In this interview, I sit down with Maciej Oldziej, the general manager of LumenRadio, to explore the current state of wireless in the BAS space, learn what sets their technology apart, and discuss how their wireless BACnet solution is enabling faster installations, reduced cabling costs, and more flexible building environments.

Wireless adoption in BAS has historically been slow. Why do you think that’s been the case, and what’s changing now?

Reliability. Wireless is a household term, but within the BAS world, it is a term that sparks fear and uncertainty. At LumenRadio, we are educating the BAS community that there is a reliable wireless solution to meet their needs.

In my opinion, there are two primary factors driving wireless adoption for the retrofit market: limited labor force and decarbonization targets. The continued rising cost of building materials is a contributing factor.

For instance, in the education sector, approximately 79% of air handling units (AHUs) sold are for retrofit projects.

What are some of the most common misconceptions about using wireless technology in building automation systems?

It doesn’t work, or that technology hasn’t evolved. The BAS industry is slow to adapt and accept new technologies, especially considering its historical sub-par experiences with wireless.

From your perspective, what are the key advantages of wireless over traditional wired BAS installations?

Reduce Install Burden: costs and time of installation. Minimized tenant and space disruption. More predictable cost analysis. And easier troubleshooting vs. trying to find where a fault is on the wire trunk.

What types of building environments are the best candidates for wireless BAS deployments?

We are seeing success in Hotels/Resort, Schools, and Medical Office Buildings. Historical buildings like courtrooms, churches, and museums. Warehouse and Manufacturing sites are also a great contender with wide open spaces that want to limit day-to-day disruption.

How has wireless reliability and security evolved over the past five years in the BAS industry?

With the adoption of IoT and remote monitoring, the security and privacy concerns have shifted to the cloud. BACnet Secure has been part of the conversation, but the adoption has been slow. IT departments want to know everything and anything on their local networks.  

What should building owners and operators consider when deciding between wired and wireless BAS systems?

Wireless systems are more flexible. If the building owner and operator have leasable spaces that are prone to change, wireless has a distinct advantage vs. wires. If the space is actively used 24/7 or only accessible during specific hours, wireless can help offset the install burden.

How do you address concerns around interference with other wireless devices and networks in commercial buildings?

This a core value at LumenRadio; Wireless Without Worries is our motto. Our 19 patents in Wireless Networking allow us to be interference free and not interfere with other existing and future technologies.

Historically, many technologies are prone to network congestion or interference. For example, a stadium filled with people and smartphones, or an office building with BLE, WiFi, Microwaves, and other technologies contributing to the on-air congestion.

Are there any regulatory or compliance factors to keep in mind when using wireless BAS technology?

In North America, you want FCC-compliant devices. Each device should have an FCC ID in the unlicensed bands like 2.4 ghz. If using LTE/Cellular technologies, additional certifications may be required.

Another thing to look out for is data storage and data visibility implications. When considering IoT, cloud, and wireless systems is paramount to understand how the data is being used and access control to ensure operational integrity within BAS systems.

Can you give us a high-level overview of LumenRadio’s Wireless BACnet solution?

It’s rather simple! We replace cable runs between BACnet MS/TP field devices. Think of it as replacing a wired RS-485 trunk with a “wireless trunk”. The Wireless BACNet Mesh solution is a plug-and-play wireless MS/TP cable.

What sets LumenRadio’s technology apart from other wireless solutions in the BAS space?

Cognitive Coexistence! It’s our core IP innovation that enables interference free transmission without the complexity of network configuration. It enables us to work in any radio and physical environment.

How does LumenRadio’s solution maintain BACnet compliance and interoperability across different vendors?

Wireless BACnet devices cannot be BTL certified because they are not addressable nor visible in the BAS. However, we maintain interoperability across vendors by mimicking the MAC address of the BACnet field device it connects to and transmitting transparent BACnet. The BAS does not know it is wireless. We are a true wireless cable replacement!

Can you walk us through a typical deployment process using your wireless BACnet solution?

Let’s take a rooftop retrofit example where running a cable across the roof or underneath the ceiling is prohibitive. Instead of running a cable between each RTU, we will install an individual W-BACnet device at each RTU controller. Then, a W-BACnet Gateway will automatically discover all the RTUs that will be discoverable in the BAS.

