{"id":4959,"date":"2018-08-05T08:35:12","date_gmt":"2018-08-05T07:35:12","guid":{"rendered":"https:\/\/citysecuritymagazine.com\/?p=4959"},"modified":"2018-08-05T12:53:59","modified_gmt":"2018-08-05T11:53:59","slug":"security-design-smart-building-security","status":"publish","type":"post","link":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/","title":{"rendered":"The danger of using smart building security"},"content":{"rendered":"

Why \u2018smart\u2019 buildings are often dumb when it comes to cybersecurity<\/strong><\/h1>\n

As building control increasingly moves into the IT sphere, the importance of cyber security is growing in tandem. Gartner recently predicted that, by 2020, more than 25% of all identified attacks in enterprises will come from the Internet of Things.<\/p>\n

Worldwide spending on smart security will reach $348m in 2016, a 23.7% increase from 2015 spending of $281.5m. By 2018, this figure will be closer to $547m.<\/p>\n

The security implications of putting buildings \u2018online\u2019 should not be shied away from. Physical infrastructure is inherently more vulnerable once connected to the digital world.<\/p>\n

Understandable, then, that 87% of facilities managers, security personnel and others involved in the management and protection of buildings are at least \u2018somewhat concerned\u2019 about the cyber security vulnerabilities posed by smart tech. Polled as part of IFSEC Global\u2019s recent survey on smart buildings, a further 43% professed to being \u2018very concerned\u2019. Nevertheless, that even 13% insist they are \u2018not concerned at all\u2019 might alarm some observers given widespread reports about the vulnerabilities of internet-connected \u2018things\u2019.<\/p>\n

Vulnerabilities laid bare<\/h6>\n

IBM\u2019s ethical hacking team, X-Force, recently conducted a penetration test of a remote building automation system that controlled sensors and thermostats in several commercial offices. X-Force found a way into one of the building\u2019s networks via a vulnerable router.\u00a0 Poor password management meant the team easily accessed the local Building Automation System (BAS) controller and eventually wrested complete control of the central BAS server.<\/p>\n

IBM\u2019s penetration test illustrates the enormous potential for disaster in this new world of smart things. However, X-Force was only able to access the BAS due to a series of security lapses. It is a mistake to assume that the buck always stops with the vendor.<\/p>\n

\u201cThe vendors have a responsibility to ensure that their solutions meet the expectations of the customer,\u201d says Stuart Higgins, head of digital impact for Cisco UK and Ireland. \u201cThat they are up to date in terms of the vulnerability landscape and that they are patching both their hardware and software on a regular basis. But,equally, the customer can\u2019t wash their hands of responsibility. It\u2019s no one individual or organisation\u2019s responsibility; it\u2019s a collective duty.\u201d<\/p>\n

In 2014, security consultant Jesus Molina told US cyber security conference Black Hat that he had commandeered control of the lighting, HVAC and entertainment systems of 200 rooms at a hotel in Chinese city Shenzhen.<\/p>\n

A year before that, the US Department of Homeland Security revealed hackers had broken into a \u201cstate government facility\u201d and made it \u201cunusually warm\u201d. Google\u2019s Sydney office was hacked through its building management system in the same year. Two cyber security experts discovered the vulnerabilities via IoT search engine Shodan.<\/p>\n

Speaking to the BBC, one of these \u2018benign\u2019 hackers, Billy Rios, claimed there are 50,000 buildings currently connected to the internet, 2,000 of which lack any kind of password protection. Conducted by more malevolent actors, the consequences of such breaches could be significant, with disruption to office buildings that costs thousands of pounds in lost productivity sitting at the less serious end of the scale. If the heating system in a hospital or care home was disabled, for example, the upshot could even be loss of life.<\/p>\n

Disruption<\/h6>\n

Hacks of building systems have already caused profound disruption. In 2013, the theft of millions of customers\u2019 credit card data from US retailer Target was traced back to the heating and ventilation system. More alarming still, a Ukrainian power station was disabled immediately before Christmas in 2015 by a spear-phishing attack \u2013 where an employee is duped into downloading malware, usually via email \u2013 leaving around 80,000 Ukrainian citizens without power.<\/p>\n

