IoT
6/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Smart' Building Industry Mulls Cybersecurity Challenges

New 'attraction and curiosity' for infosec at the Intelligent Buildings Conference this week.

A glance at the schedule for this week's IB Con conference in Silicon Valley on "intelligent buildings" makes it clear that the building industry knows cybersecurity is a topic they must address.

According to Idan Udi Edry of Nation-E, who appeared as a panelist at IB Con, the industry has evolved past a dutiful attitude towards cybersecurity, and instead displayed "an attraction and curiosity" for the topic.  

"This year there was a change," Edry says.  

The "smart" building industry -- connecting operational technology (OT) like HVAC sytems, elevators, surveillance, lighting, water, and the candy bar machine, to information technology -- is growing faster than either IT or OT pros can keep up with.

According to Navigant Research, total global revenue from the commercial building automation industry is already $70 billion, and will increase to $101 billion over the five years. The growth is expected to be particularly great in the Asia-Pacific region, where the demand for smart building technology is accelerating due to programs like the Indian government's $15 billion "Smart Cities India" program.  

The Black Hat’s CISO Summit August 2 offers executive-level insights into the technologies and issues security execs need to keep pace with the speed of business. Click to register.

One of the key components of many smart buildings is the Building Management System (BMS). A BMS system may integrate facility access controls, surveillance, HVAC, lighting, power, elevators, fire safety, etc.

Nevertheless, if a cyberattacker zeroes in on a BMS system, "The target is not necessarily the building," says Edry. 

A BMS system wouldn't necessarily need to interact with the CRM system your sportswear company is running up on the 15th floor, or the e-ticketing system the entertainment company is running on the 30th floor. However, if a denial-of-service attack on the BMS managed to take out the power for the entire building, it would cause a very bad day for all the businesses in that building. And that's just the beginning of it.

Edry's bigger concern is that OT and IT teams don't work together to spend enough time thinking about each other.

Despite all the advancements in IT technology, for example, "OT still hasn't changed," he says. "Whether you bought your generator today or 10 years ago" (or longer) "the communication protocols are the same." Everything still has a serial port, Edry says, and that creates a vulnerability that IT professionals might not think about.

It doesn't matter how much you invest in securing your IT, Edry says. If you don't also take into account the OT, you're missing something, and leaving yourself vulnerable. 

So step one to a smart building cybersecurity strategy? Edry's advice: map all the building's assets, both IT and OT alike, in one place.  

"There is always going to be a conflict between the IT and the engineering" departments. The direction must come from the top.  

Edry says that this is beginning to happen. Because regulations and cyber insurance policies are now mandating certain protections on "critical assets" -- including cyber-physical systems in smart buildings -- OT engineers are now talking to their boards of directors about cybersecurity.

"Real change," says Edry. "The strategy has changed."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdover
50%
50%
tdover,
User Rank: Apprentice
6/24/2016 | 12:54:13 PM
Smart Building Security
Your article effectively highlights the cybersecurity challenges affecting building technology.  BMS systems have been part of building technology since 1970 (see Siemens Powers570 BMS) but were silo analog systems.  The change (and threat) emerged when BMS switched to either hybrid analog/digital or all digital control systems.

Building design, construction and control is moving towards (not away) from the use of advanced and automated technology.  This movement (partially motivated by LEED standards and government regulation) increases the potential for disruption, damage or destruction of BMS systems.

An effective approach to building cybersecurity (or Critical Systems Security) utilizes methodology that can determine, to a reasonable degree of certainty, which building or process-control system, if disrupted, damaged or destroyed, would adversely impact the operation or performance of a building or structure.
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVE-2018-12561
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVE-2018-12562
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).