In facilities like hospitals, commercial buildings, data centers, and other mission-critical buildings, uptime is not just a metric, it is a mandate. From heating, ventilation, and air conditioning (HVAC) systems and access controls to medical devices and server racks, the modern commercial building relies on a complex web of interconnected technologies. But this digital backbone is under siege.
Cyber supply chain attacks are becoming more sophisticated, targeting the very systems that keep your operations running. Threat actors, whether state-sponsored or profit seeking criminals, are embedding themselves within trusted vendors, software updates, and hardware components. Their goal? To exploit the trust placed in suppliers and disrupt the services operations depend on.
Why Building Services Are High-Value Targets
Hospitals depend on a tightly integrated ecosystem of connected medical devices, precision-controlled environmental systems (including heating, cooling, water/wastewater, and gas flow), patient data digital systems, uninterrupted power supply, and automated backup controls. Each of these components, while essential to patient safety and operational continuity, is increasingly exposed to risk through third-party integrations and external service dependencies.
Modern data centers form the backbone of global digital interconnectivity, powering everything from financial transactions and stock market exchanges to critical infrastructure operations, enterprise services, and e-commerce platforms. Whether users are aware or not, daily life depends on the seamless performance of these environments.
To ensure uninterrupted operations, data centers rely on tightly regulated environmental controls, managing temperature, humidity, power distribution, and facility systems with precision. Every safeguard is in place to prevent outages, yet these very building services represent a hidden vulnerability. As the convergence of IT and operational technologies (OT) systems deepens, these operational technologies become the soft underbelly of data center resilience.
Given their interconnectivity and the critical nature of their function, it is no surprise that facility systems have emerged as prime targets for cyber exploitation and supply chain attacks.
Building automation systems (BAS) frequently rely on legacy communication protocols such as BACnet, Modbus, and LonWorks, many of which lack native encryption, authentication, or granular access controls. These systems are often deployed with vendor-managed software that operates outside the purview of traditional IT security monitoring, leaving gaps in visibility and control. Firmware updates, patching schedules, and credential management are typically handled by third parties, introducing supply chain risk and inconsistent security hygiene.
Moreover, BAS components are commonly integrated into broader facility networks without proper segmentation, allowing lateral movement opportunities for threat actors. The convergence of IT and OT environments further amplifies these vulnerabilities, making building systems a high-value target for cyberattacks aimed at disrupting the systems that maintain daily operations.
Building service environments are not merely operational; they are mission critical. A breach does not just result in system downtime; it can disrupt patient care, compromise emergency services, and introduce real-world safety hazards. The consequences extend beyond digital boundaries, affecting lives, trust, and the integrity of essential services.
A Simplified Cyber Supply Chain Risk Management Framework
CISA and NIST have a wealth of information related to Supply Chain Risk Management (SCRM), the following is a simple framework to get started:
Use this map as a checklist to identify weak links and prioritize upgrades. Even small steps, like requiring vendors to meet cybersecurity standards, can reduce your exposure.
Secure What Matters Most
Whether overseeing infrastructure in a hospital, data center, or any other critical facility, a clear understanding of supply chain risks is essential to maintaining operational resilience:
- Audit your supply chain: Know who has access to your systems and how they are secured.
- Engage your vendors: Demand transparency and cybersecurity accountability.
- Invest in resilience: If feasible, modernize legacy systems to reduce exposure, implement asset mitigation strategies to safeguard critical infrastructure, and ensure personnel are consistently trained in cyber hygiene best practices.
- Join the conversation: Collaborate with peers and industry groups to stay ahead of emerging threats to understand the supply chain.
Your facility is more than a building; it is a lifeline. Let’s make sure it is protected from the inside out. Do not underestimate the importance of a SCRM program whether you are a building service or any other critical infrastructure leader.