Taking the network scenario of Figure 1, there will be web interfaces (routers and serv- ers), BACnet/IP controllers (connected to interesting devices that are network accessible), and operator workstations that may have vulnerable OS as well as configuration files and other interesting data and resources. The following table is adapted from a Drexel report on network security [Eisenstein et al., 2003a] and lists known IT threats to a BACnet network connected to the public Internet. The threats are classified into broad threat categories, and the following are provided for each: relevant methods of attack, applicable protocol, potential countermeasures. .
