Security for Building Automation Can Take A Page from Industrial Practices

Overview

With advances in various technologies, building automation systems have become both more capable and sophisticated.  With the recent emphasis on “smart buildings,” part of the broader theme of smart infrastructure, this trend will continue and is even likely to accelerate.  Broadly available technologies in areas such as control and networking have become common, and various elements of building infrastructure (e.g., HVAC, lighting, etc.) are increasingly integrated.  Capabilities such as remote monitoring and control have become commonplace as facility managers have looked to improve effectiveness and productivity.

These and other themes should sound familiar to those of us who work with industrial control systems (ICS).  They are identical to the developments and trends that we have been dealing with for years, as industrial systems have been transformed to use commercial technology and provide increased internal and external integration.

For this reason, those providing, configuring and operating building management systems can expect to encounter similar challenges when trying to secure their systems.  In fact, common operating systems and other systems software, combined with increased network connectivity, presents building systems to a much wider potential audience, making them more vulnerable to probing and possible attack.

The lessons learned and practices developed for industrial control system cybersecurity can provide a valuable starting point for securing building management and control systems.

The Emergence of "Smart" Buildings

Technical advances in information and communications technology are gaining more attention for a variety of infrastructure-related applications.  Judging from typical press and analyst coverage, everything today is, or will soon be “smart.” We hear of smart buildings, smart cities, and all manner of smart infrastructure.

Historically, infrastructure and associated systems have garnered little attention beyond the immediate community of engineers and others who specify, design, implement, and operate them.  Concerns about the potential vulnerability of this infrastructure have focused almost exclusively on natural disasters, fire, or – more recently - physical attacks.

This situation has changed rather significantly in recent years, as more of the infrastructure has been connected to networks and controlled and operated using automated systems.

What Is a "Smart Building"?

The term Smart Building generally refers to any structure that uses automated processes to control the building’s operations, including heating, ventilation, air conditioning, lighting, security, and other systems.  Such buildings use sensors, actuators and associated computer systems to collect and manage information associated with essential functions and services.  Automation allows owners, operators and facility managers to improve asset reliability and performance, optimize energy use, and manage how space is used.

The adjective “smart” has been applied to all sorts of facilities, including apartment and office buildings, health care centers, hospitals, educational institutions, auditoriums and stadiums.  Estimates of the size of the smart building technology market in 2014-2016 have ranged from $4.7 billion to $7.0 billion, growing to as much as $36 billion by 2020.

Regardless of the size of the market, some trends can’t be questioned.  Building automation systems are becoming more integrated as technology and capabilities evolve and improve.  With this integration comes an increase in the use of commercial-off-the-shelf (COTS) technology.  Some of these systems and components come with specific limitations, particularly in areas such as cybersecurity.

Requirements and Expectations

As more automation is applied to buildings and associated infrastructure, owners and other stakeholders commonly state several requirements and expectations.  Specific examples include:

• Operational control – First, and perhaps most fundamental, is the requirement for operational control of the facility.  This typically takes the form of one or more panels, operator displays, or other devices that monitor current conditions and take appropriate action in response to unusual situations.
• Remote access – As with other types of equipment control, there is often a desire or a firm requirement to perform such tasks from locations that may be physically separated from the equipment under control.
• High availability – As with other types of automation, availability is extremely important.  These systems must be able to operate properly over long periods of time, without interruption.
• Management of change – Changes to configurations, settings and even equipment components are inevitable over the course of the system life cycle, which for buildings may be measured in decades.  It is essential to have the capability to track these changes for record keeping and planning.

Other Characteristics

Several other important characteristics of the building automation systems market must also be considered:

• Cross-sector implications – Buildings and other structures are essential elements of infrastructure in virtually all industry sectors, so most of the requirements, expectations and potential concerns associated with building automation systems are, by definition, not industry specific.  Thus, solutions employed to address requirements and expectations have a broad range of application.
• Common suppliers – As with most specialized markets, there is a comparatively small number of common suppliers, providing varying degrees of integration.  Multi-supplier installations are common.
• Standards, practices, and regulations – The building automation sector benefits from a rich body of practices and standards from organizations such as the Continental Automated Buildings Association (CABA) and American Society of Heating, Refrigerating and Air-Conditioning Engineers (ASHRAE).  These in turn address applicable regulations where required.

Opportunities and Challenges

Undoubtedly, new and evolving opportunities will continue to make buildings smarter.  Monitoring and simple control of various building functions will give way to much more advanced methods, allowing the building infrastructure to monitor; predict; and react to conditions related to weather, energy cost, and changing use.  Tenant needs will drive improvements related to convenience and how they use the facility.

Addressing these and other opportunities will require the use of more sophisticated information and automation technology, with connections to many related internal and external systems and data sources.

Unfortunately, advances in technology and capability will come with corresponding changes in each of the generally accepted components of risk (i.e., threat, vulnerability, and consequence).

We can expect to see the nature of threats change as the profile of highly automated or smart buildings increase.  This may be the result of connecting buildings to public networks, making their systems discoverable by search tools such as Shodan.  It could also happen simply because of increased awareness of the potential for disruption or compromise.  The motivation of potential attackers changes as they see opportunities for gain through the use of methods such as ransomware.  In extreme cases, threat actors may seek to do physical harm to buildings and their occupants.

Vulnerabilities in the systems and technology employed in smart buildings also continue to evolve.  As technology is adopted and adapted from other sources and sectors, the associated vulnerabilities must also be addressed.  Different methods may be required for systems embedded in building infrastructure.  Moreover, the level of public scrutiny may be much higher than is typically the case in other sectors.

