This article was originally posted on AutomatedBuildings.

October is Cybersecurity Awareness Month, and I’d like to bring the conversation into the design development meeting in the consulting engineer’s office. 

When we specify a building automation system, we spend a lot of time on sequences of operation, equipment performance, graphics, and interoperability. Those details matter, but we should give the same attention to how people (operators, vendors, etc.) and applications will access that system once it is connected. 

Things such as… Who can log in? What can they reach? Who approves a contractor’s access? And who removes that access when the work is finished? 

These are questions we can address while the project is still in the design development stage. 

In my role at Cochrane Supply & Engineering, my focus includes helping the design community understand building IoT, integration, and OT cybersecurity. Through our website SmartBuildingDesign.com, we help connect those conversations to architecture and guide specifications engineers can use. 

My message to specifying engineers is straight forward… Cybersecurity belongs in the design documents!! A clear and concise specification gives the project team something to price, implement, and verify. 

Start with the people who will operate the building 

Before selecting platforms or writing cybersecurity requirements, it’s always best to bring the owner’s Facilities and IT teams into the conversation.  Both parties should participate in these meetings jointly as a team, so that technologies can be vetted, and cyber security best practices can be implemented that are in alignment with the Owner’s IT department’s standards. 

Facilities need dependable operation and timely service. IT needs visibility into connected systems and control over access. The consulting engineer needs enough information from both to develop a workable design. 

I would start with a few practical questions. Which systems need to exchange data? Which contractors need remote access? Does the owner already have an approved remote access policy? Who will manage accounts, software updates, and backups after turnover? 

Record those answers in the Owner’s Project Requirements. When responsibilities remain undefined, contractors are left to make assumptions, and the owner inherits the result. 

This collaboration is what I call Cyber Harmony. It means the people designing, installing, protecting, and operating the building agree on how it should work. 

Make the architecture visible 

Most engineers and systems integrators think in pictures! One of the most useful tools that an engineer can provide in clarifying the overall architecture is a systems integration drawing. 

The drawing should show the connected systems, integration platform, OT network, enterprise connections, cloud applications, and remote access paths. It should identify where data moves, where access is controlled, and who owns the major pieces. 

For example, if a cloud application needs meter data, show the approved path for that information. If a controls contractor needs to service the Niagara supervisor, show how that connection will be authorized and controlled. 

Document read access and command access separately. An application that displays equipment data has different permissions from one that changes setpoints. 

The drawing and specification should support each other. The drawing explains the architecture; the specification establishes the requirements for delivering it. Together, they give the engineer, owner, IT team, and integrator a common reference. 

Turn Zero Trust into practical requirements 

Zero Trust can sound intimidating until we apply it to a familiar service call. 

A technician needs to troubleshoot an air handler. We should be able to verify the technician’s identity, authorize access to the equipment needed for the job, and record the access activity. That permission should be reviewed or removed when it is no longer needed. 

NIST’s Zero Trust guidance explains that trust should not be granted simply because a user or device is inside a network or belongs to the organization. Authentication and authorization must govern access to resources. 

For the consulting engineer, that translates into requirements such as individual user accounts, multifactor authentication for remote users, permissions based on job responsibilities, and defined procedures for granting and revoking access. 

It also means specifying controlled communication between systems and making access records available to the owner. 

Existing buildings require practical judgment. Some legacy controllers cannot support modern identity or encryption capabilities directly. The design must account for that limitation through appropriate gateways, segmentation, and access controls. Remote access is a useful place to begin applying Zero Trust, with the broader architecture addressing application and device access as well.  The engineer should familiarize themselves with easy to specify platforms for zero trust remote access if the tools are not already in place and it is your responsibility to include remote access in your design documents. 

Design the Secure by Design OT Stack

The Secure-by-Design OT Stack is a way to organize these decisions across the building’s technology architecture. Each layer has a job, and the interfaces between layers need the same attention as the products themselves. 

The secure edge controls connections into and out of the OT environment. NEEVE is an example of a platform that supports Zero Trust remote access, role-based permissions, and auditing. The engineer should establish the required access behavior, deployment responsibilities, and owner acceptance criteria. 

The enterprise operating platform brings building information together for operators and portfolio teams. KODE Labs is an example of this layer. Specify the data it will receive, the applications it will support, and whether it is permitted to issue commands. Define ownership of the data and management of application credentials. 

The open integration fabric connects systems and organizes their information. Tridium Niagara provides an example of this role. Engineers should define the required protocols, integrations, naming, tagging, and permissions so that openness supports an architecture the owner can understand and maintain. 

The hybrid OT network connects the field equipment, controllers, gateways, and supervisory systems using the appropriate wired and wireless infrastructure. Its design should establish system boundaries, permitted communication, device hardening, and support responsibilities. 

Selecting these layers is the beginning. Their configuration, integration, and ongoing management determine how effectively the architecture protects the building. Engineers can use the stack to identify gaps and assign responsibility for closing them. 

Write requirements that can be delivered 

A sentence such as “provide a secure BAS” leaves the project team with too many unanswered questions. Give bidders requirements they can understand and include in their scope. 

At a minimum, I would want the specifications to address: 

• An asset inventory and documented network architecture. 
• Approved remote access methods and account management. 
• Removal of default credentials and unnecessary services. 
• Segmentation and permitted communication paths. 
• Responsibilities for updates, vulnerability response, and product support. 
• Backup, restoration, logging, and turnover requirements. 

