Do You Know Where Your Building's Firmware Came From?
- James W.
- 3 days ago
- 1 min read
I asked a building manager: "Can you show me where the firmware in your BMS controller came from?"
They couldn't answer.
Not because they didn't care. Because nobody in the supply chain was transparent about it.
The firmware probably includes:
Operating system components (maybe open-source, maybe not, maybe years out of date)
Third-party networking libraries
Cryptography implementations
Proprietary vendor code
Possibly code from defunct companies now owned by hedge funds
All of it running in the device controlling your building's operations and security.
And you can't verify any of it.
SBCGA-SUPPLY: supply chain transparency
Bills of Materials. Firmware origin verification. Cryptographic signature validation. Supply chain risk scoring.
You can't secure what you don't understand.
Smart building security starts with supply chain visibility. Your firmware didn't appear by magic. Know where it came from.
Learn SBCGA → AC-146: "The Fifteen-Year Patch"
Comments