Cybersecurity for Smart Buildings - Revision history

Pinfold at 17:08, July 31, 2023

2023-07-31T17:08:01Z

Pinfold at 17:06, July 31, 2023

2023-07-31T17:06:44Z

← Older revision		Revision as of 17:06, July 31, 2023
Line 4:		Line 4:
	\|authors=Colin Dunn, François Bégin		\|authors=Colin Dunn, François Bégin
	\|blueprint=Smart Buildings		\|blueprint=Smart Buildings
	\|sectors=~~Cybersecurity for~~ Smart Buildings		\|sectors=Smart Buildings
	\|summary=Cybersecurity for buildings is not just about preventing inconvenience or financial loss. It's also about protecting physical safety, personal privacy, and the overall integrity of the functions and services that buildings provide. As buildings become increasingly digitized and integrated with the Internet of Things (IoT) cybersecurity in buildings becomes crucial.		\|summary=Cybersecurity for buildings is not just about preventing inconvenience or financial loss. It's also about protecting physical safety, personal privacy, and the overall integrity of the functions and services that buildings provide. As buildings become increasingly digitized and integrated with the Internet of Things (IoT) cybersecurity in buildings becomes crucial.
	\|email=colin@fend.tech		\|email=colin@fend.tech
Line 11:		Line 11:
	}}		}}
	__NOTOC__		__NOTOC__
	==[[Benefits of cybersecurity in Smart Buildings]]==		==Benefits of cybersecurity in Smart Buildings==
	Cybersecurity in smart buildings has become increasingly important as the complexity and connectivity of building management systems (BMS) grow. These systems, which manage everything from heating and air conditioning to security cameras, are increasingly being connected to the internet for remote access and control. However, this increased connectivity also creates new vulnerabilities that can be exploited by cybercriminals.		Cybersecurity in smart buildings has become increasingly important as the complexity and connectivity of building management systems (BMS) grow. These systems, which manage everything from heating and air conditioning to security cameras, are increasingly being connected to the internet for remote access and control. However, this increased connectivity also creates new vulnerabilities that can be exploited by cybercriminals.

Jskopek at 21:06, June 14, 2023

2023-06-14T21:06:13Z

← Older revision		Revision as of 21:06, June 14, 2023
Line 83:		Line 83:
	===The cyber resilience policy===		===The cyber resilience policy===
	Cyber resilience must be integral not only to technical systems but is also essential in teams, the organizational culture and daily operations. Therefore the best practice is to start with the [https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience cyber resilience policy] https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience This is a framework that guides local government leaders and responsible departments on how to establish resilient systems that maintain essential functions and service delivery in an increasingly risky digital landscape.		Cyber resilience must be integral not only to technical systems but is also essential in teams, the organizational culture and daily operations. Therefore the best practice is to start with the [https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience cyber resilience policy] https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience This is a framework that guides local government leaders and responsible departments on how to establish resilient systems that maintain essential functions and service delivery in an increasingly risky digital landscape.
	The five policy functions are an adaptation of the five US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)[[https://www.nist.gov/cyberframework\|Cybersecurity Framework (CSF) ]] functions: identify, protect, detect, respond and recover		The five policy functions are an adaptation of the five US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)[[https://www.nist.gov/cyberframework\|Cybersecurity Framework (CSF)]] functions: identify, protect, detect, respond and recover

	===The cyber resilience assessment===		===The cyber resilience assessment===
	Conducting a thorough assessment of ones’ own property which includes the building systems, other operations focused systems and platforms, third party systems and applications, communications infrastructure may seem daunting, costly and time consuming. But, as detailed above, the cost of not doing so both for one’s own operations and those of building occupants can be significant and sometimes immeasurable.		Conducting a thorough assessment of ones’ own property which includes the building systems, other operations focused systems and platforms, third party systems and applications, communications infrastructure may seem daunting, costly and time consuming. But, as detailed above, the cost of not doing so both for one’s own operations and those of building occupants can be significant and sometimes immeasurable.

	As a first next step, SBSC invites planning teams to review the [https://gctc.opencommons.org/Blueprint_Buildings_Chapter_4 Cybersecurity and Privacy Risk Management Preparation Questionnaire & Handbook]. ~~Based~~ on the [https://www.nist.gov/cyberframework/risk-management-framework NIST Cybersecurity Risk Management Framework], it outlines core issues to watch for The Handbook portion acts as a guideline for information gathering and assessment.		As a first next step, SBSC invites planning teams to review the [https://gctc.opencommons.org/Blueprint_Buildings_Chapter_4 Cybersecurity and Privacy Risk Management Preparation Questionnaire & Handbook]. Also based on the [https://www.nist.gov/cyberframework/risk-management-framework NIST Cybersecurity Risk Management Framework], it outlines core issues to watch for The Handbook portion acts as a guideline for information gathering and assessment.

