Latest / NOXTalks / A Practical Guide to BAS Cybersecurity Tabletop Exercises

Transcript

A Practical Guide to BAS Cybersecurity Tabletop Exercises · NOXTalks

• 0:07
  SPEAKER_01: Welcome to Knox Talks, the AI-generated podcast exploring the groundbreaking ways technology shapes our built environment.
• 0:14
  SPEAKER_01: Today we're diving into a topic that might sound like something straight out of a techno thriller: cyber war games for your building automation system.
• 0:22
  SPEAKER_01: Picture this: lights flicker, HVAC fans wind down, alarms chirp, and everything that keeps a modern facility humming suddenly stops.
• 0:32
  SPEAKER_01: It's not just uncomfortable, it can wreck perishable stock, violate safety regulations, and cost a fortune.
• 0:39
  SPEAKER_01: The scary part?
• 0:40
  SPEAKER_01: The threat landscape is expanding every month.
• 0:43
  SPEAKER_01: In April alone, the U.S.
• 0:45
  SPEAKER_01: cyber agency SISA published 15 advisories for industrial control products, and one patch Tuesday from Siemens patched nearly a hundred separate CBEs.
• 0:56
  SPEAKER_01: That's a fire hose of risk aimed directly at the equipment we rely on every day.
• 1:00
  SPEAKER_01: Smart facility teams aren't holding their breath, they're running tabletop war games to battle test their response plans before a real attacker forces the issue.
• 1:10
  SPEAKER_01: Think of a tabletop like a disaster drill, but without the smoke machines.
• 1:15
  SPEAKER_01: The team gathers in a room, a facilitator drops an attack scenario, and the clock starts ticking.
• 1:21
  SPEAKER_01: Everyone talks through who does what, where information flows, and how long it really takes to isolate a rogue backnet segment or spin an air handling unit back up manually.
• 1:32
  SPEAKER_01: Done right, these exercises pay off in two big ways.
• 1:36
  SPEAKER_01: First, they map hidden dependencies, like the Windows 7 laptop hiding in a pump room that nobody remembered until it blew screens during the drill.
• 1:45
  SPEAKER_01: Second, they expose the handoffs between OT and IT.
• 1:49
  SPEAKER_01: Cyber incidents couldn't care less about org charts, so your engineers and security analysts have to practice sharing the same playbook.
• 1:58
  SPEAKER_01: So how do we set one up?
• 1:59
  SPEAKER_01: Block out four to six weeks beforehand.
• 2:03
  SPEAKER_01: Start with crystal clear objectives, restore chilled water service within an hour, for example, beats the pants off, improve security, then assemble the right mix, operations, IT security, vendors, maybe even the property manager who signs the overtime slips.
• 2:20
  SPEAKER_01: Map your critical assets with an up-to-date network sketch, warts and all, including those temporary VPNs that somehow became permanent.
• 2:29
  SPEAKER_01: Next comes a scenario pack called the inject list.
• 2:33
  SPEAKER_01: You'll want three tiers of difficulty so the facilitator can twist the dial mid-game.
• 2:38
  SPEAKER_01: Maybe level one is a basic malware alert.
• 2:40
  SPEAKER_01: Level two adds a compromised vendor VPN.
• 2:43
  SPEAKER_01: Level three drops a zero-day exploit in a major controller.
• 2:47
  SPEAKER_01: Each inject should force a concrete decision.
• 2:51
  SPEAKER_01: Pull the plug, fail over, notify tenants, you name it.
• 2:55
  SPEAKER_01: On game day, the facilitator sets ground rules, no touching live networks, and a real-time clock keeps everyone honest.
• 3:03
  SPEAKER_01: Over 90 minutes, injects unfold.
• 3:06
  SPEAKER_01: Strange modbus commands hit your VSDs, the BMS workstation flashes a ransomware notice, and the local news desk starts phishing for a quote.
• 3:15
  SPEAKER_01: A scribe tracks who takes charge and where the plan buckles.
• 3:19
  SPEAKER_01: After 90 minutes, pause for a quick debrief while the adrenaline's still pumping.
• 3:25
  SPEAKER_01: Patterns jump out fast.
• 3:27
  SPEAKER_01: Orphaned subnets that still route, quarterly patch cycles that lag weeks behind exploit release dates, vendor accounts that were never shut off, backups that miss the historian database, and the myth that every damper can just be flipped to hand when the network dies.
• 3:44
  SPEAKER_01: The good news?
• 3:45
  SPEAKER_01: Most fixes are boring, inexpensive, and wildly effective.
• 3:49
  SPEAKER_01: Segment the network so HVAC, lighting, and access control aren't gossiping on the same VLAN.
• 3:56
  SPEAKER_01: Switch vendor VPNs to just-in-time access with MFA and automatic expiry.
• 4:02
  SPEAKER_01: Drop a lightweight sensor on the OT side to baseline protocol chatter and flag anomalies.
• 4:07
  SPEAKER_01: Keep golden image firmware and a spare controller on site.
• 4:11
  SPEAKER_01: Test the restore every quarter.
• 4:13
  SPEAKER_01: Measure your progress with the classics, mean time to detect, contain, and recover.
• 4:19
  SPEAKER_01: And don't stop after one drill.
• 4:22
  SPEAKER_01: Rotate scenarios, insider threats, cloud outages, or a fire brigade that shows up mid-response.
• 4:30
  SPEAKER_01: Publish a short after-action report, assign owners to every gap, and review status at the next risk meeting.
• 4:37
  SPEAKER_01: Over time, those metrics will prove to executives that a morning spent playing pretend is cheaper than a week of real downtime.
• 4:45
  SPEAKER_01: In an era when attackers can jump from a phishing email to your chiller plan in a heartbeat, the question isn't whether you'll face an incident, it's whether the team will already know the moves when the alert siren blares.
• 4:57
  SPEAKER_01: A well-rehearsed response turns chaos into a controlled, almost boring procedure.
• 5:02
  SPEAKER_01: And boring is beautiful when you're defending critical infrastructure.