What are the common vulnerabilities and threats for BMS in smart buildings?

Building Management System and closely associated Building Automated System is combination of sensors, actuators, controller and monitoring systems. The whole idea is to automate the process for large buildings like corporate parks, airposts, schools, offices, malls etc. In this there are interdependent systems like incoming smart grids, network connetions, sewage and water supply, data centers, climate and weather data etc.

Building management systems is a combination of hardware and software , such as pumps, motors, different types of sensors, fire alarm systems , fire fighting systems, CCTV, actuators etc and associated softwares. All these components need to assess for vulnerabilities and threats. In addition to above, physical security vulnerabilities must be addressed. Above all organisation policy and procedural, administrative vulnerabilities should be addressed

BMS integrates various systems like HVAC, lighting, access control, and energy management into a centralized platform. The vulnerabilities here often stem from outdated software, unsecured communication channels, and insufficient access controls. For instance, if the BMS relies on legacy protocols without encryption, it becomes susceptible to interception and unauthorized control.

BMS integrates different building systems into a centralized platform, making it high-risk. Some of the common vulnerabilities and threats include- Unauthorized access to BMS systems, compromising building security and operations. Exposure of sensitive building data due to inadequate security measures in BMS software. BMS systems infected with disruptive malware. Denial of Service attacks (DoS) because of overloading the BMS network with excessive traffic. To address these vulnerabilities, one requires robust cybersecurity practices and security awareness training to protect smart buildings.

BMS/BAS poses many challenges as it is a collection of heterogeneous systems from several vendors. This system communicates with Facility Management software also. 1. Legacy systems 2. Interconnectedness nature 3. Remote access 4. Third party integration 5. Human errors

In general like all the IT or OT systems, BMS systems work on network protocols and have inherent risks like insecure design, weak protocols security, configurations issues, authntication issues etc.

One prevalent issue is the lack of regular updates and patches, leaving systems exposed to known exploits. Additionally, inadequate authentication mechanisms and weak password policies can make unauthorized access a real concern. A concrete example could be a hacker exploiting a vulnerability in the BMS software to manipulate temperature controls, causing discomfort or even damage to equipment within the building.

BMS Risk Assessment and Management" highlights the importance of protecting a Building Management System (BMS) against cyber threats and privacy breaches. The approach involves assessing the likelihood and impact of threats and vulnerabilities, as well as selecting and implementing appropriate controls.The author shares practical insights, highlighting the usefulness of this approach in his professional experience, emphasizing the need to be aware of the topic while on the job.

Like any connected system understanding and managing the risks shall be priortised. The first step would be to enumerate what we have , how important it is to achieve the intended outcomes ?, what if somethings fails?, who can attack or exploit the systems? IEC62443-3-2 is a good guide to satrt doing the risk assessment.

I would definetely add IEC62443 as one of the standard apart from ISO 27K series of standards, CIS benchmarking and NIST guidelines. Standardization will help bring all the stakeholders on same level of understanding of security.

Ensuring robust security and privacy in BMS requires adherence to best practices. This involves the implementation of stringent access controls, regular software updates, and the encryption of communication channels. For instance, embracing the principle of least privilege guarantees that users are granted only the access essential to their specific roles, minimizing the risk of unauthorized actions. Moreover, anonymizing data collected by the BMS is crucial for privacy protection, as it prevents the identification of individuals based on their usage patterns, thereby reinforcing overall data security.

Privacy is a big concern for BMS especially the physical access system that use the user data, an attack may expose the Personlly Identifiable Information (PII).

Data Breaches: Unauthorized access to sensitive data collected by BMS (e.g., occupancy data, user habits) can lead to privacy violations. Data Interception: Intercepting data transmissions between BMS components can compromise privacy and integrity.