Coordinate those requirements across the relevant sections of Divisions 23, 25, 27, and 28, with project-wide responsibilities established in Division 01 where appropriate. 

Be clear about the controls contractor’s scope and the master systems integrator’s scope. For example, the controls contractor may install and program the BAS, while the integrator delivers specified integrations, tagging, and owner applications. The documents should identify who configures and verifies the security controls at their interfaces. 

Updates and testing also need to fit building operations. NIST’s OT security guidance recognizes the importance of performance, reliability, and safety. Define how changes will be evaluated, approved, and scheduled with the owner. 

Commission what you specify

As a commissioning authority, I want a requirement to lead to a demonstration. 

If the specification requires limited contractor access, demonstrate that the contractor can reach the approved system and is blocked from reaching unauthorized systems. If access must expire, verify that it expires. Confirm that the owner can retrieve the required access records. 

Review the installed communication paths against the approved systems integration drawing. Demonstrate the agreed backup and restoration procedure in a way that protects operations. 

Then verify turnover. The owner should receive the asset inventory, current drawings, configuration records, account administration procedures, and a clear explanation of ongoing responsibilities. Credentials should be transferred through an approved secure process. 

Cyber commissioning gives the owner evidence that the specified protections have been implemented. Ongoing operation must keep those protections current as users, software, and equipment change. 

Bring cybersecurity into your next design meeting 

For engineers looking for a starting point, SmartBuildingDesign.com provides architecture resources and guide specifications to support these conversations. Use them as a foundation, then adapt the requirements to the owner and the project. 

On your next project, ask the owner how remote access is managed. Bring Facilities and IT together before the architecture is finalized. Develop the systems integration drawing, put clear requirements in the specifications, and establish how the completed system will be verified. 

Cybersecurity Awareness Month gives us a reason to raise the subject. Specifying engineers have an opportunity to carry it into the decisions that shape the building for years to come. 

Your next set of drawings and specifications is a good place to start!! 

References

NIST Zero Trust Architecture SP 800 207 
https://www.nist.gov/publications/zero-trust-architecture 

NIST Guide to Operational Technology Security SP 800 82 Revision 3 
https://csrc.nist.gov/pubs/sp/800/82/r3/final

NEEVE Zero Trust Remote Access 
https://neeve.ai/solutions/remote-access/

KODE Labs 
https://kodelabs.com/

Tridium Niagara Framework 
https://www.tridium.com/us/en/Products/niagara 

Smart Building Design 
https://www.smartbuildingdesign.com/

The post Cybersecurity Starts in the Specification appeared first on Smart Building Design.

In this interview, I sit down with Maciej Oldziej, the general manager of LumenRadio, to explore the current state of wireless in the BAS space, learn what sets their technology apart, and discuss how their wireless BACnet solution is enabling faster installations, reduced cabling costs, and more flexible building environments.

Wireless adoption in BAS has historically been slow. Why do you think that’s been the case, and what’s changing now?

Reliability. Wireless is a household term, but within the BAS world, it is a term that sparks fear and uncertainty. At LumenRadio, we are educating the BAS community that there is a reliable wireless solution to meet their needs.

In my opinion, there are two primary factors driving wireless adoption for the retrofit market: limited labor force and decarbonization targets. The continued rising cost of building materials is a contributing factor.

For instance, in the education sector, approximately 79% of air handling units (AHUs) sold are for retrofit projects.

What are some of the most common misconceptions about using wireless technology in building automation systems?

It doesn’t work, or that technology hasn’t evolved. The BAS industry is slow to adapt and accept new technologies, especially considering its historical sub-par experiences with wireless.

From your perspective, what are the key advantages of wireless over traditional wired BAS installations?

Reduce Install Burden: costs and time of installation. Minimized tenant and space disruption. More predictable cost analysis. And easier troubleshooting vs. trying to find where a fault is on the wire trunk.

What types of building environments are the best candidates for wireless BAS deployments?

We are seeing success in Hotels/Resort, Schools, and Medical Office Buildings. Historical buildings like courtrooms, churches, and museums. Warehouse and Manufacturing sites are also a great contender with wide open spaces that want to limit day-to-day disruption.

How has wireless reliability and security evolved over the past five years in the BAS industry?

With the adoption of IoT and remote monitoring, the security and privacy concerns have shifted to the cloud. BACnet Secure has been part of the conversation, but the adoption has been slow. IT departments want to know everything and anything on their local networks.  

What should building owners and operators consider when deciding between wired and wireless BAS systems?

Wireless systems are more flexible. If the building owner and operator have leasable spaces that are prone to change, wireless has a distinct advantage vs. wires. If the space is actively used 24/7 or only accessible during specific hours, wireless can help offset the install burden.

How do you address concerns around interference with other wireless devices and networks in commercial buildings?

This a core value at LumenRadio; Wireless Without Worries is our motto. Our 19 patents in Wireless Networking allow us to be interference free and not interfere with other existing and future technologies.

Historically, many technologies are prone to network congestion or interference. For example, a stadium filled with people and smartphones, or an office building with BLE, WiFi, Microwaves, and other technologies contributing to the on-air congestion.

Are there any regulatory or compliance factors to keep in mind when using wireless BAS technology?

In North America, you want FCC-compliant devices. Each device should have an FCC ID in the unlicensed bands like 2.4 ghz. If using LTE/Cellular technologies, additional certifications may be required.