How does LumenRadio’s mesh network technology work, and what benefits does it offer for BAS installations?

Wireless BACnet is a self-configuring and self-healing mesh network. Each W-BACnet node is a repeater that can directly connect to the gateway or indirectly propagate its signal. If a node loses a signal, other nodes in the network will automatically find a path to maintain connectivity. The primary benefit of using our technology is the plug-and-play nature accelerating installation by removing control cable runs from the equation. We built the solution with the installer in mind equipping them with Bluetooth app to quickly verify their installation.

What’s the typical range and scalability of a LumenRadio wireless BACnet network?

Range! It’s our #1 question. Range will depend on the environment and antennas used. Inside the building, on average, I see 50-700 feet between devices. Outdoors we can reach up to a mile line-of-sight. Our recommendation is to build wireless MS/TP networks in line with wired networks: 25-40 devices per Wireless BACnet network. And yes, you can have multiple W-BACnet networks within the same space.

How do you ensure security — both at the device and network level — with your wireless BACnet system?

Our networks are stand-alone, not Wifi, with dynamic encryption methods. Thanks to our IP, we can mitigate network jamming attacks and safeguard against replay attacks. Only devices that are commissioned on-site can join W-BACnet networks.

Can LumenRadio’s solution coexist with legacy wired BACnet systems? How does that integration work in practice?

Yes! A great example is failing Lon VAV devices. It’s common to upgrade 2-3 end-of-life Lon VAVs to BACnet VAVs without affecting existing infrastructure. As Lon VAVs continue to fail, we can add them to the existing Wireless BACnet network without affecting Lon infrastructure.

Do you have examples or case studies where your wireless BACnet solution delivered significant cost or time savings compared to traditional wired approaches?

We do! A great example is a Resort FCU retrofit where the installers saved 90% on install cost vs. running wire, and with limited impact on the business – I don’t think resort guest would enjoy the sound of drilling holes and someone being in their room!

A big thank you to Maciej for sharing his insights on the evolution of wireless in the BAS space and the innovative work LumenRadio is doing with their Wireless BACnet solution. As buildings continue to grow smarter and more connected, it’s clear that wireless will play a key role in driving both flexibility and efficiency in system design. We look forward to seeing how LumenRadio continues to shape the future of wireless BAS technology.

The post Wireless Without Worries: A Conversation with LumenRadio on the Future of BAS Connectivity appeared first on Smart Building Design.

I sat back down with Aaron Brondum, Sr. Director of Business Development at Neeve, to talk through the technical side of Zero Trust, and how Neeve is helping real-world organizations deploy it in a way that’s actually usable in the field. 

Greg Fitzpatrick, CxA, Business Development Leader, Cochrane Supply

Aaron, thanks for joining me again. Last time we covered the fundamentals of Zero Trust. Today, I want to dive into the more technical side of things. For those out there trying to figure out how to actually apply Zero Trust to an OT network, where should they be thinking about placing the solution? 
 

Aaron Brondum, Sr. Director of Business Development, Neeve

Great question, and placement is everything. In OT networks, the best place to start is at the IT/OT boundary. That’s where the biggest risk is, and it’s where Zero Trust can act as a secure gateway. Every connection trying to cross that boundary gets verified—user identity, device health, even where the traffic is coming from and going to. 

From there, we look inside the OT network and apply micro-segmentation. Instead of treating the entire OT environment as one big trusted zone, we break it into smaller ones, HVAC, lighting, elevators, each with their own access rules. That way, even if something is compromised, it can’t spread. 

Greg:

That makes sense, sort of like building a wall, then putting locks on every door inside it. But what about remote access? That’s where a lot of threats get in. How does Neeve handle that differently? 
 

Aaron: 

Exactly—and you’re right, remote access is the biggest attack vector in most smart buildings today. That’s why we don’t rely on VPNs. VPNs are a one-and-done deal: you authenticate once, and suddenly you’ve got a tunnel to the entire network. 

