Building operations and access routes

A modern control system often needs to be accessible remotely. Maintenance technicians want to check alarms without visiting the site, suppliers want to troubleshoot, and building owners want to monitor energy use. Each connection provides a route in. If that route leads directly from the internet to the control system, with no protection in between, simply finding the address may be enough to read or change operating settings, such as setpoints, operating hours or alarm thresholds. Sweden’s National Cyber Security Centre also points out that usernames and passwords are not enough, even for systems where the consequences may seem limited.

Remote monitoring and optimisation require a connection. It can be designed so that the control system does not need to be directly accessible from the internet. When Sally R connects a building, we primarily use the existing system’s capabilities for secure communication. Where needed, we add our own gateway, which initiates an encrypted connection to our cloud service without opening up inbound access from the internet to the control system. This allows us to monitor and optimise building operations remotely.

Two ways to connect a control system. Unsafe and not recommended: the control system is reachable directly from the internet. Secure and recommended: a connection initiated from inside, where traffic goes out from the building to the Sally R cloud service using a secure protocol with encrypted traffic, through the control system’s own function or a gateway, with no inbound opening

Start with an overview

Connecting to a new service is only part of the picture. A building may also have older remote connections, integrations between old and new systems, and access for suppliers whose involvement has ended. To know what needs to change, you first need to know which access routes exist.

An inventory therefore begins with a few simple questions for each building. Which control systems are in place, and how can they be accessed from outside? Who has access today, and who is responsible for closing a connection when a contract ends? Who checks that the necessary actions are actually carried out? Across a larger portfolio with many suppliers, these questions can be difficult to answer immediately, which is precisely why an overview is worth having.

Wondering how to approach the control systems in your buildings? Get in touch at contact@sally-r.com, and we’ll be happy to help.

Source: SVT, “Critical control systems exposed on the internet” (in Swedish), 12 October 2026.