ASHRAE Journal - May 2023 - 22

FEATURE
FIGURE 2 Physical attack vectors for BAS/BMS systems.
Physical
Vectors
Direct
Connections (via
Physical Access)
Network Ports
(Router, Switch
Hub)
MS/TP
FTT
Ethernet
Network
Protocol
Connections
Wi-Fi
ZIGBEE
Laptops
Unauthorized
Computers
USB
Devices
User Interface
Access
Modbus
Direct to
Equipment
Panel
Access
Control
Hardware
Access
Operational Technologies (OT) Best Practices.
The following is a short list of some of the operational
elements of a cybersecurity plan that more directly relate
to personnel and the physical aspects of the system:
 Human resources onboarding and offboarding for
user credentials;
 Corporate policies for compliance;
 Locked equipment rooms and cabinets;
 Access restrictions;
 Passphrase requirements for building management
system (BMS) and equipment access;
 Control network protocol connectivity/security;
 Supplier device level security requirements;
 Limiting network connectivity from public to the
BAS network; and
 Limiting " back door " access to Wi-Fi and cellular.
BAS Cybersecurity Attack Vectors
Before developing a plan, however, it is critical to
understand the risks for the facility and to its building
operations, which range from mild to catastrophic.
Knowing the source of the risk, referred to as an attack
vector, helps designers harden their systems without
overdesigning. Building systems are vulnerable to a
myriad of attack vectors. Two basic categories of threat
vectors exist: physical and logical.
Physical Attack Vectors
Physical attack vectors are sources of risk facilitated by
gaining unauthorized access to BAS equipment through
22
ASHRAE JOURNAL ashrae.o rg M AY 2023
physical means, such as direct access to the physical
network, direct access to a port on equipment, accessing
a locked panel or plugging in an unauthorized laptop
computer into the owners' IP network, among other
possibilities. Common physical threat vectors are shown
in Figure 2.
Logical Attack Vectors
This relates to accessing the BAS network through logical
intrusion to the system, typically occurring using an
IP network connection external to the facility, though it
could be internal by gaining physical access. Some typical
logical attack vectors are shown in Online Figure B.
It is worth noting that design engineers may be faced
with specifying either the entire system, or, more commonly,
only a part of the system as part of a retrofit project.
For new construction or a complete replacement,
strong IT practices will help. For the partial upgrade of
the system, many of the cybersecurity infrastructure
elements may already be in place without the ability to
upgrade them. Therefore, the designer needs to work
with the owner as to the scope and goals of the design.
System Threat Assessment
The threat potential of a facility varies from mild to
very serious depending upon the type of facility and its
operations. It is important to assess the relative importance
of cybersecurity to the general scope of the facility.
Building systems can be breached in several ways. There
are inadvertent breaches and malicious ones. Some
http://www.ashrae.org
ASHRAE Journal - May 2023

Table of Contents for the Digital Edition of ASHRAE Journal - May 2023