	Municipal citizens are intimately tied to and increasingly digitally connected to the buildings in which they live work and play. It is incumbent upon the public and private organizations that manage the broader built environment to be vigilant and diligent in their active pursuit of cyber protection.		Municipal citizens are intimately tied to and increasingly digitally connected to the buildings in which they live work and play. It is incumbent upon the public and private organizations that manage the broader built environment to be vigilant and diligent in their active pursuit of cyber protection.

	<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''"Investing in smart buildings is good business, but investing in cybersmart buildings—that’s great business. Without security, the truly transformative benefits of connectivity and automation are at risk. embracing cyber security means protecting your customers and your bottom line.” (Sedar Labarre, Vice President, Booz Allen Hamilton)''</span></div>		<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''"Investing in smart buildings is good business, but investing in cybersmart buildings—that’s great business. Without security, the truly transformative benefits of connectivity and automation are at risk. embracing cyber security means protecting your customers and your bottom line.” (Sedar Labarre, Vice President, Booz Allen Hamilton)''</span></div>

			==[[Examples of cybersecurity measures in smart buildings]]==
			Many smart buildings utilize comprehensive cybersecurity measures to safeguard their digital infrastructure and the data they collect. These strategies encompass various elements, from stringent access controls to encrypted data transfers, to ensure the secure functioning of smart systems.
			Here are a few examples:
			# '''Secure Communications''': All communication between devices and servers is encrypted to prevent unauthorized access or data breaches. For instance, technologies like Transport Layer Security (TLS) are commonly used for this purpose.
			# '''Firewalls and Intrusion Detection Systems (IDS)''': Smart buildings employ advanced firewalls and IDS to identify and neutralize potential threats. These can detect suspicious activities, such as multiple unsuccessful login attempts or abnormal data transfer patterns, and trigger appropriate countermeasures.
			# '''Authentication and Access Controls:''' Robust authentication mechanisms ensure only authorized users have access to the system. This could be in the form of two-factor authentication, biometrics, or advanced password policies. Furthermore, the principle of least privilege is often adopted, where users are given the minimum levels of access necessary to perform their roles.
			# '''Frequent Software Updates and Patches:''' Regular updating and patching of all software components is vital. This includes operating systems, firmware, applications, and security software, ensuring that any known vulnerabilities are quickly addressed.
			# '''Security-By-Design''': Smart building technology providers often design their products with security built-in from the ground up. This includes secure boot processes, hardware and software attestation, and secure update mechanisms, among other things.
			# '''Network Segmentation:''' By dividing the network into separate segments, it's easier to control traffic and minimize the potential impact of a cyber attack. This means that if one device is compromised, the threat can be contained and not spread to the entire network.
			# '''Anomaly Detection Systems''': These monitor the regular patterns of the network and alarm when something unusual happens, such as a sudden spike in data transfer, unusual login attempts, or changes in device behaviors.
			# '''Data Protection and Privacy Policies''': Good cybersecurity practice also involves the correct handling and storage of user data. This could involve anonymizing data, only keeping necessary data, and regularly deleting old data.
			# '''Training and Awareness Programs''': Humans are often the weakest link in cybersecurity. Regularly training staff on the importance of cybersecurity, how to identify and report potential threats, and best practices in maintaining security is key to a robust cybersecurity program.
			# '''Penetration Testing and Security Audits''': Regular security assessments can help identify potential vulnerabilities and provide an opportunity to address them before they're exploited.

			These are just some of the cybersecurity measures that can be implemented in smart buildings. The exact strategies will depend on factors such as the type of data being collected, the specific technology in use, and the risk profile of the organization
			Furthermore, the cybersecurity landscape is continuously evolving, with organizations always having to adapt to new threats. In this sense, good cybersecurity is a process of continual adjustment and improvement rather than a static goal.

	= Additional Resources: =		= Additional Resources: =

Jskopek at 20:59, June 14, 2023

2023-06-14T20:59:04Z

← Older revision		Revision as of 20:59, June 14, 2023
Line 50:		Line 50:
	The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.		The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.

