Lars Lindkvist of Schneider Electric outlines the key steps all facility managers must take to protect the security of their building and deter cyber criminals from gaining access to sensitive data.
Major data breaches are an increasingly common occurrence, whether it is with retailers, healthcare networks, or ecommerce sites. Cyber security is a truly global issue and a costly one at that.
According to the European Cybercrime Centre, the global cost of cyber security (for victims) is about $400 billion each year, a higher cost than the global marijuana, cocaine and heroin trades combined.
Facility managers may not consider their buildings prime targets for cyber criminals, but given the increasingly connected nature of today’s intelligent building management systems (BMS), it is important to take proactive steps to protect buildings and deter cyber criminals. Clever hackers can use a BMS as an entry point to a corporation’s network and, in worst case scenarios, exploit a vulnerable BMS to gain access to highly sensitive corporate data.
To deter hackers, building managers should focus on four areas: network management, user management, password management and software management. Additionally, as part of a holistic security plan, building managers should develop a vulnerability management plan to keep the building running seamlessly and minimise risk while updating BMS and other software.
Network management
Networks are a key point of entry for many cyber criminals, so it is important to lock down the network and prevent unauthorised access.
A BMS network consists of a wide range of access points, such as the web interface, open IP ports, USB ports and network-connected building automation devices. Security measures should be taken at every turn to prevent hackers from entering the network. Unfortunately, web interfaces are difficult to secure, but basic proactive steps can be taken to mitigate risk. Companies should install a firewall and prohibit at-risk devices from connecting directly to the internet.
Hackers can also enter networks through TCP/IP (Transmission Control Protocol/Internet Protocol) ports, so administrators should disable any and all ports that are not in use. By default, devices usually have all ports open. However, depending on the size and needs of a building, not all ports may be needed. FTP (File Transfer Protocol) ports may be useful in larger installations, but, for smaller installations, they are unnecessary and thus should be closed.
Additionally, USB drives present a considerable security risk. Because of their auto-run capabilities, they can deploy malicious software when connected to a device. Hackers can distribute a ‘free’ USB drive – for example, disguising it as a gift from a customer, software partner or other trustworthy source – and infect a network through these drives. To prevent these scenarios, auto-run should always be disabled and employees should only use USB drives supplied directly from reputable vendors.
User management
In addition to external threats, BMS should be locked down internally. Taking this precaution will protect against employees accidentally opening a door to hackers and deter malevolent employees from inflicting damage on a network. As a basic step, BMS access privileges should be limited. An employee’s level of access should directly correlate to their job position and day-to-day functions. Each employee should have access levels just high enough to get their job done, but no more than that. Offering each user far-reaching access poses an unnecessary risk to the network.
In a similar vein, each user’s account should be actively updated. Auto-expire passwords should be enabled, so that users are forced to regularly change their passwords. Users who do not change their passwords within the allotted period will be locked out of their accounts, requiring a system administrator to intervene and reset the password.
System administrators should take additional measures to secure user accounts. For example, employees who shift roles should have their access privileges and authorisations adjusted accordingly; this is particularly crucial for employees who shift departments and need different access rights. In the case of departing employees, their user accounts should be disabled as soon as they cut ties with the company. This is particularly important for employees who leave the company on negative terms.
Password management
Password management is a simple, yet often overlooked security measure that should not be neglected. Leaving factory default passwords makes entire systems susceptible to hackers. Consider this: access to a building network may be as simple as knowing the type of BMS the building uses or even the model of a specific device on the network by doing a Google search for the default password, and testing it out. Changing default passwords should always be the first step when adding new devices to the network.
General password best practices apply to network passwords as well – longer passwords with a mix of lowercase, uppercase and special characters are preferable. As a general rule, passwords should be changed regularly. Also, users should avoid using the same credentials across multiple sites and platforms.
Software management
Lastly, hackers commonly exploit vulnerable software, whether it is a known vulnerability in outdated software or malware masked as legitimate software. Thankfully, securing software simply involves three proactive steps.
First, always keep software updated, so that the latest security patches are being applied. As software developers learn of exploits and security vulnerabilities, they issue patches to solve the problem and eliminate the risk – these patches play an important role in keeping hackers at bay.
Second, minimise the number of users who can install and deploy software. By lessening the number of users who can actually deploy software on a network, the risk of an employee mistakenly deploying malicious software is lessened.
Last but not least, ensure that software is authentic before installing it. Hackers can distribute modified versions of software that contain malicious programs that run silently in the background or otherwise hostile software that will compromise the network’s security. Before installing software, always confirm that it comes from a verified vendor, check the system’s security features and verify its authenticity.
BMS security: a four-pronged approach
Focusing on these four areas will increase the security of your BMS and reduce the likelihood of getting hit by hackers.
However, updating a BMS also has inherent risks, as the system will be down for brief to extended periods of time – which is why companies should develop a vulnerability management plan. This plan covers all aspects of an update: from the time it would take to install the update to the level of risk of having a temporarily inactive system. A rating system can help determine whether the vulnerability being addressed by a system update is significant enough to warrant immediate attention, or whether the update can be installed as part of a building’s regularly scheduled maintenance. This rating takes into account such factors as the impact of the update on the existing installation, the process and time needed to access and update the device(s), factors that will affect the update and any possible associated risks.
Security breaches are an increasingly common and profitable crime worldwide, and facility managers should not ignore this growing trend. By focusing on four areas and developing a vulnerability management plan, companies can deter and/or thwart hackers, protect sensitive data and keep their buildings running without interruption.
Lars Lindkvist is Schneider Electric’s operational marketing manager, EcoBuilding Division, BMS Category Management – Asia Pacific.
