Building management systems (BMS) play a pivotal role in the physical health of retail facilities, in addition to healthcare delivery organizations (HDOs), data centers, and other commercial, industrial, and medical facilities. By centrally monitoring a retail operation’s mechanical, electrical, and safety centers, BMS cybersecurity risks must also be addressed.
Given that BMS are essential operational technology (OT), they are also saddled with many of the security risks associated with other industrial automation systems, including legacy protocols. One protocol that stands out is KNX (Kennex), an open standard used primarily in Europe that enables communication over a shared network between proprietary devices built by different manufacturers.
Although KNX remains useful and can be deployed securely, its presence in a modern, interconnected retail environment introduces risks that security teams must understand and manage.
This blog will examine KNX, and identify:
Details on the standard and what cybersecurity risks it presents
KNX’s role in retail and distribution environments
Controls that can be deployed to manage KNX risk
How to build a security strategy around KNX
Given the recent disruptive cyberattacks in France impacting hundreds of supermarkets and causing millions in lost produce and profit, retailers must examine every aspect of their environments. Legacy protocols, while difficult to rip-and-replace, do have security implications that are kept in check with a solid network architecture and controls around the KNX installation. Retailers must make these decisions based on the business impact of these connected assets, and manage risk in order to avoid not only disrupting physical operations inside of stores, but the downstream impacts that disruptions or damaging cybersecurity attacks can have on the supply chain.
What is KNX, and its Cybersecurity Challenges?
KNX is an open, standardized building automation protocol used to exchange control and status information between devices such as sensors, actuators, lighting controllers, thermostats and building management systems. A KNX installation can operate locally, but IP connectivity and integration with supervisory systems allow building operations to be monitored and managed remotely.
KNX's 30-plus-year history is rooted in three European standards (EIB, EHS, and BatiBUS); it is an official European and international standard (CENELEC EN 50090 and ISO/IEC 14543-3, respectively). Like most legacy OT, it was developed when building automation was largely air-gapped from the public internet. The introduction of IP-connectivity, remote management, third-party infrastructure, and cloud-based computing services introduced a new realm of risks to these environments.
KNX deployments lack what today are considered fundamental security capabilities such as authentication and access controls, and encryption that ensures data integrity. In 2015, KNX Secure was released; it included many of the fundamental controls described above, but they are not automatically present in existing installations. They are an add-on, and it’s up to engineers and asset managers to decide to introduce KNX Secure to their respective environments.
Older devices, insecure configurations, exposed KNX/IP interfaces and inadequately protected engineering tools can create opportunities for unauthorized access, control manipulation, reconnaissance or disruption. Even where the protocol itself is not directly exposed to the internet, an attacker may reach building systems through a compromised corporate network, remote access connection or management server.
Why KNX Matters to Retail, Distribution Facilities
Retail cybersecurity must account for risks and known threats to building automation that can impact physical conditions, employee safety, customer experience, and operational continuity.
In supermarkets, unauthorized manipulation of temperature monitoring or HVAC controls could compromise store conditions, affect refrigeration-dependent operations where systems are integrated, or create conditions that require sections of a facility to close. In the France supermarket attacks, threat actors were able to access controllers in the environment and overrode existing settings to trigger refrigeration systems to go into an extreme defrost mode. Temperatures in the units reached 50℃ for six hours, causing food and stock to spoil.
While it remains unknown how the attackers accessed the French markets, exposures such as legacy protocols can enable an attacker to reach these systems unabated, largely because they were developed for functionality and not with modern cyber threats in mind.
In retail environments, KNX-based communication can be responsible for many critical functions beyond environmental controls to also include lighting, physical access controls, energy management, and more. The business impact can extend across an entire retail infrastructure if stores share centralized BMS platforms or remote administration infrastructure. A compromise could enable attacks at scale distributed across geographic locations.
Integrators and other third-party partners requiring remote access also expose retailers to risk. Contractors are often responsible for installation and maintenance of equipment in a retail setting. Retailers must have visibility into a partner’s security posture and practices—including the deployment of legacy protocols such as KNX. Poorly configured network access or assets can quickly result in an attacker rapidly moving through an environment to steal data, drop malicious code, or cause other damage.
For retailers, the resulting risks include operational downtime, lost sales, spoiled inventory, safety incidents, regulatory complications and reputational damage. The essential point is that building automation is part of the organization's cyber-physical attack surface, not merely a facilities management concern.
How to Reduce KNX Cybersecurity Risks
To manage KNX risk in retail environments, security teams should implement the following cybersecurity controls:
Discover KNX Assets, Monitor Communications.
Retailers’ cybersecurity teams, engineers, and asset operators must maintain an up to date inventory of devices communicating over KNX. Those include IP interfaces, controllers, gateways, engineering workstations and connected BMS platforms. Identify device models, firmware versions, communication paths, ownership and business functions. Traffic collection helps identify baseline network behaviors, correlate asset data to known vulnerabilities, and maps dependencies—information crucial to the rest of the security operation.
Isolate KNX Devices from Critical Systems via Segmentation.
KNX infrastructure should not have unrestricted access to corporate networks, point-of-sale environments, warehouse systems or the internet. Segmentation is an essential control that limits an attackers’ ability to move about the network in the event of a compromise. BMS should be segmented in a controlled zone with firewall rules restricting communication between BMS and other OT assets.
Where remote monitoring or centralized management is necessary, permit only explicitly authorized connections through controlled gateways or jump hosts.
Strengthen Authentication, Configuration and Remote Access.
Assess whether devices and interfaces support KNX Secure and develop a phased plan to adopt appropriate protections where feasible. Replace default credentials, eliminate shared accounts where possible, restrict engineering tools, and use strong authentication for remote administration. Disable unnecessary services and externally accessible interfaces. Where older devices cannot support modern security features, compensate through stronger segmentation, tightly restricted access and enhanced monitoring. Test configuration changes carefully to avoid introducing operational problems.
How to Build a Security Strategy Around KNX
Conduct BMS Risk Assessments
Retail cybersecurity teams strategizing around KNX deployments should regularly conduct risk assessments of their BMS infrastructure. Rely on asset visibility and inventory management capabilities to map assets and exploitation paths in order to properly deploy compensating controls such as segmentation and secure remote access solutions.
Use Asset Inventories to Inform KNX Security Requirements
Establish security requirements for KNX deployments, relying on insights and recommendations culled from asset inventories. Those requirements should include locked-down network paths, access controls, visibility into secure configurations, continuous network monitoring, and tested recovery procedures. BMS must be part of a retail exposure management, incident response and disaster recovery planning.
Ensure Resilience through Compensating Controls
Operational resilience in a retail environment depends on comprehensive security. Preventing legacy protocols such as KNX from taking down an environment is a critical first step. Until KNX Secure can be deployed, for example, all communication paths, including those from contractors and other third parties, must have compensating controls in front of them or operate behind a secure access solution.
The priority around KNX is to learn where it resides within the connected retail environment, what an attacker could reach through it, and which physical operations depend on it. With comprehensive visibility, disciplined segmentation and stronger access controls, retailers can reduce KNX-related exposure while preserving the reliability and efficiency that building automation is intended to deliver.