	== [[Review of Practical Options]]= =		==[[Review of Practical Options]]==
	<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>		<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>

Line 59:		Line 59:
	The scale of damages in a cyber-attack can inflate significantly when open systems and converged networks are overlaid with IoT. A key attribute is the inseparable relationship of device and data brought together through aggregation in the cloud that can be compromised in the event of a cyber breach. One approach is to aggregate and encrypt data locally at the building level and not push it out to the cloud. But if the goal of deploying IoT-based systems, and “digitalizing” legacy equipment is to reduce lifecycle costs, improved asset management can only be truly achieved in an edge to cloud environment, where regular streams of integrated data drive better, more timely decisions. So, the goal should not be to stovepipe OT-derived data, but to welcome integration of these edge-based systems, while ensuring that they can’t be used as attack vectors.		The scale of damages in a cyber-attack can inflate significantly when open systems and converged networks are overlaid with IoT. A key attribute is the inseparable relationship of device and data brought together through aggregation in the cloud that can be compromised in the event of a cyber breach. One approach is to aggregate and encrypt data locally at the building level and not push it out to the cloud. But if the goal of deploying IoT-based systems, and “digitalizing” legacy equipment is to reduce lifecycle costs, improved asset management can only be truly achieved in an edge to cloud environment, where regular streams of integrated data drive better, more timely decisions. So, the goal should not be to stovepipe OT-derived data, but to welcome integration of these edge-based systems, while ensuring that they can’t be used as attack vectors.

	= Designing for the Future =		==[[Designing for the Future]]==

	As Larry O’Brien at the ARC Advisor Group puts it: ''“Assets are increasingly connected, driving the need for secure remote building monitoring and management. Owner-operators must also get a better perspective of the kinds of potential vulnerabilities that exist among their installed base of cyber and control system assets. Data flows must be planned and monitored, possibly making it necessary to use one-way data diodes”.''		As Larry O’Brien at the ARC Advisor Group puts it: ''“Assets are increasingly connected, driving the need for secure remote building monitoring and management. Owner-operators must also get a better perspective of the kinds of potential vulnerabilities that exist among their installed base of cyber and control system assets. Data flows must be planned and monitored, possibly making it necessary to use one-way data diodes”.''

Line 81:		Line 80:
	Smart building technologies offer many benefits, but also create a broader attack surface and risk due to the increased numbers of devices and connected assets. Both physical and cyber security should be at the core of any investment in smart building technology. Cybersecurity considerations and planning should be an enterprise-wide, integrated effort, involving key stakeholders, that encompasses all classes of assets connected to the internet. ICS and more broadly IoT devices are not primarily designed to be cyber-secure. Thus, they need to be integrated with security-centric technology if they are to safely deliver the promised benefits. By integrating cybersecurity considerations early in the planning stage, our connected infrastructure can best serve occupants safely and efficiently.		Smart building technologies offer many benefits, but also create a broader attack surface and risk due to the increased numbers of devices and connected assets. Both physical and cyber security should be at the core of any investment in smart building technology. Cybersecurity considerations and planning should be an enterprise-wide, integrated effort, involving key stakeholders, that encompasses all classes of assets connected to the internet. ICS and more broadly IoT devices are not primarily designed to be cyber-secure. Thus, they need to be integrated with security-centric technology if they are to safely deliver the promised benefits. By integrating cybersecurity considerations early in the planning stage, our connected infrastructure can best serve occupants safely and efficiently.

	= Next Steps… =		==[[Next Steps…]]==
			===The cyber resilience policy===
			Cyber resilience must be integral not only to technical systems but is also essential in teams, the organizational culture and daily operations. Therefore the best practice is to start with the [https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience cyber resilience policy] https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience This is a framework that guides local government leaders and responsible departments on how to establish resilient systems that maintain essential functions and service delivery in an increasingly risky digital landscape.
			The five policy functions are an adaptation of the five US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)[[https://www.nist.gov/cyberframework\|Cybersecurity Framework (CSF) ]] functions: identify, protect, detect, respond and recover

			===The cyber resilience assessment===
	Conducting a thorough assessment of ones’ own property which includes the building systems, other operations focused systems and platforms, third party systems and applications, communications infrastructure may seem daunting, costly and time consuming. But, as detailed above, the cost of not doing so both for one’s own operations and those of building occupants can be significant and sometimes immeasurable.		Conducting a thorough assessment of ones’ own property which includes the building systems, other operations focused systems and platforms, third party systems and applications, communications infrastructure may seem daunting, costly and time consuming. But, as detailed above, the cost of not doing so both for one’s own operations and those of building occupants can be significant and sometimes immeasurable.

