ASHRAE Journal - November 2022 - 18

CYBERSECURITY
Column
Important Cybersecurity
Tips for ASHRAE Pros
BY ECTON ENGLISH, MEMBER ASHRAE
" Shields Up! " is the slogan the U.S. Cybersecurity and Infrastructure Security Agency
(CISA) has adopted to bring attention to critical infrastructure cybersecurity. Recently,
an increasing number of companies, small municipalities and government entities
have been victims of various cybersecurity attacks. Some are indiscriminate malware
and ransomware attacks while others are much more sophisticated and targeted
toward specific entities.1 The most important trend for awareness is that these types
of cybersecurity incidents are only going to increase in the future. As ASHRAE professionals,
this is an important time to increase cybersecurity awareness among HVAC
professionals and take steps to improve our cybersecurity posture. The intention
of this column is to help novice ASHRAE professionals take low-cost, basic steps to
significantly improve their cybersecurity practices. The following are five considerations
that can improve cybersecurity for you, industry partners and customers.
User Access
User access to a system is a key weakness often
exploited in any cybersecurity incident. Users are often
unwittingly the gateway for a cyber intrusion into a network
that enables an attack to wreak havoc. These types
of cyberattacks usually implement a click that leads to a
malicious website where credentials are stolen or malware
is loaded onto the victim's computer. Mitigations to
limit this type of attack include:
* Providing basic cybersecurity education to all users.
An educated user is a strong defense mechanism against
malware introduction and social engineering, also
known as social hacking.
* Providing users the minimum amount of privileges
needed to perform their duties. Users with administrative
or power-user accounts should only use those
18
ASHRAE JOURNAL ashrae.o rg N O V E M B E R 2022
accounts when needed and use their general nonadministrative
accounts for normal duties. This practice
can limit what an attacker can do with a compromised,
non-privileged user account.
* Using multifactor authentication (MFA)2 to limit
the effect of stolen credentials. This technology requires
users to have two forms of credentials, such as a password
and a fingerprint, for system access. For additional
security, use a time-based one-time password (TOTP)
MFA solution, which generates a temporary code that
can only be used for a limited time for system access.
TOTP and MFA solutions can often be deployed to end
users via a free cell phone application or key fob.
Ecton English is a subject matter expert for industrial control systems/supervisory
control and data acquisition (ICS/SCADA) and the technical director for the facilities
operations organization at the National Security Agency (NSA), Ft. Meade, Md.

https://www.ashrae.org/

ASHRAE Journal - November 2022

Table of Contents for the Digital Edition of ASHRAE Journal - November 2022