ASHRAE Journal - July 2019 - 29

SOLVING PROBLEMS

human health and safety, said Tully, a manager of application engineering for Reliable Controls Corporation.
Steven Bushby, Fellow ASHRAE, a previous chair of the
Standard 135 committee, said the legacy of the building
industry ignoring building automation system's cybersecurity is because closed, proprietary systems were not
connected to anything; thus, not seen as much of a risk.
That changed with the development of BACnet, the most
widely used building automation system protocol in the
world.
The most common BACnet system is a multi-level system with workstations and supervisory controllers connected to an Internet Protocol (IP) network. The supervisory controllers often serve as routers to a different,
lower-cost network technology that connects equipment
speciﬁc controllers, according to Bushby, who works
for the National Institute of Standards and Technology
(NIST). He is the leader of NIST"s Mechanical Systems
and Controls Group of the Energy and Environment
Division of the Engineering Laboratory. 
He said it is common practice for building owners
to connect building controllers to the same networks
used for general business and IT purposes. Sometimes
facilities will have a standalone, separate network for
building control that is isolated from the Internet, but
the more common approach is sharing the network
because it is cheaper, according to Bushby. This creates
vulnerabilities to phishing attacks and compromised
login credentials. In this model, login credentials
intended to provide an operator or vendor with remote
access to the building automation system becomes a
vehicle to access or attack anything connected to the IP
network.
Putting BACnet devices and other operational technology (OT) devices on IT networks can lead to dangerous installation practices such as placing unprotected
devices on the IP backbone or across the Internet, said
David Robin, Member ASHRAE, a member and past
chair of the ASHRAE Standard 135-2016 committee.
Virtual LAN (VLAN) or Virtual Private Network (VPN)
conﬁgurations should be used to protect OT devices that
do not have their own security, but this requires coordination with IT, which may cause delays when setting up
or changing a facility's operational side.
The most common mistake people make regarding building automation system security, Tully said, is
the lack of awareness about inherent vulnerabilities

and the threats they pose to organizations and mission
capabilities.
"This poor judgment or awareness often results in negligent user account management, weak or vulnerable
passwords, poor system/server/application administration, use of standard openly published ports, preservation of default credentials, inbound ﬁrewall penetration, little to no auditing and no recovery/resilience plan
for when a breach occurs," he said.
Tully said it also is common for vendors and service providers to leave default passwords in place for
convenience. 

Recommended Solutions
There is no single security solution that is appropriate
for every building automation system because of technology and the ever-changing threat environment, Tully
said.
One of the recommended strategies for protection schemes commensurate with security controls
already established in the IT domain is using NIST
Special Publication 800-27, Fundamental Engineering
Principles for Information Technology Security
(EP-ITS). Standards have implemented the use of
EP-ITS, and organizations have used EP-ITS for some
time, he said.
"Rather than ignoring or avoiding these standard
practices and security controls, BAS manufacturers and
vendors should embrace these techniques and engage in
proactive collaboration with cross-functional teams with
the organizations and IT teams whom they serve," Tully
said.
Another strategy is hardening-improving an information or computing system's security by reducing its
surface of vulnerability. Hardening trusts a minimum
number of system elements, which reduces exposure to
vulnerabilities that could be exploited for unauthorized
information access and manipulation.
Building automation system environments should be
appropriately secured to each organization's requirement and functional expectations, Tully said. The goal of
hardening is mitigating risk to an acceptable level.
"The most common solution today is to put the building automation part in a virtual private network (VPN),
which blocks access except for speciﬁcally designated
devices that can connect, and it encrypts the message
and it provides a pretty reasonable level of security,"
J U LY 2 0 19

ashrae.org

ASHRAE JOURNAL

29
https://www.ashrae.org/
ASHRAE Journal - July 2019

Table of Contents for the Digital Edition of ASHRAE Journal - July 2019