Jskopek at 20:44, June 14, 2023

2023-06-14T20:44:46Z

← Older revision		Revision as of 20:44, June 14, 2023
Line 50:		Line 50:
	The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.		The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.

			== [[Review of Practical Options]]= =
	= Review of Practical Options =
	<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>		<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>

Jskopek at 20:43, June 14, 2023

2023-06-14T20:43:22Z

← Older revision		Revision as of 20:43, June 14, 2023
Line 11:		Line 11:
	}}		}}
	__NOTOC__		__NOTOC__
	==[[Benefits of cybersecurity in ~~smart buildings~~]]==		==[[Benefits of cybersecurity in Smart Buildings]]==
	Cybersecurity in smart buildings has become increasingly important as the complexity and connectivity of building management systems (BMS) grow. These systems, which manage everything from heating and air conditioning to security cameras, are increasingly being connected to the internet for remote access and control. However, this increased connectivity also creates new vulnerabilities that can be exploited by cybercriminals.		Cybersecurity in smart buildings has become increasingly important as the complexity and connectivity of building management systems (BMS) grow. These systems, which manage everything from heating and air conditioning to security cameras, are increasingly being connected to the internet for remote access and control. However, this increased connectivity also creates new vulnerabilities that can be exploited by cybercriminals.

Line 23:		Line 23:
	# The benefits of cybersecurity in smart buildings are multifold, affecting every aspect of a building's operation, from the protection of sensitive data to the safeguarding of critical infrastructure. As the complexity and connectivity of these systems continue to grow, the importance of cybersecurity will only increase.		# The benefits of cybersecurity in smart buildings are multifold, affecting every aspect of a building's operation, from the protection of sensitive data to the safeguarding of critical infrastructure. As the complexity and connectivity of these systems continue to grow, the importance of cybersecurity will only increase.


	==[[Overview of Cybersecurity Risks Associated with Smart Buildings]]==		==[[Overview of Cybersecurity Risks Associated with Smart Buildings]]==

Line 35:		Line 34:

	As stated by Larry O’Brien, VP of Research at ARC Advisory Group, ''“there is a drive to deploy more lower cost sensors, both wired and wireless, to gather as much data as possible. At the same time, the industry has a considerable installed base of legacy building automation systems, applications, devices, and networks that must be managed, maintained, and gradually modernized.”''		As stated by Larry O’Brien, VP of Research at ARC Advisory Group, ''“there is a drive to deploy more lower cost sensors, both wired and wireless, to gather as much data as possible. At the same time, the industry has a considerable installed base of legacy building automation systems, applications, devices, and networks that must be managed, maintained, and gradually modernized.”''

			==[[The KPIs of good cybersecurity in Smart Buildings]]==
			Key Performance Indicators (KPIs) are critical for assessing the effectiveness of any cybersecurity strategy, and this includes cybersecurity for smart buildings. While KPIs can vary based on specific organizational needs and goals, here are some KPIs that are generally relevant to measure the efficiency and effectiveness of cybersecurity in smart buildings:
			# '''Incident Response Time''': Measures the time it takes for the cybersecurity team to respond to a detected security incident. This KPI includes detection time, response time, and recovery time.
			# '''Patch Management Speed''': Measures the amount of time from when a vulnerability is identified to when it is patched. The faster vulnerabilities can be patched, the lower the chance they can be exploited.
			# '''Frequency of Security Audits and Tests''': Regular audits of the security infrastructure, processes, and practices are essential. These audits can uncover hidden vulnerabilities and allow you to assess the effectiveness of current security measures.
			# '''Incident Detection Rate''': The effectiveness of an organization's security monitoring system can be measured by how many incidents it detects. This KPI is often measured against the total number of incidents that occurred, including those that were not detected by the system.
			# '''Number of Unresolved Vulnerabilities''': This measures how many identified vulnerabilities within the system are yet to be addressed. The lower the number, the better.
			# '''Rate of False Positives''': A balance needs to be struck to ensure that the system is sensitive enough to pick up on threats, but not so sensitive that a significant number of false positives are produced. High rates of false positives can lead to alert fatigue, which may cause real threats to be overlooked.
			# '''System Uptime''': A key goal of cybersecurity is to maintain system availability. Uptime should be as high as possible, indicating that the systems are resilient and can recover quickly from attacks.
			# '''User Training and Awareness''': A human is often the weakest link in cybersecurity. Regular training for all users of the system, and measuring the effectiveness of this training (e.g., through tests and surveys) can be a vital KPI.
			# '''Compliance Score''': This refers to adherence to standards and regulations, such as ISO 27001, GDPR, or any other applicable standards. Regular checks should ensure that the organization is not breaching any regulations or guidelines.
			# '''Cost of Cybersecurity Incidents''': This includes costs related to incident response, system recovery, potential fines, and any reputational damage or lost business as a result of the incident.