Another thing to look out for is data storage and data visibility implications. When considering IoT, cloud, and wireless systems is paramount to understand how the data is being used and access control to ensure operational integrity within BAS systems.

Can you give us a high-level overview of LumenRadio’s Wireless BACnet solution?

It’s rather simple! We replace cable runs between BACnet MS/TP field devices. Think of it as replacing a wired RS-485 trunk with a “wireless trunk”. The Wireless BACNet Mesh solution is a plug-and-play wireless MS/TP cable.

What sets LumenRadio’s technology apart from other wireless solutions in the BAS space?

Cognitive Coexistence! It’s our core IP innovation that enables interference free transmission without the complexity of network configuration. It enables us to work in any radio and physical environment.

How does LumenRadio’s solution maintain BACnet compliance and interoperability across different vendors?

Wireless BACnet devices cannot be BTL certified because they are not addressable nor visible in the BAS. However, we maintain interoperability across vendors by mimicking the MAC address of the BACnet field device it connects to and transmitting transparent BACnet. The BAS does not know it is wireless. We are a true wireless cable replacement!

Can you walk us through a typical deployment process using your wireless BACnet solution?

Let’s take a rooftop retrofit example where running a cable across the roof or underneath the ceiling is prohibitive. Instead of running a cable between each RTU, we will install an individual W-BACnet device at each RTU controller. Then, a W-BACnet Gateway will automatically discover all the RTUs that will be discoverable in the BAS.

How does LumenRadio’s mesh network technology work, and what benefits does it offer for BAS installations?

Wireless BACnet is a self-configuring and self-healing mesh network. Each W-BACnet node is a repeater that can directly connect to the gateway or indirectly propagate its signal. If a node loses a signal, other nodes in the network will automatically find a path to maintain connectivity. The primary benefit of using our technology is the plug-and-play nature accelerating installation by removing control cable runs from the equation. We built the solution with the installer in mind equipping them with Bluetooth app to quickly verify their installation.

What’s the typical range and scalability of a LumenRadio wireless BACnet network?

Range! It’s our #1 question. Range will depend on the environment and antennas used. Inside the building, on average, I see 50-700 feet between devices. Outdoors we can reach up to a mile line-of-sight. Our recommendation is to build wireless MS/TP networks in line with wired networks: 25-40 devices per Wireless BACnet network. And yes, you can have multiple W-BACnet networks within the same space.

How do you ensure security — both at the device and network level — with your wireless BACnet system?

Our networks are stand-alone, not Wifi, with dynamic encryption methods. Thanks to our IP, we can mitigate network jamming attacks and safeguard against replay attacks. Only devices that are commissioned on-site can join W-BACnet networks.

Can LumenRadio’s solution coexist with legacy wired BACnet systems? How does that integration work in practice?

Yes! A great example is failing Lon VAV devices. It’s common to upgrade 2-3 end-of-life Lon VAVs to BACnet VAVs without affecting existing infrastructure. As Lon VAVs continue to fail, we can add them to the existing Wireless BACnet network without affecting Lon infrastructure.

Do you have examples or case studies where your wireless BACnet solution delivered significant cost or time savings compared to traditional wired approaches?

We do! A great example is a Resort FCU retrofit where the installers saved 90% on install cost vs. running wire, and with limited impact on the business – I don’t think resort guest would enjoy the sound of drilling holes and someone being in their room!

A big thank you to Maciej for sharing his insights on the evolution of wireless in the BAS space and the innovative work LumenRadio is doing with their Wireless BACnet solution. As buildings continue to grow smarter and more connected, it’s clear that wireless will play a key role in driving both flexibility and efficiency in system design. We look forward to seeing how LumenRadio continues to shape the future of wireless BAS technology.

The post Wireless Without Worries: A Conversation with LumenRadio on the Future of BAS Connectivity appeared first on Smart Building Design.

I sat back down with Aaron Brondum, Sr. Director of Business Development at Neeve, to talk through the technical side of Zero Trust, and how Neeve is helping real-world organizations deploy it in a way that’s actually usable in the field. 

Greg Fitzpatrick, CxA, Business Development Leader, Cochrane Supply

Aaron, thanks for joining me again. Last time we covered the fundamentals of Zero Trust. Today, I want to dive into the more technical side of things. For those out there trying to figure out how to actually apply Zero Trust to an OT network, where should they be thinking about placing the solution? 
 

Aaron Brondum, Sr. Director of Business Development, Neeve

Great question, and placement is everything. In OT networks, the best place to start is at the IT/OT boundary. That’s where the biggest risk is, and it’s where Zero Trust can act as a secure gateway. Every connection trying to cross that boundary gets verified—user identity, device health, even where the traffic is coming from and going to. 

From there, we look inside the OT network and apply micro-segmentation. Instead of treating the entire OT environment as one big trusted zone, we break it into smaller ones, HVAC, lighting, elevators, each with their own access rules. That way, even if something is compromised, it can’t spread. 

Greg:

That makes sense, sort of like building a wall, then putting locks on every door inside it. But what about remote access? That’s where a lot of threats get in. How does Neeve handle that differently? 
 

Aaron: 

Exactly—and you’re right, remote access is the biggest attack vector in most smart buildings today. That’s why we don’t rely on VPNs. VPNs are a one-and-done deal: you authenticate once, and suddenly you’ve got a tunnel to the entire network. 

