. It records that you completed a free online course; it is not a regulated qualification or a CPD certificate.

  • Your name, the course, its study time and your final exam score
  • A unique certificate number and a QR code to its verification page
  • Issued by Wartens Ltd; add it to your LinkedIn profile in one click
  • Pay now or after you pass: it is issued the moment you pass the final

How the certificate works

Sample certificate for Cybersecurity for Building Automation: BMS and BACnet

Credits

Who made the lessons

The video lessons belong to their creators. EDWartens wrote the study plan, notes, quizzes and the final exam.

Questions

About this course

Who is this course for?
BMS engineers and technicians, system integrators, facility managers, MEP consultants and OT or IT security staff who look after building systems. Basic networking knowledge is assumed.
Is this a hacking course?
No. It teaches people responsible for buildings to protect them. There are no techniques for attacking systems, and the course warns against testing live buildings without written permission.
Is it tied to one BMS vendor?
No. It is about BACnet, Modbus and the design of any BMS. Siemens and other companies' lessons are used where they explain the ideas well, credited on each module, and none of them is affiliated with EDWartens.
Do I need BACnet/SC equipment?
No. The course explains BACnet/SC from the lessons and the standard's principles. If you have a controller that supports it, the bench exercises become more real.
Is the course really free?
Yes. Every module, the notes, the project and the final assessment. The only paid item is the certificate, if you want it.
What certificate do I get?
An EDWartens Certificate of Completion, issued when you pass the final assessment, with a number anyone can verify on our site. It is not a BACnet International or ASHRAE certification.
How long does the course take?
About 8.1 hours of video lessons, notes and practice questions, plus about 10 hours if you do the project. At an hour a day, that is about two and a half weeks.
What is the project?
You assess the BMS of a 14-storey office tower in Lagos, Nigeria, whose tenant wants evidence that the building's systems are secure. You write an asset inventory, a zones and conduits model, a risk register, and a plan for hardening, vendor remote access and a phased move to BACnet/SC.

The Professional Module is five live days of Siemens PLC, HMI and SCADA with an instructor, then a resume session and a CPD certificate.

See the Professional Module