New episode of How to Handshake is up. This one's on BACnet Secure Connect — what it actually is, what it doesn't fix, and when (or whether) you should bother migrating.
Our guest is Nate Benes from the University of Nebraska. Nebraska is one of the few institutions in North America that designs and builds its own building automation gear in-house — they've been doing it since 1975. Nate is also a working member of ASHRAE's SSPC 135, the BACnet committee. So he's writing the standard and living with it on a real campus.
What we covered:
- BACnet/SC is just another data link in BACnet — same application-layer messages, new transport. Not a re-architecture.
- Hub-and-spoke vs. UDP broadcast, and what that means for BBMDs (spoiler: SC does away with the need for them, and supports a primary/failover hub architecture)
- Zero trust applied to building automation — authenticating who a device is rather than where it sits on the network
- Certificates and the certificate authority: who owns the CA when the integrator walks away, and why long-dated certificates (5, 10, 20 years) are an anti-pattern
- BACnet/SC and BACnet/IP coexisting in the same building via IP-to-SC routers
- BACnet/SC vs. VPN — why the attack surface is smaller (only BACnet packets cross the pipe, no lateral movement to the corporate file share)
- What the standard does and doesn't cover (cert lifetimes, CA ownership, network shape — left to integrators)
- What's in flight at the committee level: automated cert renewal (a Let's-Encrypt-style flow for BACnet), post-quantum cryptography, the EU Cyber Resilience Act, and the U.S. Cyber Trustmark
- BTL listings — you can filter the BTL site for BACnet/SC hubs and devices that are conformance-tested today
- Nate's "don't do this" list: SC is not a reason to put thermostats directly on the public internet, and it's not a reason to abandon network segmentation
Full episode, show notes, and the cleaned-up transcript: https://www.optigo.net/how-to-handshake-ep-3-bacnetsc/
Subscribe so you catch future episodes:
- Apple Podcasts: https://podcasts.apple.com/podcast/id1889945777
- Spotify: https://open.spotify.com/show/6Jg2yumYXCV2dRl1sIuPHO
- Deezer: https://www.deezer.com/us/show/1002831921
- YouTube: https://www.youtube.com/playlist?list=PLzATddJ3Lh0Jvhf7UgxuiBFBjqMibitUt
Happy to answer questions in the comments — and if there are topics, debates, or technical deep-dives you want us to tackle on a future episode, drop them below or send us a message.