ASHRAE Journal - May 2023 - 20

FEATURE
Ultimately, the facility owner is the responsible party
for many of the elements of BAS cyber/physical security.
The owner must be part of the discussion to ensure a
full site risk assessment and security plan are part of
the project. The owner is typically made up of a team of
professionals with different responsibilities. Depending
on the size and scope of the project/owner, that team
can include:
 Facility management;
 IT manager;
 Human resources;
 Legal counsel;
 Security/risk officer; and
 Executive management.
This team sets the facility high-level owner project
requirements (OPRs), which is then used by others to
FIGURE 1 ASHRAE four-tier model with cybersecurity vectors.
Tier 1
Enterprise IP Network
Tier 2
Building Level Network
Tier 3
Subsystem Equipment
Tier 4
Field Devices
External Hacked BMS
Cloud Service Corruption
Data Center Breach
Internal Access BAS Network
External Access via VPN, VLAN,
Wi-Fi, Cellular Modems, DSL Lines
Internal Access to Cabinets,
Devices, Equipment,
User Interfaces
Physical Access to Sensors, IoT
Hacks, Bypassing Network Security,
Back Door Access by Contractors
vectors for each tier.
One well understood cybersecurity model is the risk
management framework (RMF) initially developed by
the U.S. Government's National Institute for Standards
and Technology (NIST), which is now being adopted
by many in the public and private sectors. The RMF
provides an extensive assessment and engagement
model to identify the strategic and tactical areas to
address. For military facilities, the list of criteria is
extensive. It's less so for schools and much less so for a
gas station. The RMF follows three basic principles:
 Development of the risk assessment model;
 Identifying level of paranoia; and
 Assign responsibility.
The U.S. Army Corps of Engineers uses the Defense
in Depth approach (Online Figure A; see this and Online
Figure B at https://tinyurl.com/
JournalExtras). It is the practice of
arranging defensive lines so they can
defend each other, especially in the
case of an enemy incursion.
BAS system specifications that
define cybersecurity requirements
typically will address both the
physical and logical aspects of
the system. Segmenting the
specification into the physical and
logical components helps define the
responsible party. One way of doing
this is by defining the information
technology (IT) and operational
technology (OT) requirements.
create specifications, standards, playbooks and design
frameworks. If the owner has multiple buildings in
their portfolio, these OPRs typically are consistent
from project to project. In many cases, these roles are
performed by third-party consultants, contractors or
advisors.
Assembling a Cybersecurity Plan
ASHRAE Guideline 13-2023, Specifying Building
Automation Systems, defines a BAS/BMS four-tier model.
The model defines the physical and logical tiers of a
building controls system segmented to roughly follow
how projects are contracted. Figure 1 shows the four-tier
model overlayed with the potential cybersecurity attack
20
ASHRAE JOURNAL ashrae.o rg M AY 2023
IT Best Practices
The following is a short list of some of the technical
tools IT professionals have at their disposal to manage
cybersecurity risks:
VLAN setup;
 Port lock downs;
 Encryption;
 Bandwidth monitoring;
 Firewalls;
 Password/passphrase changes;
 Network monitoring and restricted access;
 Two factor/level authentication;
 Isolated IP address access and management; and
 Proper VPN setup.
Building Data Abstraction
https://tinyurl.com/JournalExtras https://tinyurl.com/JournalExtras http://www.ashrae.org
ASHRAE Journal - May 2023

Table of Contents for the Digital Edition of ASHRAE Journal - May 2023
