IoT
6/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Smart' Building Industry Mulls Cybersecurity Challenges

New 'attraction and curiosity' for infosec at the Intelligent Buildings Conference this week.

A glance at the schedule for this week's IB Con conference in Silicon Valley on "intelligent buildings" makes it clear that the building industry knows cybersecurity is a topic they must address.

According to Idan Udi Edry of Nation-E, who appeared as a panelist at IB Con, the industry has evolved past a dutiful attitude towards cybersecurity, and instead displayed "an attraction and curiosity" for the topic.  

"This year there was a change," Edry says.  

The "smart" building industry -- connecting operational technology (OT) like HVAC sytems, elevators, surveillance, lighting, water, and the candy bar machine, to information technology -- is growing faster than either IT or OT pros can keep up with.

According to Navigant Research, total global revenue from the commercial building automation industry is already $70 billion, and will increase to $101 billion over the five years. The growth is expected to be particularly great in the Asia-Pacific region, where the demand for smart building technology is accelerating due to programs like the Indian government's $15 billion "Smart Cities India" program.  

The Black Hat’s CISO Summit August 2 offers executive-level insights into the technologies and issues security execs need to keep pace with the speed of business. Click to register.

One of the key components of many smart buildings is the Building Management System (BMS). A BMS system may integrate facility access controls, surveillance, HVAC, lighting, power, elevators, fire safety, etc.

Nevertheless, if a cyberattacker zeroes in on a BMS system, "The target is not necessarily the building," says Edry. 

A BMS system wouldn't necessarily need to interact with the CRM system your sportswear company is running up on the 15th floor, or the e-ticketing system the entertainment company is running on the 30th floor. However, if a denial-of-service attack on the BMS managed to take out the power for the entire building, it would cause a very bad day for all the businesses in that building. And that's just the beginning of it.

Edry's bigger concern is that OT and IT teams don't work together to spend enough time thinking about each other.

Despite all the advancements in IT technology, for example, "OT still hasn't changed," he says. "Whether you bought your generator today or 10 years ago" (or longer) "the communication protocols are the same." Everything still has a serial port, Edry says, and that creates a vulnerability that IT professionals might not think about.

It doesn't matter how much you invest in securing your IT, Edry says. If you don't also take into account the OT, you're missing something, and leaving yourself vulnerable. 

So step one to a smart building cybersecurity strategy? Edry's advice: map all the building's assets, both IT and OT alike, in one place.  

"There is always going to be a conflict between the IT and the engineering" departments. The direction must come from the top.  

Edry says that this is beginning to happen. Because regulations and cyber insurance policies are now mandating certain protections on "critical assets" -- including cyber-physical systems in smart buildings -- OT engineers are now talking to their boards of directors about cybersecurity.

"Real change," says Edry. "The strategy has changed."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdover
50%
50%
tdover,
User Rank: Apprentice
6/24/2016 | 12:54:13 PM
Smart Building Security
Your article effectively highlights the cybersecurity challenges affecting building technology.  BMS systems have been part of building technology since 1970 (see Siemens Powers570 BMS) but were silo analog systems.  The change (and threat) emerged when BMS switched to either hybrid analog/digital or all digital control systems.

Building design, construction and control is moving towards (not away) from the use of advanced and automated technology.  This movement (partially motivated by LEED standards and government regulation) increases the potential for disruption, damage or destruction of BMS systems.

An effective approach to building cybersecurity (or Critical Systems Security) utilizes methodology that can determine, to a reasonable degree of certainty, which building or process-control system, if disrupted, damaged or destroyed, would adversely impact the operation or performance of a building or structure.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.