A fundamental challenge to securing smart buildings, or any building large enough to have a building automation system, is how to protect devices so that they reject cyber attacks in real-time. Rejecting a cyber attack in real-time is different than reporting on a traffic anomaly in that it stops an attack from happening.

Monitoring and alerting from anomaly is useful, but is only capable of informing about a potential false alarm or after an intrusion has occurred. Device-level protection, using a NIST Zero Trust framework, uses mutual authentication, a secure tunnel and encrypted communications to secure the device.