Securing your installation
Securing your building automation system
Change the credentials, segment the network, keep the software updated, and never expose control equipment directly to the Internet.
Connected building-automation systems bring real benefits: easier monitoring and configuration, and new services built on the data they hold. They are also found and probed by automated tools, with motives from curiosity to extortion and sabotage. Attackers look for three openings: a default or weak password, a device reachable directly from the Internet, or software that has not been updated. The consequences are the same whatever the motive: functions degrade or stop, data is lost or exposed, or a minor device becomes the way into more critical systems.
Make cybersecurity part of every installation, including the ones already in service. Who does what is set out below, then the checklist.
This is general guidance. For a specific product or service, follow its documentation, its Security & Trust Overview where published, Swegon's security advisories, and the site's own risk assessment.
Who does what
Security of a connected building is shared, and the line moves with how the equipment is connected: the more of the connectivity Swegon provides, the more Swegon carries. Swegon is responsible for the products, services and managed connectivity it provides, and for stating what they need from their environment. The customer is responsible for that environment. At a high level:
| Swegon | Customer | |
|---|---|---|
| Product and software | Secure design, access control, a verified update mechanism, vulnerability monitoring and fixes | Operate the product as intended, manage local user accounts, install updates, assess the impact in your environment |
| Network | Clearly defined interfaces and defaults, secure communication options where supported | Segmentation and firewalls, restricted access to management and automation interfaces, secured remote access |
| Managed connectivity and cloud services | The transport, the path to the cloud and the service itself, where Swegon provides them | Assign roles in the service and enforce MFA where offered |
| Physical security | Design for installation in controlled environments | Physical security of the installed equipment |
| Operation and monitoring | Product-level logging and diagnostics, advisories when action is needed | Monitor the installation and respond to incidents on site |
| Lifecycle | Security documentation and guidance, support for released versions | Keep the equipment on a supported version |
Swegon's security assumptions and support guidance apply when the equipment runs in the environment its documentation describes. The exact split for a product or service, and how it changes with managed connectivity and cloud services, is in the Connected Products Security & Secure Deployment Guide and the product's Security & Trust Overview.
The checklist
Three moments in the life of an installation: when it is commissioned, at every periodic review while it is in use, and when it is taken out of service. The checklist is the summary from the Swegon Connected Products Security & Secure Deployment Guide, which explains each item. Use it at handover and at every periodic review.
|
Commissioning When the equipment is installed and handed over, before it goes into service.
|
|
Periodic maintenance At each periodic review, for as long as the equipment is in use.
|
|
Decommissioning When the equipment is taken out of service, replaced or passed on.
|
Want the detail?
- The reasoning behind each item, and secure deployment across Swegon's connected products: the Swegon Connected Products Security & Secure Deployment Guide.
- A product's or service's ports, interfaces, defaults, connectivity and certification evidence: its product documentation, and its Security & Trust Overview where published.
- Found a vulnerability? Report it under the Swegon Vulnerability Disclosure Policy.
Last reviewed 4 November 2026.