Page 25 - index

is the responsibility of executive management, who recognize
cyber attacks are a real threat to their business bottom line. This
also includes the question of ownership: Who’s in charge of
building system security? Is it facilities or is it IT?
B. Risk assessments and auditing
Once empowered, the next step is to become aware of potential
risks. This includes identifying areas of vulnerabilities and likely
targets and implementing the tools and technologies to mitigate
this risk and protect those assets, all while minimizing the impact
on the normal operations. Strict rules are counterproductive if
they are circumvented by users because they are too inconve-
nient or can’t be accommodated into normal workflows.
Once implemented, periodic auditing becomes essential to
ensure the mitigation strategies are effective and up to date.
C. Incident response plans
Response plans should be crafted for when, not if, a cyber attack
occurs. Clearly identified chains of commands and incident
reporting can drastically minimize the length and damage of a
cyber attack. If possible, drills and war games can be conducted,
in the same manner as fire drills.
Starting from the bottom–best practices
While technology is useless without the proper personnel to im-
plement it, there are a number of ways technology can improve
the security of a smart building. Security is about creating layers
of protection. While no security setup is impenetrable, improve
your security by implementing as many layers as possible to
thwart attackers:
1. Separate building systems from IT networks
Physical isolation is the easiest way to ensure outsiders cannot
gain access to assets on one system from the other. Building
systems are fundamentally different than IT networks and there
are no good reasons why they should run on the same physical
infrastructure. Logical separation is not enough, because it is too
easy for mistakes to be made as building systems scale into the
hundreds and thousands of devices. Don’t leave your company
open to vulnerabilities.
2. Use firewalls
If communication between physically separated building systems
and IT networks is required, implement firewalls at the gateways
between the two systems. Firewalls should also be placed dili-
gently around sensitive assets (i.e. servers, databases, etc.).
3. Minimize access to building systems
Minimize access between building networks to the lowest re-
quired state. This includes disabling unused ports, implementing
Access Control List (ACL) rules to limit and direct the flow of traf-
fic, and logically separating independent services. While access
control may need to ride on the same virtual local area networks
(VLANs) as security cameras, use separate VLANs for each service
where intercommunication is not required.
4. Password management
It goes without saying: always change default passwords for all
your BAS devices. Use unique and strong passwords. Use pass-
word management software, if necessary.
5. Device management
Utilize the security features of the device itself, where supported.
This may include end-to-end encryption and/or authentication
by protocols such as TLS, IPsec or IEEE 802.1X.
6. Vendor management
Limit access to your building networks; but, where required,
ensure vendors are using appropriate levels of security (such
as two-step authentication). Write your requirements into your
vendor contracts. Vendors should be more secure, not less, than
the host organization.
7. Monitor/log suspicious activity
Implement security information and event management (SIEM)
software to track incidents and events, or use other anomaly
detection tools to identify and track security threats. These tools
use behavioral analytics to identify threats and security events on
a continuous basis.
8. Continuously update your software
While fairly uncommon in the BAS space, update device firmware
when provided by the device manufacturer. This is the best way
to ensure that the devices in your building are not vulnerable to
known attacks.
Be resilient
More than ever, the threat of a cyber attack affects the deploy-
ment of technologies within a smart building. Deployed properly,
the risk of installing the latest and greatest technologies can
be minimized, along with any damages resulting. But make no
mistake—intrusions will still occur.
Cybersecurity needs to be a priority for the entire organiza-
tion. This must involve both executive management to drive
security as a corporate value and the IT team to recommend and
implement best practices. While a building will never be entirely
impenetrable, a little knowledge and some common sense goes
a long way to securing your smart building.
Pook-Ping Yao is CEO of Optigo Networks (www.optigo.
net), a company making smart buildings smarter with an
integrated networking solution for connecting the smart
building and protecting it from network anomalies. Ping is a
recognized expert in networking with years of network security
experience. He has over 12 years at PMC-Sierra in
networking design and applications.
Byron Thom is General Counsel of Optigo Networks. Byron
has delved into digital privacy and informational security issues
as a researcher for the Samuelson-Glushko Canadian Internet
Policy and Public Interest Clinic (CIPPIC) in Ottawa and
the Electronic Privacy Information Center (EPIC) in
Washington, DC.
Realcomm 23