Martyn Thomas, a professor of IT at Gresham College, told the BBC \u201cthat attempts to attack building management systems are happening all the time [\u2026] These BMS systems have hundreds of thousands of lines of code, and yet the average programmer makes 20 mistakes in every 1,000 lines of code, so there are lot of bugs there.\u201d Respondents to our survey were polarised over the magnitude of the hacking threat to building management systems. Those who were more relaxed about the risk seemed to have one of two main reasons. The first, expressed by an office-based facilities manager, was that their system \u201chad no physical connection to the outside world\u201d. Similarly, a senior executive in the industrial\/warehouse sector said, \u201cno life-critical applications will go on publicly connected networks\u201d.<\/p>\n

But even if hackers could access a BMS network, it doesn\u2019t follow that they would have a compelling motive for doing so, according to one integrator: \u201cI work solely in the residential market. My view is that if anyone has the capability to hack my home then they would be more inclined to hack a company for political reasons, or a bank for money. Security is important, but if I worry about this I\u2019d never install any smart equipment. I rely on the hardware purchased for this purpose.\u201d<\/p>\n

But can you rely on the hardware? Not so, said one security consultant who believes that \u2018security by design\u2019 has only \u201cbeen addressed in a limited way as only a few leaders recognise the issue and manufacturers do not ensure the products are secure, despite the PR\u201d. A company director cited cyber risk as \u201cone of our main reasons for inaction\u201d when it comes to installing smart technologies.<\/p>\n

A health and safety professional offered a balanced view of the risk, saying that \u201cwhile no critical systems are likely to be integrated\u201d into smart networks \u201canytime soon, outside influences potentially being able to make changes via networked tech, even if it only means switching the lights off, can be a costly nuisance\u201d.<\/p>\n

Adam Bannister Editor of FSEC Global<\/p>\n","protected":false},"excerpt":{"rendered":"

