Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
6/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Smart' Building Industry Mulls Cybersecurity Challenges

New 'attraction and curiosity' for infosec at the Intelligent Buildings Conference this week.

A glance at the schedule for this week's IB Con conference in Silicon Valley on "intelligent buildings" makes it clear that the building industry knows cybersecurity is a topic they must address.

According to Idan Udi Edry of Nation-E, who appeared as a panelist at IB Con, the industry has evolved past a dutiful attitude towards cybersecurity, and instead displayed "an attraction and curiosity" for the topic.  

"This year there was a change," Edry says.  

The "smart" building industry -- connecting operational technology (OT) like HVAC sytems, elevators, surveillance, lighting, water, and the candy bar machine, to information technology -- is growing faster than either IT or OT pros can keep up with.

According to Navigant Research, total global revenue from the commercial building automation industry is already $70 billion, and will increase to $101 billion over the five years. The growth is expected to be particularly great in the Asia-Pacific region, where the demand for smart building technology is accelerating due to programs like the Indian government's $15 billion "Smart Cities India" program.  

The Black Hat’s CISO Summit August 2 offers executive-level insights into the technologies and issues security execs need to keep pace with the speed of business. Click to register.

One of the key components of many smart buildings is the Building Management System (BMS). A BMS system may integrate facility access controls, surveillance, HVAC, lighting, power, elevators, fire safety, etc.

Nevertheless, if a cyberattacker zeroes in on a BMS system, "The target is not necessarily the building," says Edry. 

A BMS system wouldn't necessarily need to interact with the CRM system your sportswear company is running up on the 15th floor, or the e-ticketing system the entertainment company is running on the 30th floor. However, if a denial-of-service attack on the BMS managed to take out the power for the entire building, it would cause a very bad day for all the businesses in that building. And that's just the beginning of it.

Edry's bigger concern is that OT and IT teams don't work together to spend enough time thinking about each other.

Despite all the advancements in IT technology, for example, "OT still hasn't changed," he says. "Whether you bought your generator today or 10 years ago" (or longer) "the communication protocols are the same." Everything still has a serial port, Edry says, and that creates a vulnerability that IT professionals might not think about.

It doesn't matter how much you invest in securing your IT, Edry says. If you don't also take into account the OT, you're missing something, and leaving yourself vulnerable. 

So step one to a smart building cybersecurity strategy? Edry's advice: map all the building's assets, both IT and OT alike, in one place.  

"There is always going to be a conflict between the IT and the engineering" departments. The direction must come from the top.  

Edry says that this is beginning to happen. Because regulations and cyber insurance policies are now mandating certain protections on "critical assets" -- including cyber-physical systems in smart buildings -- OT engineers are now talking to their boards of directors about cybersecurity.

"Real change," says Edry. "The strategy has changed."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdover
50%
50%
tdover,
User Rank: Apprentice
6/24/2016 | 12:54:13 PM
Smart Building Security
Your article effectively highlights the cybersecurity challenges affecting building technology.  BMS systems have been part of building technology since 1970 (see Siemens Powers570 BMS) but were silo analog systems.  The change (and threat) emerged when BMS switched to either hybrid analog/digital or all digital control systems.

Building design, construction and control is moving towards (not away) from the use of advanced and automated technology.  This movement (partially motivated by LEED standards and government regulation) increases the potential for disruption, damage or destruction of BMS systems.

An effective approach to building cybersecurity (or Critical Systems Security) utilizes methodology that can determine, to a reasonable degree of certainty, which building or process-control system, if disrupted, damaged or destroyed, would adversely impact the operation or performance of a building or structure.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31755
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setmac allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31756
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allows attackers to execute arbitrary code on the system via a crafted post request. This occurs when input vector controlled by malicious attack get copie...
CVE-2021-31757
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setVLAN allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31758
PUBLISHED: 2021-05-07
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /goform/setportList allows attackers to execute arbitrary code on the system via a crafted post request.
CVE-2021-31458
PUBLISHED: 2021-05-07
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...