We use Zero Trust Network Access (ZTNA) instead. It’s more surgical. A technician accessing HVAC controllers only gets access to those, and only for a set time. Every session is authenticated and encrypted, and we can revoke access at any point. It’s dynamic, and it’s role-based. 

Greg:

That’s a huge improvement, especially when you’ve got vendors logging in from who knows where. But what about older systems—those legacy devices in OT that weren’t built with any of this in mind? 

Aaron: 

That’s probably the biggest misconception we hear: “Zero Trust won’t work because my gear is too old.” The truth is, we don’t need the devices themselves to support modern security protocols. 

Neeve secures the network layer, not the device layer. We look at the traffic moving between devices, enforce policies at the edge, and isolate anything that shouldn’t be talking. So even if a 20-year-old controller has no encryption, it can still live inside a secure, Zero Trust architecture. 

Greg: 

So it’s not about upgrading all your gear, it’s about controlling what talks to what? 

Aaron:

Exactly. We like to say: protect the flow, not the box. You don’t need to replace every sensor or controller. You just need to know what normal looks like, then put the guardrails in place to make sure it stays that way. 

Greg: 

Let’s talk monitoring. Zero Trust is all about verification—but what kind of visibility do you need to really make it work? 

Aaron:

You need full telemetry. That’s part of the power of our platform. We offer real-time monitoring of every connection and session—who connected, when, from where, and what they did. That allows us to: 

• Spot anomalies quickly, 
• Detect lateral movement attempts, 
• And adjust access policies dynamically. 

It’s especially useful in OT environments where normal behavior is pretty stable. If a lighting controller suddenly starts trying to talk to an elevator PLC? That’s a red flag. 

Greg: 

That kind of real-time insight would be huge for incident response too. Have you seen this deployed in the real world? 

Aaron:

Yeah—one great example is Kilroy Realty. They came to us with growing concerns around remote vendor access and a need to strengthen security across multiple buildings. 

We started with a risk assessment, then implemented micro-segmentation and ZTNA. Vendors only got access to the exact systems they needed, with MFA and session limits. All traffic was monitored in real time. No more open VPN tunnels. 

The result? Tighter control, better compliance, and no disruptions to building operations. 

Greg: 

That’s the sweet spot—better security, but nothing breaks. So, what are some best practices for firms trying to take this on themselves? 

Aaron: 

Here’s a simple roadmap we’ve seen work: 

1. Start with an asset and communication map. Know what’s connected and how it communicates.

2. Segment your network. Start coarse, then work toward micro-segmentation. 

3. Use role-based access and MFA. Make sure only the right people have access to the right systems. 

4. Replace VPNs with ZTNA. That alone is a major leap forward. 

5. Continuously monitor. Know what’s normal so you can spot what’s not. 

6. Roll out in phases. Don’t try to do the whole network at once. Start where the risk is highest. 

Greg: 

Last question, what do you say to the folks who still think Zero Trust is too expensive or complex? 

Aaron: 

I’d say they’re not wrong to worry, but they’re probably looking at the wrong solutions. Neeve was built specifically for OT environments, so we focus on using what’s already there. We don’t force forklift upgrades. We integrate gradually, and we secure networks that were never built to be secure. 

In most cases, we’re helping organizations improve security without increasing operational cost. That’s the power of doing it right. 

Greg:

This has been incredibly helpful, Aaron. For anyone serious about OT cybersecurity, this kind of approach isn’t just smart, it’s necessary. Zero Trust isn’t a buzzword. It’s a technical strategy that works. And with solutions like Neeve, it’s finally accessible to the people who need it. 

Aaron: 

Appreciate it, Greg. It’s always a pleasure to talk real-world security with someone who gets the OT side. Looking forward to more of these conversations, there’s a lot more ground to cover as this space continues to evolve. 

As OT networks become more connected and remote access becomes more common, a Zero Trust architecture, especially one that can be deployed without disrupting legacy systems, is becoming the new standard. With practical tools like Neeve and a phased deployment strategy, cybersecurity is no longer a barrier to smart building innovation. It’s the foundation. 

The post Part 2: Diving Deeper: The Technical Realities of Zero Trust in OT–A Conversation with Neeve  appeared first on Smart Building Design.

Greg Fitzpatrick, CxA, Business Development Leader, Cochrane Supply:

Hey, Aaron, thanks so much for sitting down to speak with me. Today I wanted to talk to you about Implementing cybersecurity in smart building design. It’s still kind of a new concept for a lot of consulting engineers and systems integrators. They’re often working with the owner’s IT department to integrate smart building technology with an existing IT setup, or they’re setting up a separate OT network. One big question that always comes up from the engineers and integrators is: what’s the best remote access strategy for the standalone OT network? “Zero Trust” comes up a lot, especially in IT circles, but for people who might not be familiar with it, can you explain what Zero Trust really means and why it’s so critical for remote access?

Aaron Brondum, Sr Director Business Development, Neeve:

Yeah, absolutely. Zero Trust is kind of a game-changer in cybersecurity. You know, the traditional approach is that once you’re inside the network, you’re trusted. Zero Trust flips that on its head—it’s more like, “never trust, always verify.” Every single user or device that’s trying to access any resource has to be verified, no matter where they are or how they’re connecting.