Why \u2018smart\u2019 buildings are often dumb when it comes to cybersecurity As building control…<\/p>\n","protected":false},"author":19,"featured_media":4759,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[97,39],"tags":[],"class_list":["post-4959","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-design","category-security-technology"],"acf":[],"yoast_head":"\nThe danger of using smart building security - City Security Magazine<\/title>\n<meta name=\"description\" content=\"The implications of smart building security should not be shied away from. Physical structure is more vulnerable once connected to the digital world.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The danger of using smart building security\" \/>\n<meta property=\"og:description\" content=\"Why \u2018smart\u2019 buildings are often dumb when it comes to cybersecurity As building control increasingly moves into the IT sphere, the importance of cyber\" \/>\n<meta property=\"og:url\" content=\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\" \/>\n<meta property=\"og:site_name\" content=\"City Security Magazine\" \/>\n<meta property=\"article:published_time\" content=\"2018-08-05T07:35:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-08-05T11:53:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1170\" \/>\n\t<meta property=\"og:image:height\" content=\"780\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Contributor CSM\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@CitySecuritymag\" \/>\n<meta name=\"twitter:site\" content=\"@CitySecuritymag\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Contributor CSM\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\"},\"author\":{\"name\":\"Contributor CSM\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2\"},\"headline\":\"The danger of using smart building security\",\"datePublished\":\"2018-08-05T07:35:12+00:00\",\"dateModified\":\"2018-08-05T11:53:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\"},\"wordCount\":952,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg\",\"articleSection\":[\"Security Design\",\"Security Technology\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\",\"url\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\",\"name\":\"The danger of using smart building security - City Security Magazine\",\"isPartOf\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg\",\"datePublished\":\"2018-08-05T07:35:12+00:00\",\"dateModified\":\"2018-08-05T11:53:59+00:00\",\"description\":\"The implications of smart building security should not be shied away from. Physical structure is more vulnerable once connected to the digital world.\",\"breadcrumb\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage\",\"url\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg\",\"contentUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg\",\"width\":1170,\"height\":780,\"caption\":\"smart building security\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/citysecuritymagazine.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The danger of using smart building security\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#website\",\"url\":\"https:\/\/citysecuritymagazine.com\/\",\"name\":\"City Security Magazine\",\"description\":\"News and advice for security professionals\",\"publisher\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/citysecuritymagazine.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\",\"name\":\"City Security Magazine\",\"url\":\"https:\/\/citysecuritymagazine.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg\",\"contentUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg\",\"width\":2048,\"height\":573,\"caption\":\"City Security Magazine\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CitySecuritymag\",\"https:\/\/www.linkedin.com\/company\/city-security-magazine\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2\",\"name\":\"Contributor CSM\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g\",\"caption\":\"Contributor CSM\"},\"description\":\"City Security magazine is proud to work with contributors from across the security sector and beyond, including police forces, security associations, security providers, consultants and specialists who produce a range of varied and interesting content.\",\"url\":\"https:\/\/citysecuritymagazine.com\/author\/contributor-csm\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"The danger of using smart building security - City Security Magazine","description":"The implications of smart building security should not be shied away from. Physical structure is more vulnerable once connected to the digital world.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/","og_locale":"en_GB","og_type":"article","og_title":"The danger of using smart building security","og_description":"Why \u2018smart\u2019 buildings are often dumb when it comes to cybersecurity As building control increasingly moves into the IT sphere, the importance of cyber","og_url":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/","og_site_name":"City Security Magazine","article_published_time":"2018-08-05T07:35:12+00:00","article_modified_time":"2018-08-05T11:53:59+00:00","og_image":[{"width":1170,"height":780,"url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg","type":"image\/jpeg"}],"author":"Contributor CSM","twitter_card":"summary_large_image","twitter_creator":"@CitySecuritymag","twitter_site":"@CitySecuritymag","twitter_misc":{"Written by":"Contributor CSM","Estimated reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#article","isPartOf":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/"},"author":{"name":"Contributor CSM","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2"},"headline":"The danger of using smart building security","datePublished":"2018-08-05T07:35:12+00:00","dateModified":"2018-08-05T11:53:59+00:00","mainEntityOfPage":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/"},"wordCount":952,"commentCount":0,"publisher":{"@id":"https:\/\/citysecuritymagazine.com\/#organization"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage"},"thumbnailUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg","articleSection":["Security Design","Security Technology"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/","url":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/","name":"The danger of using smart building security - City Security Magazine","isPartOf":{"@id":"https:\/\/citysecuritymagazine.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage"},"thumbnailUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg","datePublished":"2018-08-05T07:35:12+00:00","dateModified":"2018-08-05T11:53:59+00:00","description":"The implications of smart building security should not be shied away from. Physical structure is more vulnerable once connected to the digital world.","breadcrumb":{"@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#primaryimage","url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg","contentUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/64p27.jpg","width":1170,"height":780,"caption":"smart building security"},{"@type":"BreadcrumbList","@id":"https:\/\/citysecuritymagazine.com\/security-technology\/security-design-smart-building-security\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/citysecuritymagazine.com\/"},{"@type":"ListItem","position":2,"name":"The danger of using smart building security"}]},{"@type":"WebSite","@id":"https:\/\/citysecuritymagazine.com\/#website","url":"https:\/\/citysecuritymagazine.com\/","name":"City Security Magazine","description":"News and advice for security professionals","publisher":{"@id":"https:\/\/citysecuritymagazine.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/citysecuritymagazine.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/citysecuritymagazine.com\/#organization","name":"City Security Magazine","url":"https:\/\/citysecuritymagazine.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/","url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg","contentUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg","width":2048,"height":573,"caption":"City Security Magazine"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CitySecuritymag","https:\/\/www.linkedin.com\/company\/city-security-magazine"]},{"@type":"Person","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2","name":"Contributor CSM","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g","caption":"Contributor CSM"},"description":"City Security magazine is proud to work with contributors from across the security sector and beyond, including police forces, security associations, security providers, consultants and specialists who produce a range of varied and interesting content.","url":"https:\/\/citysecuritymagazine.com\/author\/contributor-csm\/"}]}},"_links":{"self":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts\/4959","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/comments?post=4959"}],"version-history":[{"count":0,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts\/4959\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/media\/4759"}],"wp:attachment":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/media?parent=4959"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/categories?post=4959"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/tags?post=4959"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}