We use Zero Trust Network Access (ZTNA) instead. It’s more surgical. A technician accessing HVAC controllers only gets access to those, and only for a set time. Every session is authenticated and encrypted, and we can revoke access at any point. It’s dynamic, and it’s role-based. 

Greg:

That’s a huge improvement, especially when you’ve got vendors logging in from who knows where. But what about older systems—those legacy devices in OT that weren’t built with any of this in mind? 

Aaron: 

That’s probably the biggest misconception we hear: “Zero Trust won’t work because my gear is too old.” The truth is, we don’t need the devices themselves to support modern security protocols. 

Neeve secures the network layer, not the device layer. We look at the traffic moving between devices, enforce policies at the edge, and isolate anything that shouldn’t be talking. So even if a 20-year-old controller has no encryption, it can still live inside a secure, Zero Trust architecture. 

Greg: 

So it’s not about upgrading all your gear, it’s about controlling what talks to what? 

Aaron:

Exactly. We like to say: protect the flow, not the box. You don’t need to replace every sensor or controller. You just need to know what normal looks like, then put the guardrails in place to make sure it stays that way. 

Greg: 

Let’s talk monitoring. Zero Trust is all about verification—but what kind of visibility do you need to really make it work? 

Aaron:

You need full telemetry. That’s part of the power of our platform. We offer real-time monitoring of every connection and session—who connected, when, from where, and what they did. That allows us to: 

• Spot anomalies quickly, 
• Detect lateral movement attempts, 
• And adjust access policies dynamically. 

It’s especially useful in OT environments where normal behavior is pretty stable. If a lighting controller suddenly starts trying to talk to an elevator PLC? That’s a red flag. 

Greg: 

That kind of real-time insight would be huge for incident response too. Have you seen this deployed in the real world? 

Aaron:

Yeah—one great example is Kilroy Realty. They came to us with growing concerns around remote vendor access and a need to strengthen security across multiple buildings. 

We started with a risk assessment, then implemented micro-segmentation and ZTNA. Vendors only got access to the exact systems they needed, with MFA and session limits. All traffic was monitored in real time. No more open VPN tunnels. 

The result? Tighter control, better compliance, and no disruptions to building operations. 

Greg: 

That’s the sweet spot—better security, but nothing breaks. So, what are some best practices for firms trying to take this on themselves? 

Aaron: 

Here’s a simple roadmap we’ve seen work: 

1. Start with an asset and communication map. Know what’s connected and how it communicates.

2. Segment your network. Start coarse, then work toward micro-segmentation. 

3. Use role-based access and MFA. Make sure only the right people have access to the right systems. 

4. Replace VPNs with ZTNA. That alone is a major leap forward. 

5. Continuously monitor. Know what’s normal so you can spot what’s not. 

6. Roll out in phases. Don’t try to do the whole network at once. Start where the risk is highest. 

Greg: 

Last question, what do you say to the folks who still think Zero Trust is too expensive or complex? 

Aaron: 

I’d say they’re not wrong to worry, but they’re probably looking at the wrong solutions. Neeve was built specifically for OT environments, so we focus on using what’s already there. We don’t force forklift upgrades. We integrate gradually, and we secure networks that were never built to be secure. 

In most cases, we’re helping organizations improve security without increasing operational cost. That’s the power of doing it right. 

Greg:

This has been incredibly helpful, Aaron. For anyone serious about OT cybersecurity, this kind of approach isn’t just smart, it’s necessary. Zero Trust isn’t a buzzword. It’s a technical strategy that works. And with solutions like Neeve, it’s finally accessible to the people who need it. 

Aaron: 

Appreciate it, Greg. It’s always a pleasure to talk real-world security with someone who gets the OT side. Looking forward to more of these conversations, there’s a lot more ground to cover as this space continues to evolve. 

As OT networks become more connected and remote access becomes more common, a Zero Trust architecture, especially one that can be deployed without disrupting legacy systems, is becoming the new standard. With practical tools like Neeve and a phased deployment strategy, cybersecurity is no longer a barrier to smart building innovation. It’s the foundation. 

The post Part 2: Diving Deeper: The Technical Realities of Zero Trust in OT–A Conversation with Neeve  appeared first on Smart Building Design.