When you apply that to smart buildings, especially with remote access, Zero Trust becomes essential for making sure IT and OT systems—which run things like HVAC and lighting—are communicating securely. Let’s say someone’s trying to access the OT network remotely. With Zero Trust, you’re basically saying, “Okay, even though you’re on the network, we’re still going to verify who you are, what device you’re on, and whether you’re authorized to access this specific system.” It’s an extra layer of protection, especially when you’re dealing with sensitive infrastructure.

Greg:

So, it’s not just a blanket trust once you’re in. Every access point gets verified. That makes a lot of sense. And I guess the principle is the same whether you’re dealing with IT or OT networks?

Aaron:

Exactly, but there are some differences in how it’s applied. For example, in IT, you’ve got your standard devices—laptops, phones—things that already come with built-in security. But in OT, you’re working with legacy systems, like sensors and HVAC controllers that were never really designed with cybersecurity in mind. So, you have to adapt the Zero Trust methods in a way that doesn’t disrupt critical operations.

Another big thing is network segmentation. In IT, you might use more fine-grained access controls based on user roles. In OT, you’re segmenting the network to make sure critical systems are isolated, but still allow necessary communication. It’s all about understanding the physical processes of the building systems and securing them without shutting anything down.

Greg:

Got it. And what are some of the key factors to think about when you’re specifying a cyber solution for OT? I mean, it’s not just about security, but you’ve got to make sure it’s easy to deploy and doesn’t disrupt the operations, right?

Aaron:

Yeah, that’s the tricky part—balancing security with ease of deployment. One thing to always keep in mind is segmentation and isolation. You want to make sure that your OT network is separate from the IT network. That way, if there’s a threat in the IT network, it doesn’t spread to critical OT systems like HVAC or elevators.

And then there’s secure remote access. You need strong security, like multi-factor authentication, but also something that integrates Zero Trust principles. A lot of people still rely on VPNs, but the problem with VPNs is that once you’re in, you’ve got access to everything. With Zero Trust, you’re constantly verifying who’s accessing what.

Greg:

What about legacy systems? OT networks are full of older equipment. How do you secure those?

Aaron:

That’s a huge challenge. A lot of these systems weren’t built with cybersecurity in mind, so you’ve got to choose solutions that can work with what’s already there, without requiring expensive upgrades. It’s about securing the network layer, rather than trying to retrofit security onto each individual device.

Greg:

Makes sense. So, let’s say the owner wants a separate OT network. Can we look at a solution that gives remote access but with true firewall capabilities?

Aaron:

Yeah, definitely. The key here is placing a Zero Trust solution right at the edge of the OT network. That way, any communication between IT and OT gets verified. You’re basically creating a secure gateway between the two environments. And if you’re adding remote access, Zero Trust ensures that only authorized users get through, continuously verifying their identity. It’s like a firewall, but with the added security of constant authentication.

Greg:

It sounds like you’re tightening things up at every level, from the edge to the individual systems. How does a solution like NEEVE’s Zero Trust help with the specific challenges of securing remote connectivity in OT systems?

Aaron:

And then, there’s network segmentation again. We create smaller zones within the OT network. So even if someone gets into one area, they can’t jump around and access everything.

NEEVE’s approach is all about continuous identity verification, using things like multi-factor authentication, so it’s not a one-and-done check. Every time someone tries to access the OT system remotely, we verify their identity and the security of their connection. Plus, all the communication is encrypted, so no one’s snooping in on sensitive data.

Greg:

So, even legacy systems are covered under this?

Aaron:

Exactly. A lot of people think Zero Trust can’t work with older OT systems, but that’s not the case. You’re securing the network and monitoring traffic between devices, so you don’t necessarily need to upgrade every single piece of equipment.

Greg:

And what are some of the misconceptions about Zero Trust in OT environments that you run into?

Aaron:

Oh, there are a few. Some folks think Zero Trust will disrupt their operations or be too complex to implement. But the reality is, if it’s done right, it’s actually pretty smooth. For example, with NEEVE, we take a step-by-step approach, integrating it into existing infrastructure without causing downtime. It’s all about making the process as seamless as possible.

And there’s this idea that OT devices can’t support Zero Trust, which, again, isn’t true. Even if the devices are older, we secure the network layer to make sure they’re part of the architecture.

Greg:

It’s like you’re providing a modern security solution, but without needing to overhaul the whole system. That’s huge for these older setups.

Aaron:

Exactly! And it’s also cost-effective. People think Zero Trust is going to break the bank, but we work with what’s already there, so you can roll it out without a massive upfront investment.

Greg:

This has been super insightful, Aaron. Thanks for breaking it down so clearly. Zero Trust seems like a no-brainer for securing OT networks, especially as they’re becoming more integrated with IT.

Aaron:

Absolutely, Greg. It’s becoming more essential every day, especially as smart buildings and OT environments get more complex. Always a pleasure to chat about this stuff! I’m looking forward to diving into a more technical level with you next time.

As the integration of IT and OT systems in smart buildings continues to grow, the importance of a robust cybersecurity strategy, grounded in Zero Trust principles, becomes undeniable. By incorporating Cyber Harmony as an industry-wide approach and applying Zero Trust as a guiding framework, consulting engineers and systems integrators can better protect today’s complex built environments. In our next article, we’ll dive deeper into the technical specifics, exploring advanced Zero Trust architectures, practical deployment strategies, and best practices for overcoming real-world challenges in OT cybersecurity. Stay tuned as we uncover how to fortify smart buildings at every layer.

The post Part 1: Implementing Zero Trust in Smart Buildings, A Cybersecurity Guide for OT Environments appeared first on Smart Building Design.

