iscover
David WalshShare this article on:
Powered by
MOMENTUM
MEDIA
Attacks on building systems are escalating threats that Australian building owners and managers need to mitigate and defend against. With the number of connected devices being deployed, it’s critical that building managers are aware of the risks they face, David Walsh, founder and CEO of CIM, writes. While attacks on building systems in Australia have not yet become prevalent, these are not unknown.
Recently, when a building automation firm in Germany lost contact with hundreds of devices, it faced its biggest nightmare. Suddenly, it was locked out of a building with lighting, motion sensors and shutter controls under a malicious cyber attacker’s control. And they weren’t the only building owners affected. The attackers struck other buildings across Europe that were running on the KNX platform. And a recent report by Forescout Research Labs noted that HVAC systems were a significant point of cyber risk exposure in commercial buildings.
Cyber security is a serious risk for all businesses. In a building, a cyber security breach can result in a loss of access to a building, equipment damage and the loss of critical information. Putting effective steps in place can mitigate the risk of an attack and minimise the damage should a breach occur.
Here are five tips for securing your building’s data and systems:
1. Cyber awareness training
While the way attackers may seem to change, the reality is most deploy the same tools. Teaching employees to not open attachments or links without verifying the sender, ensuring emails are sent from trusted sources and not to visit websites that look suspicious is a good start. But also encouraging positive behaviours with identity management such as not using easily guessed passwords (an enterprise password management platform can help) or reusing passwords.
2. Use an established and trusting cyber security framework
Cyber security is rapidly maturing which means many of the challenges the building industry faces aren’t new. Other industries have faced many of the same issues and have developed tools and frameworks to assist with implementing a robust cyber security-built environment strategy. Three that are widely used include: The Essential Eight, NIST and ISO 27001.
3. Assess your risk
An enterprise vulnerability assessment that considers your property’s systems, data, access privileges, and policies in place is essential. Not all security threats apply equally to all buildings. It’s important to assess the risks that matter to your portfolio of property assets and then develop a remediation plan to achieve an effective cyber security posture.
4. Constant vigilance
Monitoring both your physical and digital environment for anomalous activity is crucial. While you can take all possible preventative steps, it is still possible for a determined attacker to breach your defences. Constant monitoring of your property’s IT and operational technology (OT) environment is crucial for quickly detecting and responding to attacks before they escalate and seriously impact your building’s operations.
5. Work with trusted partners
If your internal cyber security capability is limited, you can work with established cyber security experts to ensure you have the right prevention, detection and recovery processes and systems in place. But it’s also important to partner with a building analytics provider that is reputable and has gone through the correct checks and balances. Your building analytics partner should take information security very seriously and apply industry best practice and to comply with the numerous compliance regulations in Australia. Ask your analytics partner if they have implemented strict cyber security policies and procedures including independent assessment and penetration tests.
David Walsh is the founder and CEO of CIM.
Be the first to hear the latest developments in the cyber industry.