			The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.


	= Review of Practical Options =		= Review of Practical Options =

Jskopek at 20:37, June 14, 2023

2023-06-14T20:37:57Z

← Older revision		Revision as of 20:37, June 14, 2023
Line 24:		Line 24:


	= Overview of Cybersecurity Risks Associated with Smart Buildings =		==[[Overview of Cybersecurity Risks Associated with Smart Buildings]]==


	The big push to adopt IoT and remote connectivity has resulted in many connected buildings with insecure remote access. Building automation systems can be a vector for cyber-attacks where potential attackers gain entry to corporate networks through HVAC systems, elevator operations, lighting, water supply, alarm systems, security devices, access systems, power supply and the list goes on. Criminals gained access to Target’s corporate information systems through inappropriate credentialing to an HVAC contractor. Russia took down the Ukrainian power grid and has infiltrated much of the US energy infrastructure. Each system and device, including its multiple versions and iterations, has its own level of cybersecurity risk. The gradual elimination of human intervention in the IoT world implies a machine-to-machine (M2M) environment where all physical systems that can interconnect and intercommunicate through an IP network can be the entry point of, or victim to, a cyber breach.		The big push to adopt IoT and remote connectivity has resulted in many connected buildings with insecure remote access. Building automation systems can be a vector for cyber-attacks where potential attackers gain entry to corporate networks through HVAC systems, elevator operations, lighting, water supply, alarm systems, security devices, access systems, power supply and the list goes on. Criminals gained access to Target’s corporate information systems through inappropriate credentialing to an HVAC contractor. Russia took down the Ukrainian power grid and has infiltrated much of the US energy infrastructure. Each system and device, including its multiple versions and iterations, has its own level of cybersecurity risk. The gradual elimination of human intervention in the IoT world implies a machine-to-machine (M2M) environment where all physical systems that can interconnect and intercommunicate through an IP network can be the entry point of, or victim to, a cyber breach.

Jskopek at 20:36, June 14, 2023

2023-06-14T20:36:19Z

@@ Line 11: / Line 11: @@
 }}
 __NOTOC__
 =  Overview of Cybersecurity Risks Associated with Smart Buildings  =

Jskopek at 20:32, June 14, 2023

2023-06-14T20:32:51Z

← Older revision		Revision as of 20:32, June 14, 2023
Line 5:		Line 5:
	\|blueprint=Smart Buildings		\|blueprint=Smart Buildings
	\|sectors=Cybersecurity for Smart Buildings		\|sectors=Cybersecurity for Smart Buildings
	\|summary=~~“The rise of the Internet of Things (IoT) and the declining costs of sensors and cloud computing are disrupting the building industry as more organizations retrofit~~ or ~~build out new smart buildings~~. ~~There are numerous benefits of smart building technology ranging from occupant comfort and~~ safety ~~to improved efficiency~~ and ~~sustainability. However,~~ the ~~proliferation~~ of ~~smart building technology increases~~ the ~~risk of a cyberattack on vulnerable endpoints~~ that ~~need to be protected~~. In most cases security has not been built in when it comes to deploying smart building point solutions, thus expanding the risk exposure. Organizations must take a security-first approach to deploying smart building technology and ~~migrate to a security fabric architecture to improve~~ the ~~organization’s security posture”. ''~~(~~IDC InfoBrief sponsored by Fortinet~~)''		\|summary=Cybersecurity for buildings is not just about preventing inconvenience or financial loss. It's also about protecting physical safety, personal privacy, and the overall integrity of the functions and services that buildings provide. As buildings become increasingly digitized and integrated with the Internet of Things (IoT) cybersecurity in buildings becomes crucial.
	\|email=colin@fend.tech		\|email=colin@fend.tech
	\|document=2020-SBSC-blueprint.pdf		\|document=2020-SBSC-blueprint.pdf