Increased awareness of vulnerabilities is inevitable, simply because potential consequences can affect a much larger group of people.  While interruptions to transportation systems may not be an immediate concern for those not using them, and upsets in process plants are only of concern for those in the immediate vicinity; consequences related to smart buildings can affect virtually anyone.   System failures in smart buildings also present different, or even unique scenarios that must be anticipated and modeled.

Sound Familiar?

The above summary should sound familiar to those who have long been dealing with ensuring the reliability, availability and integrity of processes using industrial automation systems.  The response in this area has broadened from anticipating and mitigating equipment failures, design flaws and improper behavior on the part of operation, to include preventing or mitigating deliberate attack via networks and computer systems.

Building automation systems share many of the common characteristics found in process or manufacturing automation.  Specific examples include:

• Design focused on function – All automation systems are designed and configured on the basis of the primary function to be performed (i.e., safe and reliable operation), with considerations such as ease of use often getting less attention.
• Obscure protocols – Internal communications between system components often use protocols that are either proprietary, or are seldom used in other applications.
• Disparate devices – Automation systems are typically assembled from devices and components that have been acquired over time, from a variety of sources.
• Physical impact – These systems are directly connected to elements of the physical infrastructure.  As a consequence, malfunctions or compromises can damage or compromise physical components (pumps, valves, etc.).
• Connection to safety – The connections to physical systems often means that safe operations can be compromised by system failure or compromise.

Implications and Potential Response

If we accept the statement that building automation systems are very similar to those used in manufacturing and process sectors, then we have to accept that threats, vulnerabilities, and many of the potential implications of failure or compromise will also be similar.  For this reason, the basic approach to securing building automation systems can be adapted from that used in industrial systems’ security.  Most of the elements of this approach have been examined and described extensively in accepted standards and practices.

Essential Elements

The details of the approach taken will no doubt vary somewhat in each circumstance, but many reference sources describe the basic steps in an effective response.  One popular example is the NIST Cybersecurity Framework.  Regardless of the details of the method or approach chosen, several essential must be included:

• Identification and assessment – It should be obvious that a system that is not fully characterized cannot be secured.  For this reason, the first step must be to assemble a detailed inventory of all system components and how they interact.  This becomes the basis for a general assessment of the current state with regard to technology levels, versions, and capability.
• Threat assessment – Once the system has been effectively characterized, the next step is to assess potential threats.  While the theoretical range of threats may be vast, the list can sometimes be reduced by eliminating those that do not apply to the specific systems and components installed.  In addition to the nature of the threat, it is also essential to identify and evaluate threat sources, both internal and external.
• Roles and responsibilities – An effective and sustainable response also requires a thorough understanding of the roles, responsibilities, and capabilities of various stakeholders (such as building owners, tenants, building or industrial control system vendors, IT personnel, and third-party security vendors).
• Audits and assessments – To maintain the effectiveness of the response over time it is also essential to conduct routine audits of hardware, software, and processes to identify any deficiencies or needs for improvement.

Drawing on ICS Standards and Practices

Fortunately, the industrial control systems community has developed standards and practices that address each of these elements in considerable detail.  Standards development organizations have recognized that their products may have a broader range of application, and have been considering how to adapt them to the building automation systems environment.

The ISA99 committee of the International Society of Automation (ISA) and the ISA Security Compliance Institute (ISCI) have discussed this opportunity with both CABA and ASHRAE.  Although there have been no commitments at this time, such an adaptation could be very effective in promoting the need for improved security and accelerating the required response.

There are precedents for this type of collaboration.  Both the rail transportation and medical device sectors have seen some success in applying the general standards to develop sector-specific recommended practices.

It is important for asset owners to work with industry associations and suppliers to explore the potential benefits.  Many suppliers provide systems and solutions for both industrial and building automation, and could realize additional benefits from integrating such systems.  For those suppliers that may not be as familiar with available standards, it is important to help them understand the potential.  Drawing on needs and imperatives from building and industrial automation will almost certainly result in improved products and solutions for both constituencies.  In addition, many of the recommended practices based on established standards are also likely to be applicable to both environments.

Recommendations

Many of the needs and constraints related to securing building and industrial automation systems are similar, if not identical.  The progress made in developing standards and practices for industrial systems can be easily applied to building automation, but this will require encouragement and support from asset owners and technical experts.  A coordinated response by all stakeholders can lead to benefits for all concerned.

Based on ARC research and analysis, we recommend the following actions for asset owners and other technology users:

• Learn about industry standards – Asset owners should learn more about available standards, to determine the extent to which they apply to building automation.  This can be accomplished by participating in standards committees, or by researching relevant case studies.
• Engage with industry organizations – Organizations such as ASHRAE and CABA are already considering how they might be able to apply available standards.  Contributing to these efforts can lead to better conclusions.
• Challenge suppliers – Asset owners should challenge their suppliers to demonstrate that their products and solutions conform to accepted standards and practices.
• Share experiences – Case studies and use cases can be particularly valuable in describing the most effective response.  Unfortunately, not enough of these are available.  Asset owners who have had a successful result should consider describing their experiences and sharing them with others.

 

If you would like to buy this report or obtain information about how to become a client, please  Contact Us

Keywords: Automation, Cybersecurity, Infrastructure, Smart Buildings, ARC Advisory Group.