ASHRAE Journal - July 2021 - 56

CYBERSECURITY
Column
David J. Branson
Understanding IIoT
Cybersecurity Issues
BY DAVID J. BRANSON, P.E., BCXP, FELLOW/LIFE MEMBER ASHRAE
Applying cybersecurity principles to the built environment often focuses on securing
user access to building automation systems, an obvious area of concern. Similar application
can secure the interface that connects equipment to the internet to facilitate
machine-to-machine communication-often referred to as the Industrial Internet of
Things (IIoT).1 A cursory knowledge of this subject is important to give owners, engineers
and technicians a user-level understanding of cybersecurity issues. After all, the
development efforts mentioned in this column are being funded directly or indirectly
by all of us. In a way, this means we are also funding cyber criminals.2
A primary function of the IIoT is to allow field devices
to pass collected low-level data through edge node
and relay devices to cloud services that can provide
advanced processing in support of complex decisions,
and then possibly allow the return of instructions
for equipment use. Examples include diagnostics
and operational adjustments to prevent early hardware
failure, real-time utility purchasing, resource
optimization, strategic planning and other advanced
features.
Many methods exist to allow developers to move
data between devices in the IIoT world, and more are
being added rapidly. Organizations like OASIS3 (see
the " Terminology " sidebar for acronyms and definitions)
have released tools and methodologies to aid in
the development of secure communications between
devices along independent paths. OSI4 network, transport
and framework functional levels are typical focal
points of cybersecurity intrusion, and they form the
domain of this introductory column. The goal is to allow
manufacturers, developers, specifiers and users of
equipment in the built environment to better understand
the ease with which these appliances can be
secured.
56
ASHRAE JOURNAL ashrae.org J U LY 2021
Most of us have been exposed to the networking OSI
model. Internet protocol (IP) resides at the OSI network
layer; HTTP5 and TCP6 reside at the transport layer.
Additional transport layer protocols are widely available
for use by developers of IIoT services. Common
examples are MQTT,7 CoAP8 and DDSI-RTPS.9 These
foundational tools allow data to pass between disparate
appliances.
Equipment manufacturer developers use these and
other protocols to pass data between computational
tools that reside on dissimilar compute platform configurations,
e.g., an x86-class desktop computer running
Microsoft Windows 10 communicating with a
cloud application residing on a Raspberry Pi running
Debian Linux operating system (OS), with service tech
input via a smartphone running its unique OS. Without
this cross-platform capability, shared or advanced
cloud services would be severely limited by hardware
compatibility.
IIoT cyberattacks usually occur at the communications
interface of a device in the pathway used to transport
David J. Branson, P.E., is president of Compliance Services Group, Inc., in Lubbock,
Texas. He is a member of TC 1.5, Computer Applications and vice chair of the
Cybersecurity Multidisciplinary Task Group.

http://www.ashrae.org

ASHRAE Journal - July 2021

Table of Contents for the Digital Edition of ASHRAE Journal - July 2021