Jskopek at 20:30, June 14, 2023

2023-06-14T20:30:13Z

← Older revision		Revision as of 20:30, June 14, 2023
Line 1:		Line 1:
	~~{{Infobox project~~
	~~\|image=CybersecurityChapter.jpg~~
	~~\|imagecaption=Cybersecurity~~
	~~\|team-members=Colin Dunn, François Bégin~~
	~~\|poc=Colin Dunn~~
	~~\|location_city=everywhere~~
	~~\|status=Implemented~~
	~~\|sector=Buildings, Cybersecurity and Privacy~~
	~~\|chapter=Smart Buildings O&M~~
	~~\|summary=Overview of KPIs and Cybersecurity Risks Associated with Smart Buildings~~
	}}
	{{Chapter		{{Chapter
	\|image=CybersecurityChapter.jpg		\|image=CybersecurityChapter.jpg
	\|poc=Colin Dunn		\|poc=Colin Dunn
	\|authors=Colin Dunn, François Bégin		\|authors=Colin Dunn, François Bégin
	\|blueprint=~~Cybersecurity and Privacy~~		\|blueprint=Smart Buildings
	\|sectors=Cybersecurity ~~and Privacy~~		\|sectors=Cybersecurity for Smart Buildings
	\|summary=“The rise of the Internet of Things (IoT) and the declining costs of sensors and cloud computing are disrupting the building industry as more organizations retrofit or build out new smart buildings. There are numerous benefits of smart building technology ranging from occupant comfort and safety to improved efficiency and sustainability. However, the proliferation of smart building technology increases the risk of a cyberattack on vulnerable endpoints that need to be protected. In most cases security has not been built in when it comes to deploying smart building point solutions, thus expanding the risk exposure. Organizations must take a security-first approach to deploying smart building technology and migrate to a security fabric architecture to improve the organization’s security posture”. ''(IDC InfoBrief sponsored by Fortinet)''		\|summary=“The rise of the Internet of Things (IoT) and the declining costs of sensors and cloud computing are disrupting the building industry as more organizations retrofit or build out new smart buildings. There are numerous benefits of smart building technology ranging from occupant comfort and safety to improved efficiency and sustainability. However, the proliferation of smart building technology increases the risk of a cyberattack on vulnerable endpoints that need to be protected. In most cases security has not been built in when it comes to deploying smart building point solutions, thus expanding the risk exposure. Organizations must take a security-first approach to deploying smart building technology and migrate to a security fabric architecture to improve the organization’s security posture”. ''(IDC InfoBrief sponsored by Fortinet)''
	\|email=colin@fend.tech		\|email=colin@fend.tech
	\|document=2020-SBSC-blueprint.pdf		\|document=2020-SBSC-blueprint.pdf
	\|chapter=~~1004~~		\|chapter=Smart Buildings O&M
	}}		}}
	__NOTOC__		__NOTOC__

← Older revision		Revision as of 17:08, July 31, 2023
Line 23:		Line 23:
	# The benefits of cybersecurity in smart buildings are multifold, affecting every aspect of a building's operation, from the protection of sensitive data to the safeguarding of critical infrastructure. As the complexity and connectivity of these systems continue to grow, the importance of cybersecurity will only increase.		# The benefits of cybersecurity in smart buildings are multifold, affecting every aspect of a building's operation, from the protection of sensitive data to the safeguarding of critical infrastructure. As the complexity and connectivity of these systems continue to grow, the importance of cybersecurity will only increase.

	==[[Overview of Cybersecurity Risks Associated with Smart Buildings]]==		==Overview of Cybersecurity Risks Associated with Smart Buildings==