Some The Key Points:

• CISA’s RFI, published in the Federal Register, seeks information to enhance its Secure by Design campaign.
• Topics include integrating security early into the software development life cycle (SDLC), education, recurring vulnerabilities, AI, operational technology (OT), and addressing the economics of secure design.
• CISA emphasizes the need for diverse perspectives and feedback to strengthen its campaign.
• The President’s National Cybersecurity Strategy calls for a shift in security responsibility from customers to software manufacturers.
• Co-sealed by 18 U.S. and international agencies, CISA’s Secure by Design guidance aims to reduce cybersecurity burdens on customers.
• The RFI seeks feedback on effective security tactics in the SDLC, with a focus on smaller software manufacturers struggling to implement robust practices.
• Input is requested on examples of educational initiatives linking commercial entities, universities, and online programs to enhance security knowledge.
• CISA inquires about the costs incurred by manufacturers in developing secure-by-design products and seeks information on how vulnerabilities impact both manufacturers and customers.
• The RFI addresses customer perceptions of security and explores ways customers request secure products.
• Recurring vulnerabilities are a focal point, with CISA seeking input on barriers to elimination and changes to CVE and CWE programs.
• Threat modeling, especially in OT systems, is highlighted, seeking examples of public threat models and best practices for demonstrating robust threat modeling programs.
• CISA urges manufacturers and stakeholders to provide written comments by Feb. 20, 2024, to inform future iterations of their whitepaper and collaborative efforts with the global community.

In conclusion, the information gathered through CISA’s Request for Information (RFI) serves as a crucial resource for enhancing the cybersecurity of Operational Technology (OT) deployments. By addressing key areas such as integrating security into the software development life cycle, education, recurring vulnerabilities, and threat modeling in OT systems, the insights obtained can guide the development of more cyber-secure OT solutions.

The emphasis on diverse perspectives, feedback from manufacturers, and understanding the economic aspects of secure design contributes to a comprehensive approach. Ultimately, this initiative facilitates the creation of robust, secure-by-design OT deployments, aligning with CISA’s global campaign to reduce cybersecurity burdens on customers and foster a safer technological landscape.

Greg is currently the Business Development Leader for Building IoT and Integration for Cochrane Supply & Engineering. In 2022, Greg was was appointed to the role of Executive Director for the Real Estate Cyber Consortium (RECC), promoting “cyber harmony” through leadership and insight on best practices, policies, and procedures for real estate owners, operators, and solution providers.

The post CISA’s challenge to a major stakeholder in the “Cyber Harmony” Model- The Manufacturer appeared first on Smart Building Design.

For the past five years, I’ve traveled across the country, engaging in discussions with consulting engineers about the integration of IP technology into their smart building designs.  In most cases, I’ve found that these firms are enthusiastic about incorporating IP Technology into their strategies.

In June 2023, I authored an article for Realcomm’s Edge Magazine titled “Creating A Path To Cyber Harmony – Challenging Commercial Real Estate’s Supply Chain,” where I briefly emphasize the significance of cyber awareness for commercial real estate owners and all project stakeholders, including consulting engineers.

While IP technology holds immense potential for smart building design, its implementation introduces new challenges in terms of cybersecurity and potential risks for consulting engineers. The consulting engineering community must recognize that cybersecurity is pivotal in deploying Operational Technology (OT) during the construction process.

OT systems, such as building automation and control systems, are increasingly interconnected and susceptible to cyber threats. The recent cyberattacks to MGM & Caesars properties in Las Vegas, and to building controls manufacturers, underscore the urgency of addressing cyber risks in the construction industry.

Robust cybersecurity measures safeguard not only sensitive construction data but also the physical infrastructure. This protection prevents potential disruptions, unauthorized access, or sabotage, ensuring the safety, efficiency, and integrity of construction projects. But, as we are experiencing, these devices are limited for shielding against the growing sophistication of the costly ransomware of today’s hackers.

Concentrated threats to properties and controls manufacturers are alarming, and with SEC’s approval of new cybersecurity disclosure rules, consulting engineers must elevate their cyber awareness and comprehend how to incorporate the necessary hardware and software to address cybersecurity concerns in their designs and specifications.

