Latest / NOXTalks / The Cyber Side of BAS: Are You The Weakest Link?

Transcript

The Cyber Side of BAS: Are You The Weakest Link? · NOXTalks

• 0:07
  SPEAKER_00: Welcome to Knox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
• 0:14
  SPEAKER_00: Today the discussion dives deep into the cyber side of building automation systems, asking a tough but crucial question.
• 0:21
  SPEAKER_00: Might you be the weakest link?
• 0:24
  SPEAKER_00: It's pretty amazing when considering how buildings have essentially become giant smartphones.
• 0:29
  SPEAKER_00: They're packed with sensors connected to the cloud and running software that makes critical decisions without human input.
• 0:36
  SPEAKER_00: But here's something that should keep everyone awake at night.
• 0:39
  SPEAKER_00: As buildings grow smarter, they're becoming increasingly vulnerable too.
• 0:43
  SPEAKER_00: Consider this eye-opening story.
• 0:46
  SPEAKER_00: Back in 2017, hackers managed to steal a casino's high-roller database.
• 0:51
  SPEAKER_00: Surprisingly, they didn't crack the casino's sophisticated security system.
• 0:55
  SPEAKER_00: Instead, they broke in through an internet-connected thermostat in the casino's aquarium.
• 1:00
  SPEAKER_00: Who would have imagined FISH posing a cybersecurity threat?
• 1:04
  SPEAKER_00: Fast forward to 2022, when a significant breach of Johnson control systems exposed operational technology across multiple facilities, prompting urgent warnings from the Cybersecurity and Infrastructure Security Agency.
• 1:19
  SPEAKER_00: These incidents are not isolated.
• 1:21
  SPEAKER_00: According to a Honeywell report, nearly 41% of building management systems run outdated software, creating a staggering number of potential vulnerabilities.
• 1:31
  SPEAKER_00: Now consider your own building.
• 1:33
  SPEAKER_00: If the automation system was installed or last upgraded more than five years ago, there's a risk.
• 1:40
  SPEAKER_00: Can building controls be accessed from personal devices or home networks?
• 1:44
  SPEAKER_00: Do vendors have permanent credentials that never expire?
• 1:48
  SPEAKER_00: Answering yes to any of these questions indicates a building could be an easy target.
• 1:52
  SPEAKER_00: A recent incident involving a facility manager in Atlanta highlights this vulnerability.
• 1:57
  SPEAKER_00: Multiple contractors shared a single generic login.
• 2:01
  SPEAKER_00: Eventually, a former contractor secretly altered system settings remotely, causing months of significant energy waste.
• 2:08
  SPEAKER_00: This scenario could easily occur in other buildings.
• 2:11
  SPEAKER_00: However, securing these systems doesn't mean becoming a cybersecurity expert overnight.
• 2:17
  SPEAKER_00: Here are practical steps anyone managing a building can implement today.
• 2:21
  SPEAKER_00: Begin by creating a comprehensive inventory of connected devices.
• 2:25
  SPEAKER_00: Document every device, including model, firmware version, and network connections.
• 2:31
  SPEAKER_00: This inventory becomes a critical security roadmap.
• 2:34
  SPEAKER_00: Next, segment networks.
• 2:36
  SPEAKER_00: Building systems should not unnecessarily share networks with corporate IT.
• 2:41
  SPEAKER_00: Cybersecurity expert Fred Gordy likens network segmentation to fireproof doors.
• 2:47
  SPEAKER_00: If one area is compromised, damage remains contained.
• 2:50
  SPEAKER_00: Access control is another essential step.
• 2:53
  SPEAKER_00: Require unique logins and implement multi-factor authentication.
• 2:58
  SPEAKER_00: Regularly review and update user permissions, removing any outdated or unnecessary credentials.
• 3:04
  SPEAKER_00: Prioritizing firmware updates is equally crucial.
• 3:07
  SPEAKER_00: Regularly apply security patches and test updates carefully to ensure they don't disrupt operations.
• 3:13
  SPEAKER_00: Additionally, maintain offline backups and document manual override procedures for critical systems and emergencies.
• 3:20
  SPEAKER_00: Finally, create a clear and concise cyber incident response plan.
• 3:25
  SPEAKER_00: Determine who needs to be notified, which systems must be isolated, and how operations can quickly be restored after an incident.
• 3:32
  SPEAKER_00: Beyond technology, human awareness and training are immensely important.
• 3:37
  SPEAKER_00: James McHale, CEO of Memori Research, stresses that the human element is both the greatest vulnerability and the strongest defense in cybersecurity.
• 3:47
  SPEAKER_00: Regular training sessions and simple tabletop exercises can dramatically enhance team readiness.
• 3:53
  SPEAKER_00: As building technology evolves, the distinction between facility management and IT continues to blur.
• 4:00
  SPEAKER_00: Michael Chipley, a contributor to NIST's operational technology security guidelines, emphasizes that effective cybersecurity programs depend on close collaboration between IT and facilities teams.
• 4:12
  SPEAKER_00: By working together, security measures become integral parts of upgrades and installations, not mere afterthoughts.
• 4:20
  SPEAKER_00: Ultimately, as buildings become increasingly intelligent, approaches to securing them must evolve equally fast.
• 4:27
  SPEAKER_00: It's not about if systems will face cyber threats, but about how well prepared buildings will be when they inevitably do.