	The big push to adopt IoT and remote connectivity has resulted in many connected buildings with insecure remote access. Building automation systems can be a vector for cyber-attacks where potential attackers gain entry to corporate networks through HVAC systems, elevator operations, lighting, water supply, alarm systems, security devices, access systems, power supply and the list goes on. Criminals gained access to Target’s corporate information systems through inappropriate credentialing to an HVAC contractor. Russia took down the Ukrainian power grid and has infiltrated much of the US energy infrastructure. Each system and device, including its multiple versions and iterations, has its own level of cybersecurity risk. The gradual elimination of human intervention in the IoT world implies a machine-to-machine (M2M) environment where all physical systems that can interconnect and intercommunicate through an IP network can be the entry point of, or victim to, a cyber breach.		The big push to adopt IoT and remote connectivity has resulted in many connected buildings with insecure remote access. Building automation systems can be a vector for cyber-attacks where potential attackers gain entry to corporate networks through HVAC systems, elevator operations, lighting, water supply, alarm systems, security devices, access systems, power supply and the list goes on. Criminals gained access to Target’s corporate information systems through inappropriate credentialing to an HVAC contractor. Russia took down the Ukrainian power grid and has infiltrated much of the US energy infrastructure. Each system and device, including its multiple versions and iterations, has its own level of cybersecurity risk. The gradual elimination of human intervention in the IoT world implies a machine-to-machine (M2M) environment where all physical systems that can interconnect and intercommunicate through an IP network can be the entry point of, or victim to, a cyber breach.
Line 35:		Line 35:
	As stated by Larry O’Brien, VP of Research at ARC Advisory Group, ''“there is a drive to deploy more lower cost sensors, both wired and wireless, to gather as much data as possible. At the same time, the industry has a considerable installed base of legacy building automation systems, applications, devices, and networks that must be managed, maintained, and gradually modernized.”''		As stated by Larry O’Brien, VP of Research at ARC Advisory Group, ''“there is a drive to deploy more lower cost sensors, both wired and wireless, to gather as much data as possible. At the same time, the industry has a considerable installed base of legacy building automation systems, applications, devices, and networks that must be managed, maintained, and gradually modernized.”''

	==[[The KPIs of good cybersecurity in Smart Buildings]]==		==The KPIs of good cybersecurity in Smart Buildings==
	Key Performance Indicators (KPIs) are critical for assessing the effectiveness of any cybersecurity strategy, and this includes cybersecurity for smart buildings. While KPIs can vary based on specific organizational needs and goals, here are some KPIs that are generally relevant to measure the efficiency and effectiveness of cybersecurity in smart buildings:		Key Performance Indicators (KPIs) are critical for assessing the effectiveness of any cybersecurity strategy, and this includes cybersecurity for smart buildings. While KPIs can vary based on specific organizational needs and goals, here are some KPIs that are generally relevant to measure the efficiency and effectiveness of cybersecurity in smart buildings:
	# '''Incident Response Time''': Measures the time it takes for the cybersecurity team to respond to a detected security incident. This KPI includes detection time, response time, and recovery time.		# '''Incident Response Time''': Measures the time it takes for the cybersecurity team to respond to a detected security incident. This KPI includes detection time, response time, and recovery time.
Line 50:		Line 50:
	The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.		The purpose of these KPIs is to provide actionable insights. Therefore, they should be reviewed regularly and used to continuously improve the cybersecurity strategy for the smart building. Also, since each building and its use case may be different, the KPIs must be customized to meet individual organizational needs and priorities.

	==[[Review of Practical Options]]==		==Review of Practical Options==
	<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>		<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''Pervasiveness of technology, ubiquitous connectivity, and an increasingly evolving machine-to-machine (M2M) environment will continue to impact and influence how smart buildings are operated, which will raise the need for protection against cyber risks quite significantly. A delayed head start not only poses huge challenges in dealing with this complex issue but undermines the value and adequacy of initiatives that could potentially be used to ward off adversarial impacts. Irrespective of such shortfalls, however, inaction is no longer an option for the smart buildings industry. (Frost Sullivan – Cybersecurity in Smart Buildings)''</span></div>

Line 59:		Line 59:
	The scale of damages in a cyber-attack can inflate significantly when open systems and converged networks are overlaid with IoT. A key attribute is the inseparable relationship of device and data brought together through aggregation in the cloud that can be compromised in the event of a cyber breach. One approach is to aggregate and encrypt data locally at the building level and not push it out to the cloud. But if the goal of deploying IoT-based systems, and “digitalizing” legacy equipment is to reduce lifecycle costs, improved asset management can only be truly achieved in an edge to cloud environment, where regular streams of integrated data drive better, more timely decisions. So, the goal should not be to stovepipe OT-derived data, but to welcome integration of these edge-based systems, while ensuring that they can’t be used as attack vectors.		The scale of damages in a cyber-attack can inflate significantly when open systems and converged networks are overlaid with IoT. A key attribute is the inseparable relationship of device and data brought together through aggregation in the cloud that can be compromised in the event of a cyber breach. One approach is to aggregate and encrypt data locally at the building level and not push it out to the cloud. But if the goal of deploying IoT-based systems, and “digitalizing” legacy equipment is to reduce lifecycle costs, improved asset management can only be truly achieved in an edge to cloud environment, where regular streams of integrated data drive better, more timely decisions. So, the goal should not be to stovepipe OT-derived data, but to welcome integration of these edge-based systems, while ensuring that they can’t be used as attack vectors.

