Theme: Protected transport is a component, not the whole architecture
Quick definition
Secure Connect here means BACnet Secure Connect, or BACnet/SC: a secure BACnet datalink using WebSocket and TLS for peer authentication, encryption and reliable connection-oriented communication. It protects BACnet messages over IPv4 or IPv6. Secure transport is valuable, but it is not a complete security architecture.
In context
BACnet/SC complements BACnet/IP and MS/TP; it does not replace BACnet’s object and service model. Other protected connections can exist in a facility, but this established title refers to the BACnet technology. The factual scope is therefore building automation communication rather than every remote-access product.
A concrete service scenario
A refrigeration contractor needs to diagnose a controller from an external service location. BACnet/SC can protect traffic among trusted BACnet nodes. Access still needs a named user, approved time window and logging, while local control needs defined behaviour if the connection disappears during the session.
Certificates and identity
TLS depends on keys and certificates. Someone must issue, distribute, renew, revoke and recover them. A valid device certificate does not automatically mean that a particular engineer may alter a setpoint. Device identity, human identity and functional authorisation are separate design and governance decisions.
Opportunities
Authenticated, encrypted transport reduces exposure to eavesdropping and unauthorised BACnet peers on the path. BACnet/SC is designed for managed IP infrastructure and avoids some broadcast-related complications of older BACnet/IP deployments. Public reference implementation and test resources can support product interoperability work.
Limitations and trade-offs
BACnet/SC does not correct excessive privileges, vulnerable application logic or a compromised trusted endpoint. Certificate operations and hub dependencies add lifecycle work. Segmentation, allowlists, monitoring, secure configuration and tested fallback behaviour remain necessary according to operational consequence.
HubMind’s view
Specify Secure Connect as a governed trust path. State which identities are trusted, which commands are allowed and who owns certificates. Use BACnet/SC where BACnet transport needs protection, but never turn a transport property into a claim that the complete system is secure.
A practical next step
Trace one real remote-service path from the engineer’s identity to the target controller. Mark authentication, certificate ownership, network boundaries, permitted services and logs. Then test an expired certificate, unavailable hub and broken link, confirming that the physical process reaches its intended operating state.
Related concepts
BACnet, Cybersecurity (OT), Network Segmentation, IEC 62443.
Sources and further reading
Scope and freshness
Secure Connect is used here specifically for BACnet/SC. It was defined in Addendum 135-2016bj and is included in later BACnet editions; this page does not cover every VPN or remote-access design. Reviewed 31 August 2026.