Cyber Harmony: A Holistic Approach to Cybersecurity

Cyber Harmony is a collaborative framework that ensures all stakeholders involved in a project—engineers, integrators, owners, end-users, and more—are aligned in their understanding and implementation of cybersecurity practices.

Key Principles:

• Importance: With the increasing complexity and interconnectedness of IT (Information Technology) and OT (Operational Technology) systems, a harmonized approach to cybersecurity is vital to protect project integrity and data.
• Goal: Embed cybersecurity best practices into every aspect of hardware and software solutions, from initial specifications to final coordination drawings.
• Roles and Responsibilities: Clearly define the roles and responsibilities of each stakeholder in maintaining a secure environment. This includes engineers, integrators, owners, and IT professionals.
• Layered Approach: Combine technology (e.g., encryption, firewalls) with human elements (e.g., training, awareness) for a robust defense.
• Early Engagement: Engage IT professionals early in the project lifecycle to ensure seamless integration of network and security requirements.
• Owner’s Project Requirements (OPR): Develop a comprehensive OPR document that outlines the owner’s cybersecurity expectations and guides the project’s security measures.

Implementation Phases:

1. Initial Discussions: Understand the owner’s vision and specific requirements for cybersecurity integration.
2. Design: Incorporate cybersecurity measures into the design of both hardware and software solutions.
3. Commissioning: Ensure that all security settings are accurate and systems are updated before deployment.
4. Ongoing Monitoring: Regularly audit networks, update software, and conduct security drills to identify and address vulnerabilities.

Challenges and Considerations:

• Cloud Adoption: While beneficial, cloud migration requires careful planning, leadership buy-in, and addressing security concerns.
• Data Encryption: Implement strong encryption at all levels to protect sensitive information.
• Unauthorized Access: Employ a multi-layered approach, including firewalls, VPNs, and user access controls.
• Backup and Recovery: Establish a dedicated team and process for regular backups and disaster recovery.
• Compliance: Adhere to industry standards (e.g., ISO 27001) and regulations (e.g., SEC) to ensure compliance and maintain a secure network.

Recommendations:

• Consider VPN routers and cellular modems to enhance security and connectivity.
• Evaluate both combined appliances and separate components to determine the best fit for the system.
• Prioritize regular network audits and security updates.
• Integrate information technology asset management (ITAM) to track and manage IT assets effectively.
• Foster collaboration between different departments to address cybersecurity challenges collectively.

The post The Engineer’s & Integrator’s Role in Creating Cyber Harmony appeared first on Smart Building Design.

Some The Key Points:

• CISA’s RFI, published in the Federal Register, seeks information to enhance its Secure by Design campaign.
• Topics include integrating security early into the software development life cycle (SDLC), education, recurring vulnerabilities, AI, operational technology (OT), and addressing the economics of secure design.
• CISA emphasizes the need for diverse perspectives and feedback to strengthen its campaign.
• The President’s National Cybersecurity Strategy calls for a shift in security responsibility from customers to software manufacturers.
• Co-sealed by 18 U.S. and international agencies, CISA’s Secure by Design guidance aims to reduce cybersecurity burdens on customers.
• The RFI seeks feedback on effective security tactics in the SDLC, with a focus on smaller software manufacturers struggling to implement robust practices.
• Input is requested on examples of educational initiatives linking commercial entities, universities, and online programs to enhance security knowledge.
• CISA inquires about the costs incurred by manufacturers in developing secure-by-design products and seeks information on how vulnerabilities impact both manufacturers and customers.
• The RFI addresses customer perceptions of security and explores ways customers request secure products.
• Recurring vulnerabilities are a focal point, with CISA seeking input on barriers to elimination and changes to CVE and CWE programs.
• Threat modeling, especially in OT systems, is highlighted, seeking examples of public threat models and best practices for demonstrating robust threat modeling programs.
• CISA urges manufacturers and stakeholders to provide written comments by Feb. 20, 2024, to inform future iterations of their whitepaper and collaborative efforts with the global community.

In conclusion, the information gathered through CISA’s Request for Information (RFI) serves as a crucial resource for enhancing the cybersecurity of Operational Technology (OT) deployments. By addressing key areas such as integrating security into the software development life cycle, education, recurring vulnerabilities, and threat modeling in OT systems, the insights obtained can guide the development of more cyber-secure OT solutions.

The emphasis on diverse perspectives, feedback from manufacturers, and understanding the economic aspects of secure design contributes to a comprehensive approach. Ultimately, this initiative facilitates the creation of robust, secure-by-design OT deployments, aligning with CISA’s global campaign to reduce cybersecurity burdens on customers and foster a safer technological landscape.

Greg is currently the Business Development Leader for Building IoT and Integration for Cochrane Supply & Engineering. In 2022, Greg was was appointed to the role of Executive Director for the Real Estate Cyber Consortium (RECC), promoting “cyber harmony” through leadership and insight on best practices, policies, and procedures for real estate owners, operators, and solution providers.

The post CISA’s challenge to a major stakeholder in the “Cyber Harmony” Model- The Manufacturer appeared first on Smart Building Design.

For the past five years, I’ve traveled across the country, engaging in discussions with consulting engineers about the integration of IP technology into their smart building designs.  In most cases, I’ve found that these firms are enthusiastic about incorporating IP Technology into their strategies.

In June 2023, I authored an article for Realcomm’s Edge Magazine titled “Creating A Path To Cyber Harmony – Challenging Commercial Real Estate’s Supply Chain,” where I briefly emphasize the significance of cyber awareness for commercial real estate owners and all project stakeholders, including consulting engineers.

While IP technology holds immense potential for smart building design, its implementation introduces new challenges in terms of cybersecurity and potential risks for consulting engineers. The consulting engineering community must recognize that cybersecurity is pivotal in deploying Operational Technology (OT) during the construction process.

OT systems, such as building automation and control systems, are increasingly interconnected and susceptible to cyber threats. The recent cyberattacks to MGM & Caesars properties in Las Vegas, and to building controls manufacturers, underscore the urgency of addressing cyber risks in the construction industry.

Robust cybersecurity measures safeguard not only sensitive construction data but also the physical infrastructure. This protection prevents potential disruptions, unauthorized access, or sabotage, ensuring the safety, efficiency, and integrity of construction projects. But, as we are experiencing, these devices are limited for shielding against the growing sophistication of the costly ransomware of today’s hackers.

Concentrated threats to properties and controls manufacturers are alarming, and with SEC’s approval of new cybersecurity disclosure rules, consulting engineers must elevate their cyber awareness and comprehend how to incorporate the necessary hardware and software to address cybersecurity concerns in their designs and specifications.

Cybersecurity Expertise to Achieve “Cyber Harmony”

With over 30 years in the consulting industry my aim has always been to simplify the process of designing and specifying OT and integration, making it as clear and concise as possible. Cybersecurity is no exception.

Earlier this year I accepted the role as the Executive Director of the Real Estate Cyber Consortium (RECC), where I’m striving to foster a movement towards ‘Cyber Harmony’ across the industry.

It is important to bridge the gap between facilities and IT departments, and implementing internal OT teams. My goal is to achieve “Cyber Harmony” through increased collaboration among diverse stakeholders, promoting activities such as knowledge sharing, best practice documentation, podcasts, and other communication channels to ultimately develop best practices and standards for the industry.

My objective is to streamline the fundamental cybersecurity requirements for consulting engineers, making these principles an integral part of the designer’s drawings and specifications when creating construction documents for building systems.

In any given project, there is typically a discovery phase where the designer must ask essential questions before proceeding. Incorporating cybersecurity into your design follows a similar pattern. Here are some key points to clarify during the discovery phase to determine your cybersecurity strategy:

1. Determine whether you are deploying IP devices on the owner’s network or designing a separate OT network that supports various building technologies. If the owner manages all OT, the designer’s responsibility is to ensure data encryption, while firewalls and VPN strategy fall under the owner’s IT department.

2. If the designer is responsible for a separate OT network, they must understand how to incorporate cybersecurity into the design.

Strategy First: Planning for Cybersecurity is Paramount

When considering essential design prerequisites for cybersecurity in your OT Network, assuming the owner prefers complete separation of the OT from their IT network (air gapped), I recommend these four tips:

1. Ensure that the specified OT Network solution offers robust port security capabilities, both in software and through the ability to bind device MAC addresses. This is critical to safeguard against unauthorized access. Optigo provides an OT network solution with the necessary port security and unified management through a user-friendly interface.

2. Implement robust data encryption mechanisms for network traffic, which can be achieved through various methods, including BAS system web supervisors, dedicated gateway devices, or BACnet Secure Connect (BACnet SC) using Tridium’s Niagara. This ensures data confidentiality and protection against threats.

3. Prioritize security when facilitating remote access to the network via the internet. Specify a firewall solution and establish a secure Virtual Private Network (VPN) appliance and strategy for remote access. This multi-layered approach enhances network security.

4. Collaborate with the end user on a VPN strategy for remote access and select a secure VPN appliance. TosiBox offers a product known for its ease of deployment and security features, popular among systems integrators.

Incorporating Your Cybersecurity Strategy into Your Construction Documents

Once a cybersecurity strategy is determined for our design, the question often arises: “How do I incorporate cybersecurity into my construction documents?

As a general practice, it’s wise to include as much detail as possible on your drawings and provide further clarification in the specifications. I advocate for the use of a detailed “Systems Integration Drawing” as the foundation for conveying intent to the master systems integrator (MSI). This drawing should display the OT network layout and the hardware used in your cybersecurity strategy.

The use of this drawing allows the designer show:

• Deployment location of the supervisory software
• VPN hardware/software
• Cell Modem
• Firewall
• OT Network router
• OT Network management switch(s)
• OT Network media
• IP switch types and locations
• Gateway devices
• Server (where applicable)
• Subnetwork media
• Technology being integrated
• OT Network MDF location and installed hardware

SmartBuildingDesign.com has the resources to help you need for ensuring strong cybersecurity for any OT Network

At SmartBuildingDesing.com we have detailed Systems Integration Drawings available here: https://www.smartbuildingdesign.com/system-architecture/

Regarding specifications, I recommend using Division 25 – Integrated Automation as the section for hardware and software related to your cybersecurity strategy. Examples of Division 25 specifications are available on our Guide Specifications page.

Incorporating these measures into your OT Network design not only reduces your risk as a designer but significantly enhances your client’s cybersecurity posture, reducing vulnerabilities and ensuring the safety and integrity of their critical operations.

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Cybersecurity Awareness 2023: Achieving Cyber Harmony in a Fragmented Industry appeared first on Smart Building Design.

Here are 10 of the main take-aways from his article:

• Real Estate Cyber Consortium (RECC) was formed in 2016 to address rising cyber threats in commercial real estate.
• RECC is a leading force in driving cybersecurity standards for the built environment.
• RECC represents over 45 organizations responsible for 12.5 billion sq. ft. of property management worldwide.
• RECC’s leadership board meets monthly to share insights on best practices and industry trends.
• 2023’s hot topics include network monitoring tools, risk frameworks, incident response plans, and integrating cyber into construction.
• Focus on the effect of operational technology (OT) on managing and securing built environments.
• Goal is to achieve “Cyber Harmony” through collaboration and adoption of best practices and specifications.
• There is a need for thought leaders to come together from various disciplines in the industry.
• It is important to bridge the gap between facilities and IT departments and implementing internal OT teams.
• The industry need to collectively develop a commercial real estate OT playbook, with advancements in technology and industry protocols.

Read Full Article Here

The post Real Estate Cyber Consortium (RECC): Creating a Path to Cyber Harmony appeared first on Smart Building Design.

This year marked my first attendance at the RealComm | IBCon Conference, and I must say that describing it as exciting would be an understatement.

RealComm | IBcon 2023 commemorated its 25th anniversary from June 13-15 in Las Vegas. The 3-day commercial real estate technology conference commenced with a day of pre-conference programs, where I led the day off with The Real Estate Cyber Consortium’s CRE Cybersecurity Forum.

Beginning at 9:00 am Tuesday morning, the CRE Cybersecurity Forum was eagerly anticipated by industry experts, professionals, and thought leaders, with few seats left unfilled. The session fostered discussions on the ever-evolving landscape of cybersecurity in real estate and technology.

We covered a wide range of topics, from nation state threats to the integration of cyber measures into the construction process. With an engaged audience of approximately 300 people, the session generated valuable takeaways. It was both an honor to host and participate in the event’s discussions.

Check out some highlights from “Integrating Cyber into New Construction and Commissioning Across Asset Classes” with Thano Lambrinos of QuadReal Property Group and Fred Gordy of Michael Baker International.

Throughout the conference, the vendor showroom buzzed with activity, featuring special interviews on the RealComm Live stage. I was ecstatic with overall traffic the RECC booth attracted while I shared the exhibit floor with some of the top manufacturers in the building controls industry showing the latest automated business solutions and state-of-the-art enterprise technologies tailored for the commercial and corporate real estate industry.

On the third day, I had the pleasure of leading an OT Network Design and Configuration Workshop, as one of the final sessions of the entire conference. Despite my initial expectations of a lightly attended session, the room was packed with an enthusiastic audience, eager to ask questions and share their experiences. By the workshop’s conclusion, participants had gained practical knowledge and skills necessary to effectively configure and manage OT networks. This newfound expertise enables them to enhance operational efficiency, resilience, and cybersecurity within their respective real estate organizations.

RealComm 2023 was brimming with countless memorable moments, leaving a lasting impact on both myself and the attendees. The industry will undoubtedly continue buzzing until 2024, when we come together once again for another remarkable event!

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Realcomm | IBcon 2023 Recap: Creating Cyber Harmony in Commercial Real Estate and Its Supply Chain appeared first on Smart Building Design.

Here are some key points mentioned during the conversation:

1. Greg’s role: Greg mentioned that he works with consulting engineers to help them understand and write specifications based on new technologies and network requirements in building automation controls.
2. New website for consulting engineers: Cochrane Supply is launching a new website specifically for consulting engineers. This website will provide resources and best practices for smart building and building automation controls and control networks.
3. Differences between IP controls and traditional controls: Greg talked about the shift towards IP controls and more IoT-type technologies. He discussed the differences between IP (Internet Protocol) and MSTP (Master-Slave/Token-Passing) and highlighted the importance of understanding IP network solutions for the facility world.
4. Basic design principles for IP networks: Greg mentioned the importance of following basic design principles when setting up an IP network for building automation. This ensures a reliable and secure network infrastructure.
5. Consultants as trusted advisors: Greg emphasized the role of consulting engineers as trusted advisors. They play a crucial role in guiding clients and helping them make informed decisions regarding open systems and new technologies.
6. Evolution of consulting engineering: The discussion touched upon the evolving nature of consulting engineering, moving from one-to-one interactions to a more comprehensive and consultative approach.
7. Importance of consulting engineers: Greg highlighted the significance of consulting engineers and their contributions to the industry. He shared his own experience working for a small firm in the early 90s and the value consultants bring to projects.
8. Greg’s roadshow and ICcon: Greg talked about his roadshow, which is different from the early days of building automation controls. He also mentioned his upcoming involvement at ICcon (presumably an industry conference) and the cyber forum scheduled for the event.
9. Cybersecurity and real estate industry: The concept of “cyber harmony” was discussed in relation to the real estate industry. Best practice groups and the Real Estate Cyber Consortium were mentioned as initiatives focused on promoting cybersecurity in the industry.
10. Continuous learning and expertise: Greg emphasized the importance of staying relevant and understanding what an expert looks like, even if one may not be an expert in every aspect. Continuous learning and awareness of industry trends are key.

We want to thank Eric for having Greg on his show to share his expertise and knowledge.

The post Interview: Greg Fitzpatrick joins Eric Stromquist of ControlTrends Podcast (6/9/2023) appeared first on Smart Building Design.