IoT
6/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Smart' Building Industry Mulls Cybersecurity Challenges

New 'attraction and curiosity' for infosec at the Intelligent Buildings Conference this week.

A glance at the schedule for this week's IB Con conference in Silicon Valley on "intelligent buildings" makes it clear that the building industry knows cybersecurity is a topic they must address.

According to Idan Udi Edry of Nation-E, who appeared as a panelist at IB Con, the industry has evolved past a dutiful attitude towards cybersecurity, and instead displayed "an attraction and curiosity" for the topic.  

"This year there was a change," Edry says.  

The "smart" building industry -- connecting operational technology (OT) like HVAC sytems, elevators, surveillance, lighting, water, and the candy bar machine, to information technology -- is growing faster than either IT or OT pros can keep up with.

According to Navigant Research, total global revenue from the commercial building automation industry is already $70 billion, and will increase to $101 billion over the five years. The growth is expected to be particularly great in the Asia-Pacific region, where the demand for smart building technology is accelerating due to programs like the Indian government's $15 billion "Smart Cities India" program.  

The Black Hat’s CISO Summit August 2 offers executive-level insights into the technologies and issues security execs need to keep pace with the speed of business. Click to register.

One of the key components of many smart buildings is the Building Management System (BMS). A BMS system may integrate facility access controls, surveillance, HVAC, lighting, power, elevators, fire safety, etc.

Nevertheless, if a cyberattacker zeroes in on a BMS system, "The target is not necessarily the building," says Edry. 

A BMS system wouldn't necessarily need to interact with the CRM system your sportswear company is running up on the 15th floor, or the e-ticketing system the entertainment company is running on the 30th floor. However, if a denial-of-service attack on the BMS managed to take out the power for the entire building, it would cause a very bad day for all the businesses in that building. And that's just the beginning of it.

Edry's bigger concern is that OT and IT teams don't work together to spend enough time thinking about each other.

Despite all the advancements in IT technology, for example, "OT still hasn't changed," he says. "Whether you bought your generator today or 10 years ago" (or longer) "the communication protocols are the same." Everything still has a serial port, Edry says, and that creates a vulnerability that IT professionals might not think about.

It doesn't matter how much you invest in securing your IT, Edry says. If you don't also take into account the OT, you're missing something, and leaving yourself vulnerable. 

So step one to a smart building cybersecurity strategy? Edry's advice: map all the building's assets, both IT and OT alike, in one place.  

"There is always going to be a conflict between the IT and the engineering" departments. The direction must come from the top.  

Edry says that this is beginning to happen. Because regulations and cyber insurance policies are now mandating certain protections on "critical assets" -- including cyber-physical systems in smart buildings -- OT engineers are now talking to their boards of directors about cybersecurity.

"Real change," says Edry. "The strategy has changed."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdover
50%
50%
tdover,
User Rank: Apprentice
6/24/2016 | 12:54:13 PM
Smart Building Security
Your article effectively highlights the cybersecurity challenges affecting building technology.  BMS systems have been part of building technology since 1970 (see Siemens Powers570 BMS) but were silo analog systems.  The change (and threat) emerged when BMS switched to either hybrid analog/digital or all digital control systems.

Building design, construction and control is moving towards (not away) from the use of advanced and automated technology.  This movement (partially motivated by LEED standards and government regulation) increases the potential for disruption, damage or destruction of BMS systems.

An effective approach to building cybersecurity (or Critical Systems Security) utilizes methodology that can determine, to a reasonable degree of certainty, which building or process-control system, if disrupted, damaged or destroyed, would adversely impact the operation or performance of a building or structure.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.