Commercial building control systems consist of mechanical and electrical equipment that controls the entire building environment. This includes HVAC, lighting, security access, surveillance, elevators, and more. These systems are aimed at creating a safe, comfortable building environment to support and even enhance the satisfaction and productivity of its tenants. At its best, it can facilitate a sense of belonging that contributes to staff retention. In the march toward smarter buildings, standalone systems using proprietary protocols with limited IT have morphed into networked digital systems that take full advantage of IT technologies, often sharing the IT infrastructure. The many advantages of these interconnected systems come at a price: cyberattacks. A successful cyberattack can have a long-lasting impact on a company's bottom line. This goes well beyond the readily quantified costs incurred by regulatory fines, litigation, public relations, and direct expenditures that accompany large-scale personal data breaches. There are many other intangible costs associated with damage to reputation, operational disruption, loss of proprietary information, and corporate strategy.
The methods hackers use to exploit known vulnerabilities, in both new and legacy installations, are numerous: malware, phishing, man-in-the-middle attack, denial-of-service, and SQL injection are but a few of them. The Cybersecurity and Infrastructure Security Agency (CISA) tracks the various cyber threats and provides advisories [1]. A system breach can lead to unauthorized disclosures of personal data, theft of proprietary information and intellectual property, violation of consumer privacy, and even loss of service. Given the dangers, cybersecurity is no longer optional for building owners and operators. A security-oriented mindset and comprehensive security mechanisms—applied to the building and its subsystems—are essential to averting and mitigating risk.
Connected devices and systems continue to grow exponentially. Forbes predicts that by the end of 2024 there will be more than 207 billion connected devices worldwide [2]. In such a deeply interconnected world, we must build and maintain a trusted environment that uses advanced technologies to offer the best possible defense against increasingly sophisticated attacks. A cybersecurity incident can cripple an organization in minutes, and so building owners need suppliers to prove that their products comply with the relevant cybersecurity standard.