Cybersecurity Expertise to Achieve “Cyber Harmony”

With over 30 years in the consulting industry my aim has always been to simplify the process of designing and specifying OT and integration, making it as clear and concise as possible. Cybersecurity is no exception.

Earlier this year I accepted the role as the Executive Director of the Real Estate Cyber Consortium (RECC), where I’m striving to foster a movement towards ‘Cyber Harmony’ across the industry.

It is important to bridge the gap between facilities and IT departments, and implementing internal OT teams. My goal is to achieve “Cyber Harmony” through increased collaboration among diverse stakeholders, promoting activities such as knowledge sharing, best practice documentation, podcasts, and other communication channels to ultimately develop best practices and standards for the industry.

My objective is to streamline the fundamental cybersecurity requirements for consulting engineers, making these principles an integral part of the designer’s drawings and specifications when creating construction documents for building systems.

In any given project, there is typically a discovery phase where the designer must ask essential questions before proceeding. Incorporating cybersecurity into your design follows a similar pattern. Here are some key points to clarify during the discovery phase to determine your cybersecurity strategy:

1. Determine whether you are deploying IP devices on the owner’s network or designing a separate OT network that supports various building technologies. If the owner manages all OT, the designer’s responsibility is to ensure data encryption, while firewalls and VPN strategy fall under the owner’s IT department.

2. If the designer is responsible for a separate OT network, they must understand how to incorporate cybersecurity into the design.

Strategy First: Planning for Cybersecurity is Paramount

When considering essential design prerequisites for cybersecurity in your OT Network, assuming the owner prefers complete separation of the OT from their IT network (air gapped), I recommend these four tips:

1. Ensure that the specified OT Network solution offers robust port security capabilities, both in software and through the ability to bind device MAC addresses. This is critical to safeguard against unauthorized access. Optigo provides an OT network solution with the necessary port security and unified management through a user-friendly interface.

2. Implement robust data encryption mechanisms for network traffic, which can be achieved through various methods, including BAS system web supervisors, dedicated gateway devices, or BACnet Secure Connect (BACnet SC) using Tridium’s Niagara. This ensures data confidentiality and protection against threats.

3. Prioritize security when facilitating remote access to the network via the internet. Specify a firewall solution and establish a secure Virtual Private Network (VPN) appliance and strategy for remote access. This multi-layered approach enhances network security.

4. Collaborate with the end user on a VPN strategy for remote access and select a secure VPN appliance. TosiBox offers a product known for its ease of deployment and security features, popular among systems integrators.

Incorporating Your Cybersecurity Strategy into Your Construction Documents

Once a cybersecurity strategy is determined for our design, the question often arises: “How do I incorporate cybersecurity into my construction documents?

As a general practice, it’s wise to include as much detail as possible on your drawings and provide further clarification in the specifications. I advocate for the use of a detailed “Systems Integration Drawing” as the foundation for conveying intent to the master systems integrator (MSI). This drawing should display the OT network layout and the hardware used in your cybersecurity strategy.

The use of this drawing allows the designer show:

• Deployment location of the supervisory software
• VPN hardware/software
• Cell Modem
• Firewall
• OT Network router
• OT Network management switch(s)
• OT Network media
• IP switch types and locations
• Gateway devices
• Server (where applicable)
• Subnetwork media
• Technology being integrated
• OT Network MDF location and installed hardware

SmartBuildingDesign.com has the resources to help you need for ensuring strong cybersecurity for any OT Network

At SmartBuildingDesing.com we have detailed Systems Integration Drawings available here: https://www.smartbuildingdesign.com/system-architecture/

Regarding specifications, I recommend using Division 25 – Integrated Automation as the section for hardware and software related to your cybersecurity strategy. Examples of Division 25 specifications are available on our Guide Specifications page.

Incorporating these measures into your OT Network design not only reduces your risk as a designer but significantly enhances your client’s cybersecurity posture, reducing vulnerabilities and ensuring the safety and integrity of their critical operations.

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Cybersecurity Awareness 2023: Achieving Cyber Harmony in a Fragmented Industry appeared first on Smart Building Design.