ASHRAE Journal - November 2023 - 18

COLUMN CYBERSECURITY
FIGURE 2 BAS system architecture.
IP Network External to ICS
IP Network
External to CS
Level 5
External
Connection and CS
Management
Level 4
CS Front End
And CS IP
Network
Level 3
Field Point of
Connection (FPOC)
Level 2
Field Control
System (IP)
Level 1
Field Control
System
(Non-IP)
Level 0
Sensors &
Actuators
SOURCE: UNIFIED FACILITY CRITERIA (UFC) 4-010-06 " CYBERSECURITY FOR FACILITY-RELATED CONTROL SYSTEMS " HTTPS://WWW.WBDG.ORG/FFC/DOD/UNIFIED-FACILITIES-CRITERIA-UFC/UFC-4-010-06
of the devices with the respective levels as they consider
the appropriate cybersecurity control measures
specified for the project.
However, most importantly, when looking at the
system architecture, it is important to specify it to
include system segmentation, network zoning, firewalls
and demilitarized zones (DMZs). Clearly define how the
various components of the BAS should be connected and
segregated to minimize the risk of unauthorized access.
Access Controls
Detail the access control mechanisms that will be
implemented to protect the BAS. Specify user roles,
privileges and authentication methods. Consider
the use of multi-factor authentication when
feasible, strong password policies and secure user
management practices. Additionally, emphasize
the importance of regular access control audits
18
ASHRAE JOURNAL ashrae.org N OVEMBER 2 0 2 3
and user account management processes.
Network Security
Outline the specific network security measures
to be implemented. This includes the use of secure
protocols such as SSL/TLS encryption for data
transmission. Specify intrusion detection and
prevention systems (IDS/IPS), as well as network
monitoring tools to identify and respond to potential
threats. Make sure network equipment, including
routers, switches and firewalls, adhere to industry
best practices for security configurations. At the field
point of connection (FPOC) level, the device should
have a " deny all/permit by exception " policy applied.
The FPOC should be set up with the most restrictive
set of access control list (ACL) possible, as it is the
demarcation point in the control system between the
field control system and the BAS front end.
1A-Non-IP Controllers
1N-Non-IP Network
2B-Switches
Or
Or
4A-Servers
4B-Workstations
2N-IP Network
Switch, " Proxy Device, " or Firewall
Operations Center
2C-Control Protocol HW
2A-IP-Based Controllers
1N-Non-IP Network
1A-Non-IP Controllers
1N-Non-IP Network
1A-Non-IP Controllers
To More Field
Control Systems
Connection Components
(Firewalls, DMZ, Proxies, Servers, etc.)
Connection Components
(Firewalls, DMZ, Proxies, Servers, etc.)
CS Management
4N-IP Network (CS VLAN(s) or Dedicated Network)
Software Updates, Monitoring, Scanning, Patches, Audits
To More Field
Control Systems
Control System (CS) PIT Authorization Boundary
2D-Field Control System Computers
1N-Non-IP Network
1A-Non-IP Controllers
HTTPS://WWW.WBDG.ORG/FFC/DOD/UNIFIED-FACILITIES-CRITERIA-UFC/UFC-4-010-06 http://www.ashrae.org
ASHRAE Journal - November 2023

Table of Contents for the Digital Edition of ASHRAE Journal - November 2023
