01
What a BMS is
A building management system monitors and controls the plant that keeps a building usable: cooling, ventilation, pumps and energy metering. Operators work from servers and workstations that talk over a dedicated network to field controllers wired to the equipment. In a hospital or an airport that plant has to keep running, so availability comes before almost everything else.
02
What I protect
The supervisory layer of servers, databases, domain controllers and operator workstations; the field network that connects it to the controllers; and the boundary to everything outside. If those are compromised or misconfigured, operators can lose sight or control of the plant. I do not program the controllers. I secure the systems and networks around them.
03
Hardening and identity
I deploy and harden Windows Server, Active Directory, Group Policy and SQL Server, and build two-node Hyper-V clusters with shared storage so one failed host does not take the BMS down. Administrator logins on firewalls and switches authenticate against Active Directory through RADIUS, so access is individual and can be removed in one place.
04
Vulnerabilities in systems that cannot just be patched
Many BMS networks are air-gapped and run around the clock. I triage scanner findings alongside OT asset-visibility data, prioritise what matters, and apply patches offline in agreed change windows. Where something cannot be fixed yet, I document the residual risk and the compensating controls for the client to accept.
05
Boundaries and segmentation
I review firewall policy rule by rule, record why each rule exists, and plan replacements with validation, observation and rollback steps. VLAN segmentation keeps field traffic apart from servers and remote access.
06
Seeing what happens
I onboard servers, switches and storage to centralised log monitoring with the implementation vendor, maintain endpoint protection, and manage TLS certificates on system and device management interfaces.
07
Recovery and evidence
Field switch configurations are backed up and verified by script, backups are copied between sites on a schedule, and every change leaves a runbook entry recording what was checked and what is still open. Clients get written answers on what is in place and what remains their responsibility.