Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
6/23/2016
06:00 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

'Smart' Building Industry Mulls Cybersecurity Challenges

New 'attraction and curiosity' for infosec at the Intelligent Buildings Conference this week.

A glance at the schedule for this week's IB Con conference in Silicon Valley on "intelligent buildings" makes it clear that the building industry knows cybersecurity is a topic they must address.

According to Idan Udi Edry of Nation-E, who appeared as a panelist at IB Con, the industry has evolved past a dutiful attitude towards cybersecurity, and instead displayed "an attraction and curiosity" for the topic.  

"This year there was a change," Edry says.  

The "smart" building industry -- connecting operational technology (OT) like HVAC sytems, elevators, surveillance, lighting, water, and the candy bar machine, to information technology -- is growing faster than either IT or OT pros can keep up with.

According to Navigant Research, total global revenue from the commercial building automation industry is already $70 billion, and will increase to $101 billion over the five years. The growth is expected to be particularly great in the Asia-Pacific region, where the demand for smart building technology is accelerating due to programs like the Indian government's $15 billion "Smart Cities India" program.  

The Black Hat’s CISO Summit August 2 offers executive-level insights into the technologies and issues security execs need to keep pace with the speed of business. Click to register.

One of the key components of many smart buildings is the Building Management System (BMS). A BMS system may integrate facility access controls, surveillance, HVAC, lighting, power, elevators, fire safety, etc.

Nevertheless, if a cyberattacker zeroes in on a BMS system, "The target is not necessarily the building," says Edry. 

A BMS system wouldn't necessarily need to interact with the CRM system your sportswear company is running up on the 15th floor, or the e-ticketing system the entertainment company is running on the 30th floor. However, if a denial-of-service attack on the BMS managed to take out the power for the entire building, it would cause a very bad day for all the businesses in that building. And that's just the beginning of it.

Edry's bigger concern is that OT and IT teams don't work together to spend enough time thinking about each other.

Despite all the advancements in IT technology, for example, "OT still hasn't changed," he says. "Whether you bought your generator today or 10 years ago" (or longer) "the communication protocols are the same." Everything still has a serial port, Edry says, and that creates a vulnerability that IT professionals might not think about.

It doesn't matter how much you invest in securing your IT, Edry says. If you don't also take into account the OT, you're missing something, and leaving yourself vulnerable. 

So step one to a smart building cybersecurity strategy? Edry's advice: map all the building's assets, both IT and OT alike, in one place.  

"There is always going to be a conflict between the IT and the engineering" departments. The direction must come from the top.  

Edry says that this is beginning to happen. Because regulations and cyber insurance policies are now mandating certain protections on "critical assets" -- including cyber-physical systems in smart buildings -- OT engineers are now talking to their boards of directors about cybersecurity.

"Real change," says Edry. "The strategy has changed."

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdover
50%
50%
tdover,
User Rank: Apprentice
6/24/2016 | 12:54:13 PM
Smart Building Security
Your article effectively highlights the cybersecurity challenges affecting building technology.  BMS systems have been part of building technology since 1970 (see Siemens Powers570 BMS) but were silo analog systems.  The change (and threat) emerged when BMS switched to either hybrid analog/digital or all digital control systems.

Building design, construction and control is moving towards (not away) from the use of advanced and automated technology.  This movement (partially motivated by LEED standards and government regulation) increases the potential for disruption, damage or destruction of BMS systems.

An effective approach to building cybersecurity (or Critical Systems Security) utilizes methodology that can determine, to a reasonable degree of certainty, which building or process-control system, if disrupted, damaged or destroyed, would adversely impact the operation or performance of a building or structure.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9074
PUBLISHED: 2020-06-05
Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. A component cannot deal with an exception correctly. Attackers can exploit this vulnerability by sending malformed message. This could compromise normal service of affected phones...
CVE-2020-9859
PUBLISHED: 2020-06-05
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5 Supplemental Update, tvOS 13.4.6, watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.
CVE-2020-11975
PUBLISHED: 2020-06-05
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
CVE-2020-12723
PUBLISHED: 2020-06-05
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
CVE-2020-1883
PUBLISHED: 2020-06-05
Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal.