Understanding Cybersecurity in Smart Buildings

When we think about Smart Buildings, we immediately think about their advantages. We think of the efficiencies such connected building technology offers developers, building managers and tenants. Whether it’s about efficiency, long-term value or brand perception, stakeholders will suffer if their building is not ‘smart’. However, do we think about their cybersecurity risks?

As our buildings become more complex, with the number of IoT connected devices and cloud services growing exponentially, the threat and chance of cyberattacks becomes even greater.

So, how can we understand these challenges and prevent them from happening in the future?

Chart highlighting cybersecurity facts pertaining to smart buildings

The Challenges of Smart Buildings

Today’s buildings systems often fall short of effectively managing any potential cyber intrusion. This is a direct result of there being an obvious disconnect between groups managing information technology (IT), who have extensive cybersecurity knowledge and the groups managing building operational technology (OT), who have the building management system (BMS) operational knowledge.

Previously, BMS required specialised knowledge of systems and protocols and didn’t require access to corporate network resources or the internet. Therefore, the security of a BMS network predominantly relied on obscurity and the lack of external connectivity. However, in this day and age, the evolution of BMS technology has meant that typical BMS control systems now use a combination of OT protocols, including ModBus and BACnet, as well as IT protocols such as HTTP and FTP. This has revolutionised the way smart buildings operate but it has also affected how they can be targeted from a cyber perspective.

The evolution of BMS technology is essentially a gold mine for hackers. Coupled with the disconnect between IT groups and OT groups, the de facto operational model for buildings needs to change. In recent years there have even been hacker communities and research groups that specialise in cyberattacks targeting smart buildings to retract important data.

Ultimately, the problem starts with the network of a BMS. This network can be deemed as a way in to the wider IT network of an organisation. Hence, not only does the management system itself become the target but so does the whole company.

The solution

For those looking to update their building technology, the risk of cyber-attacks is a huge roadblock. It prevents many sectors, most notably healthcare, FS and public sector, from investing in buildings enhancements. This is a direct result of the fear of attacks, and the damage and disruption they could cause. The reality is that an attack could cost millions to an organisation.

To mitigate these attacks and realise the full potential of smart buildings, operators and occupiers need to alter how smart building control systems are architected and managed from a cybersecurity perspective. Setting aside organisational barriers and acknowledging the IT/OT disconnect is the critical first step towards implementing and operating cyber secure smart building control systems.

Luckily, there has already been strong support in the OT control systems industry to address the security challenges being faced today. Better yet, industry associations have risen to the need for common OT cybersecurity best practices, in particular with the development of the IEC 62443 global set of cybersecurity standards. This is set to improve safety, availability, integrity and confidentiality of systems used for industrial automation and control.

Fundamentally, there are four key ways that organisations can create a secure and operational smart building:

  1. Assess and protect legacy OT building control systems
  2. Choose IoT devices and vendors that follow a Secure Development Lifecycle approach
  3. Implement secure OT building control system architectures
  4. Bridge the secure OT building control systems through an IT Security Monitoring Zone

The future of building cyber security

 The vulnerability of a BMS system working with these two sets of protocols lays on the disconnect between the groups in the IT team, who have the cybersecurity knowledge and the OT team, who have the operational knowledge. The smarter your building gets and the less these two groups work with each other, the more vulnerable technology will become resulting in the increase of external cyberattacks. Teams need to work together to create a more secure system and organisations must adhere to certain practices to keep their building as secure as possible.

Learn more about Schneider Electric and cybersecurity.

The post Understanding Cybersecurity in Smart Buildings appeared first on Schneider Electric Blog.

Visit Toronto Wiring
from Schneider Electric Blog


Visit Toronto Wiring

Comments

Post a Comment

Popular posts from this blog

EFF: No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S.

No Digital Surveillance of Iranians at the U.S. Border—or Within the U.S. Only days into heightened tensions between the United States and Iran, media outlets have published disturbing reports of increased scrutiny of people of Iranian descent at U.S. borders, including in at least one case involving a traveler’s phone. EFF strongly opposes any targeting of people for digital surveillance based on their race, religion, or nationality, at our border and in our interior. And we remind all members of the public to practice surveillance self-defense. Disturbing Reports from the Border On January 5, media outlets reported that more than 60 people of Iranian descent, including U.S. citizens, were held at the border between Canada and Washington state for many hours and questioned about their perceived connections to Iran. U.S. Customs and Border Protection (CBP) denied that it detained or refused entry to Iranians based on their national origin, a claim contested by accounts f
Read more

EFF: Corporate Speech Police Are Not the Answer to Online Hate

Corporate Speech Police Are Not the Answer to Online Hate A coalition of civil rights and public interest groups issued recommendations today on policies they believe Internet intermediaries should adopt to try to address hate online. While there’s much of value in these recommendations, EFF does not and cannot support the full document. Because we deeply respect these organizations, the work they do, and the work we often do together; and because we think the discussion over how to support online expression—including ensuring that some voices aren’t drowned out by harassment or threats—is an important one, we want to explain our position. We agree that online speech is not always pretty—sometimes it’s extremely ugly and causes real world harm. The effects of this kind of speech are often disproportionately felt by communities for whom the Internet has also provided invaluable tools to organize, educate, and connect. Systemic discrimination does not disappear and can even be ampl
Read more

Living on the (IT) Edge: Schneider Electric at HPE Discover 2018

Image
We’re here at HPE Discover 2018 , proudly sponsoring the event and enjoying a jam-packed few days in Las Vegas. The data center industry has experienced tremendous disruption in the last decade. The fourth Industrial Revolution, with its IT/OT convergence, the proliferation of IoT, and insatiable demand for digital connectivity, is creating the opportunity to push the envelope of performance beyond the obvious and create new business value. And there’s no bigger opportunity right now than at the edge. At the same time, these new paradigms are also driving more complexity: companies today are trying to manage a combination of environments, from large centralized data centers on-premises or in the cloud, regional edge data centers, to local edge data centers. We have more data centers, intertwined across more locations, and with more data, than ever before. All of this adds up to promising opportunities on the horizon for our customers – but an equally daunting number of new challenges
Read more