Building automation and control systems

Task:

Many of today’s facilities use Building Automation and Control Systems (BACS). Therefore, your task is to:

1. Introduce BACS and its technology
2. List and critically discuss the security professionals’ considerations of BACS vulnerabilities Criteria:

 

Word length:

1,000 to 2,500 words.

 

1

Learning Objectives

BACS:

• Understand development of BACS
• Identify & integrate technologies & elements of

BACS

• Critically examine the benefits, applications &

functions of BACS

• Identify & mitigation BACS vulnerabilities
• Demonstrate & apply an understanding of the

relationship between the built environment, ……..

BACS & security

2

Historical Perspective

• Conventional Building (to 1980s)
• Automated Building (1981 – 1990)
• Responsive Building (1991 – 1996)
• Effective Building (1997 – 2010)
• Intelligent Building (2010 – ??)
• Smart Building (20**)

 

 

 

3

To the 1980s

• Minimal integration of systems
• Systems analogue i/o only
• Stand alone systems:

– Security

– HVAC

– Fire & life safety

– Lighting

– Lifts

– Telephone

– Data network

 

4

5

Automated Building (1981–1990)

• Emphasis on shared tenant services
• Computer mainframes
• Mini-computers offered new capabilities
• Telecomm infrastructure no longer monopolised
• Expected to provide market edge over conventional buildings
• Failure due to security integrity concerns

Responsive Building (1991–1996)

• 2nd generation
• Technology alone cannot meet tenant needs
• Responsive to change raised
• Understanding of building life cycle

6

Building Life Cycle

• Concept of total integration
• Building shell typ. 30-75 years
• Mech & Elec services typ. 15 years
• Internal tenant fit out typ. 5 years
• Office furnishing day to day
• Building must cope with these changes

 

7

Effective Building (1997–2010)

• 3rd generation
• Facility services must contribute to tenants business
• Focus on occupants needs
• Integration supports achievement of business goals
• Technology – not the goal

Intelligent Buildings (2010+)

• Building wide automatic control, monitoring, management &

maintenance of different systems & services

• Flow of information Enterprise wide
• Local &/or remote connectivity
• Scalable

8

Drive for BACS?

“50% of building’s lifetime costs typically goes to

operations .. the most attractive benefit of integrated

buildings may be its operating costs” (Langston & Lauge-Kristensen,

2002, p. 76)

Energy is 30% of a building’s operating cost

(Cotts, Roper & Payant, 2009)

“Energy used in buildings accounts for almost 20% of all

energy” (ABCD, 2014, p. 22)

Approx. 50% of total world energy consumption went to

heat for buildings & industry. HVAC: Slow growth, but

vast potential—key for energy transition (Renewables 2015 Global

Status Report, 2016, p. 17)

9

Drive for BACS

• BACS (2016) market valued at $54-78 billion
• Annual growth 12-34% annually
• Global market
• Converging all building systems
• Converging functionality at enterprise level

Marketsandmarkets. (2017). Building Automation System Market by Communication

Technology (Wired, & Wireless), Offering (Facilities Management Systems, Security &

Access Control Systems, & Fire Protection Systems), Application, & Region – Global

Forecast to 2022 (SE2966).

TMR Analysis. (2017). Commercial Building Automation Market 2016-2024.

10

BACS Benefits

BACS will:

– Reduced energy

– Reduced operating costs

– Remove overlapping systems

– Reduced systems control space

– Remote 24 hours control

– Improve reporting/auditing procedures

– Meet compliance needs

– Provides trending patterns

– Leads to greater tenant satisfaction

– Reduced costs = increased profile

11

What are BACS?

No standard definition, but common:

– Integrates disparate systems by centralised interface

– Shared network

– Maximises performance & efficiency by integration

– Uses technology & strategies for sustainability (Madsen, 2008)

– Free flow of information

• Automated system that converges at a central point to integrate

building technology & process the flow of information … to

create a facility that is safer, more comfortable & productive for

its occupants, & more efficient for its owners & operators

• System names:

– Building Automation Systems BAS

– Energy Management System EMS

– Building Management System BMS

– Intelligent Building IB

– Smart Building

12

BACS Hardware Architecture

Management

 

 

Automation

 

Field Devices

13

BACS

Architecture

14

BACS Software Architecture

15

BACS Vulnerabilities

• Risks are contextual, aligned with the

building:

– Threat exposure

– Criticality of operations

• Covers:

– Hardware

– Software

– Network

16

BACS Vulnerabilities

Management

Automation

Field Devices

 

 

 

 

17

BACS Vulnerabilities

Management Level

– Device access

• Workstation
• Insert illegal storage device

– Communication network access

• Logical connectivity
• Wiretapping
• Monitor & analyze traffic

Automation Level

• Controller access
• Cover
• Manipulate inputs/outputs
• Tamper detection
• Field programmer
• Embedded functionality
• Power
• Communication network access
• Wiretapping (sniffing)
• Monitor & analyze traffic
• Open source programs
• Data injection (fabrication)
• Insert illegal Controller

 

Field Level

– Device access

• Manipulation (on/off/alter)
• Destruction

– Connection access

• Manipulation

(on/off/alter/disconnect)

• Destruction
• Tamper detection

18

Network Vulnerabilities

19

BACS: The Security Problem?

• Converging all building systems, including Security
• Who owns & is responsible?
• Physical & logical breaches
• External network connectivity
• Legacy issues
• Internet of Things

20

BACS: The Security Problem?

Practitioners understanding:

• Majority of security & building operators

had neutral understanding of BACS

vulnerabilities

• Integrators displayed understanding
• Security: Limited BACS responsibilities
• 50% of BACS had integrated security

systems

• Diverse views on integration & systems

21

Protecting the Building

• Security Guidelines/s: System design, zoning, etc
• Security risk management: Threat, criticality &

vulnerability

• Physical control to devices & network
• Personnel security: Vetting, inc 3rd parties
• Integration of facility functions: Working group
• (Some) Network isolation: Internal & external,

between BACS, operating systems & wider networks

• Continuity of operations: UPS, override
• Security awareness: Training, issues, share intel

22 BACS – Future Risks

• Wireless: Increase for ease & cost of connectivity
• Open architecture: Increase connectivity, s/w, h/w
• Extended interconnectivity: Multiple connectivity,

internal & external, extending to other networks/clouds

• Enterprise integration
• Plug & play: Easier to maintain
• Single design: Controller has multiple applications &

functions

• Artificial intelligence: Smarter system, more complexity
• Smart sensor: One sensor for multiple functions

23

Conclusion

• Understand:

– Drive for BACS

– BACS architecture

– Vulnerabilities

– Mitigation strategies

– Responsibility lies across multiple persons/groups.