	==[[Designing for the Future]]==		==Designing for the Future==
	As Larry O’Brien at the ARC Advisor Group puts it: ''“Assets are increasingly connected, driving the need for secure remote building monitoring and management. Owner-operators must also get a better perspective of the kinds of potential vulnerabilities that exist among their installed base of cyber and control system assets. Data flows must be planned and monitored, possibly making it necessary to use one-way data diodes”.''		As Larry O’Brien at the ARC Advisor Group puts it: ''“Assets are increasingly connected, driving the need for secure remote building monitoring and management. Owner-operators must also get a better perspective of the kinds of potential vulnerabilities that exist among their installed base of cyber and control system assets. Data flows must be planned and monitored, possibly making it necessary to use one-way data diodes”.''

Line 80:		Line 80:
	Smart building technologies offer many benefits, but also create a broader attack surface and risk due to the increased numbers of devices and connected assets. Both physical and cyber security should be at the core of any investment in smart building technology. Cybersecurity considerations and planning should be an enterprise-wide, integrated effort, involving key stakeholders, that encompasses all classes of assets connected to the internet. ICS and more broadly IoT devices are not primarily designed to be cyber-secure. Thus, they need to be integrated with security-centric technology if they are to safely deliver the promised benefits. By integrating cybersecurity considerations early in the planning stage, our connected infrastructure can best serve occupants safely and efficiently.		Smart building technologies offer many benefits, but also create a broader attack surface and risk due to the increased numbers of devices and connected assets. Both physical and cyber security should be at the core of any investment in smart building technology. Cybersecurity considerations and planning should be an enterprise-wide, integrated effort, involving key stakeholders, that encompasses all classes of assets connected to the internet. ICS and more broadly IoT devices are not primarily designed to be cyber-secure. Thus, they need to be integrated with security-centric technology if they are to safely deliver the promised benefits. By integrating cybersecurity considerations early in the planning stage, our connected infrastructure can best serve occupants safely and efficiently.

	==[[Next Steps…]]==		==Next Steps…==
	===The cyber resilience policy===		===The cyber resilience policy===
	Cyber resilience must be integral not only to technical systems but is also essential in teams, the organizational culture and daily operations. Therefore the best practice is to start with the [https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience cyber resilience policy] https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience This is a framework that guides local government leaders and responsible departments on how to establish resilient systems that maintain essential functions and service delivery in an increasingly risky digital landscape.		Cyber resilience must be integral not only to technical systems but is also essential in teams, the organizational culture and daily operations. Therefore the best practice is to start with the [https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience cyber resilience policy] https://www.weforum.org/whitepapers/the-cyber-resilience-index-advancing-organizational-cyber-resilience This is a framework that guides local government leaders and responsible departments on how to establish resilient systems that maintain essential functions and service delivery in an increasingly risky digital landscape.
Line 94:		Line 94:
	<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''"Investing in smart buildings is good business, but investing in cybersmart buildings—that’s great business. Without security, the truly transformative benefits of connectivity and automation are at risk. embracing cyber security means protecting your customers and your bottom line.” (Sedar Labarre, Vice President, Booz Allen Hamilton)''</span></div>		<div style="text-align:center;margin-left:0.6in;margin-right:0.6in;"><span style="color:#404040;">''"Investing in smart buildings is good business, but investing in cybersmart buildings—that’s great business. Without security, the truly transformative benefits of connectivity and automation are at risk. embracing cyber security means protecting your customers and your bottom line.” (Sedar Labarre, Vice President, Booz Allen Hamilton)''</span></div>

	==[[Examples of cybersecurity measures in smart buildings]]==		==Examples of cybersecurity measures in smart buildings==
	Many smart buildings utilize comprehensive cybersecurity measures to safeguard their digital infrastructure and the data they collect. These strategies encompass various elements, from stringent access controls to encrypted data transfers, to ensure the secure functioning of smart systems.		Many smart buildings utilize comprehensive cybersecurity measures to safeguard their digital infrastructure and the data they collect. These strategies encompass various elements, from stringent access controls to encrypted data transfers, to ensure the secure functioning of smart systems.
	Here are a few examples:		Here are a few examples: