In this interview, I sit down with Maciej Oldziej, the general manager of LumenRadio, to explore the current state of wireless in the BAS space, learn what sets their technology apart, and discuss how their wireless BACnet solution is enabling faster installations, reduced cabling costs, and more flexible building environments.

Wireless adoption in BAS has historically been slow. Why do you think that’s been the case, and what’s changing now?

Reliability. Wireless is a household term, but within the BAS world, it is a term that sparks fear and uncertainty. At LumenRadio, we are educating the BAS community that there is a reliable wireless solution to meet their needs.

In my opinion, there are two primary factors driving wireless adoption for the retrofit market: limited labor force and decarbonization targets. The continued rising cost of building materials is a contributing factor.

For instance, in the education sector, approximately 79% of air handling units (AHUs) sold are for retrofit projects.

What are some of the most common misconceptions about using wireless technology in building automation systems?

It doesn’t work, or that technology hasn’t evolved. The BAS industry is slow to adapt and accept new technologies, especially considering its historical sub-par experiences with wireless.

From your perspective, what are the key advantages of wireless over traditional wired BAS installations?

Reduce Install Burden: costs and time of installation. Minimized tenant and space disruption. More predictable cost analysis. And easier troubleshooting vs. trying to find where a fault is on the wire trunk.

What types of building environments are the best candidates for wireless BAS deployments?

We are seeing success in Hotels/Resort, Schools, and Medical Office Buildings. Historical buildings like courtrooms, churches, and museums. Warehouse and Manufacturing sites are also a great contender with wide open spaces that want to limit day-to-day disruption.

How has wireless reliability and security evolved over the past five years in the BAS industry?

With the adoption of IoT and remote monitoring, the security and privacy concerns have shifted to the cloud. BACnet Secure has been part of the conversation, but the adoption has been slow. IT departments want to know everything and anything on their local networks.  

What should building owners and operators consider when deciding between wired and wireless BAS systems?

Wireless systems are more flexible. If the building owner and operator have leasable spaces that are prone to change, wireless has a distinct advantage vs. wires. If the space is actively used 24/7 or only accessible during specific hours, wireless can help offset the install burden.

How do you address concerns around interference with other wireless devices and networks in commercial buildings?

This a core value at LumenRadio; Wireless Without Worries is our motto. Our 19 patents in Wireless Networking allow us to be interference free and not interfere with other existing and future technologies.

Historically, many technologies are prone to network congestion or interference. For example, a stadium filled with people and smartphones, or an office building with BLE, WiFi, Microwaves, and other technologies contributing to the on-air congestion.

Are there any regulatory or compliance factors to keep in mind when using wireless BAS technology?

In North America, you want FCC-compliant devices. Each device should have an FCC ID in the unlicensed bands like 2.4 ghz. If using LTE/Cellular technologies, additional certifications may be required.

Another thing to look out for is data storage and data visibility implications. When considering IoT, cloud, and wireless systems is paramount to understand how the data is being used and access control to ensure operational integrity within BAS systems.

Can you give us a high-level overview of LumenRadio’s Wireless BACnet solution?

It’s rather simple! We replace cable runs between BACnet MS/TP field devices. Think of it as replacing a wired RS-485 trunk with a “wireless trunk”. The Wireless BACNet Mesh solution is a plug-and-play wireless MS/TP cable.

What sets LumenRadio’s technology apart from other wireless solutions in the BAS space?

Cognitive Coexistence! It’s our core IP innovation that enables interference free transmission without the complexity of network configuration. It enables us to work in any radio and physical environment.

How does LumenRadio’s solution maintain BACnet compliance and interoperability across different vendors?

Wireless BACnet devices cannot be BTL certified because they are not addressable nor visible in the BAS. However, we maintain interoperability across vendors by mimicking the MAC address of the BACnet field device it connects to and transmitting transparent BACnet. The BAS does not know it is wireless. We are a true wireless cable replacement!

Can you walk us through a typical deployment process using your wireless BACnet solution?

Let’s take a rooftop retrofit example where running a cable across the roof or underneath the ceiling is prohibitive. Instead of running a cable between each RTU, we will install an individual W-BACnet device at each RTU controller. Then, a W-BACnet Gateway will automatically discover all the RTUs that will be discoverable in the BAS.

How does LumenRadio’s mesh network technology work, and what benefits does it offer for BAS installations?

Wireless BACnet is a self-configuring and self-healing mesh network. Each W-BACnet node is a repeater that can directly connect to the gateway or indirectly propagate its signal. If a node loses a signal, other nodes in the network will automatically find a path to maintain connectivity. The primary benefit of using our technology is the plug-and-play nature accelerating installation by removing control cable runs from the equation. We built the solution with the installer in mind equipping them with Bluetooth app to quickly verify their installation.

What’s the typical range and scalability of a LumenRadio wireless BACnet network?

Range! It’s our #1 question. Range will depend on the environment and antennas used. Inside the building, on average, I see 50-700 feet between devices. Outdoors we can reach up to a mile line-of-sight. Our recommendation is to build wireless MS/TP networks in line with wired networks: 25-40 devices per Wireless BACnet network. And yes, you can have multiple W-BACnet networks within the same space.

How do you ensure security — both at the device and network level — with your wireless BACnet system?

Our networks are stand-alone, not Wifi, with dynamic encryption methods. Thanks to our IP, we can mitigate network jamming attacks and safeguard against replay attacks. Only devices that are commissioned on-site can join W-BACnet networks.

Can LumenRadio’s solution coexist with legacy wired BACnet systems? How does that integration work in practice?

Yes! A great example is failing Lon VAV devices. It’s common to upgrade 2-3 end-of-life Lon VAVs to BACnet VAVs without affecting existing infrastructure. As Lon VAVs continue to fail, we can add them to the existing Wireless BACnet network without affecting Lon infrastructure.

Do you have examples or case studies where your wireless BACnet solution delivered significant cost or time savings compared to traditional wired approaches?

We do! A great example is a Resort FCU retrofit where the installers saved 90% on install cost vs. running wire, and with limited impact on the business – I don’t think resort guest would enjoy the sound of drilling holes and someone being in their room!

A big thank you to Maciej for sharing his insights on the evolution of wireless in the BAS space and the innovative work LumenRadio is doing with their Wireless BACnet solution. As buildings continue to grow smarter and more connected, it’s clear that wireless will play a key role in driving both flexibility and efficiency in system design. We look forward to seeing how LumenRadio continues to shape the future of wireless BAS technology.

The post Wireless Without Worries: A Conversation with LumenRadio on the Future of BAS Connectivity appeared first on Smart Building Design.

I sat back down with Aaron Brondum, Sr. Director of Business Development at Neeve, to talk through the technical side of Zero Trust, and how Neeve is helping real-world organizations deploy it in a way that’s actually usable in the field. 

Greg Fitzpatrick, CxA, Business Development Leader, Cochrane Supply

Aaron, thanks for joining me again. Last time we covered the fundamentals of Zero Trust. Today, I want to dive into the more technical side of things. For those out there trying to figure out how to actually apply Zero Trust to an OT network, where should they be thinking about placing the solution? 
 

Aaron Brondum, Sr. Director of Business Development, Neeve

Great question, and placement is everything. In OT networks, the best place to start is at the IT/OT boundary. That’s where the biggest risk is, and it’s where Zero Trust can act as a secure gateway. Every connection trying to cross that boundary gets verified—user identity, device health, even where the traffic is coming from and going to. 

From there, we look inside the OT network and apply micro-segmentation. Instead of treating the entire OT environment as one big trusted zone, we break it into smaller ones, HVAC, lighting, elevators, each with their own access rules. That way, even if something is compromised, it can’t spread. 

Greg:

That makes sense, sort of like building a wall, then putting locks on every door inside it. But what about remote access? That’s where a lot of threats get in. How does Neeve handle that differently? 
 

Aaron: 

Exactly—and you’re right, remote access is the biggest attack vector in most smart buildings today. That’s why we don’t rely on VPNs. VPNs are a one-and-done deal: you authenticate once, and suddenly you’ve got a tunnel to the entire network. 

We use Zero Trust Network Access (ZTNA) instead. It’s more surgical. A technician accessing HVAC controllers only gets access to those, and only for a set time. Every session is authenticated and encrypted, and we can revoke access at any point. It’s dynamic, and it’s role-based. 

Greg:

That’s a huge improvement, especially when you’ve got vendors logging in from who knows where. But what about older systems—those legacy devices in OT that weren’t built with any of this in mind? 

Aaron: 

That’s probably the biggest misconception we hear: “Zero Trust won’t work because my gear is too old.” The truth is, we don’t need the devices themselves to support modern security protocols. 

Neeve secures the network layer, not the device layer. We look at the traffic moving between devices, enforce policies at the edge, and isolate anything that shouldn’t be talking. So even if a 20-year-old controller has no encryption, it can still live inside a secure, Zero Trust architecture. 

Greg: 

So it’s not about upgrading all your gear, it’s about controlling what talks to what? 

Aaron:

Exactly. We like to say: protect the flow, not the box. You don’t need to replace every sensor or controller. You just need to know what normal looks like, then put the guardrails in place to make sure it stays that way. 

Greg: 

Let’s talk monitoring. Zero Trust is all about verification—but what kind of visibility do you need to really make it work? 

Aaron:

You need full telemetry. That’s part of the power of our platform. We offer real-time monitoring of every connection and session—who connected, when, from where, and what they did. That allows us to: 

• Spot anomalies quickly, 
• Detect lateral movement attempts, 
• And adjust access policies dynamically. 

It’s especially useful in OT environments where normal behavior is pretty stable. If a lighting controller suddenly starts trying to talk to an elevator PLC? That’s a red flag. 

Greg: 

That kind of real-time insight would be huge for incident response too. Have you seen this deployed in the real world? 

Aaron:

Yeah—one great example is Kilroy Realty. They came to us with growing concerns around remote vendor access and a need to strengthen security across multiple buildings. 

We started with a risk assessment, then implemented micro-segmentation and ZTNA. Vendors only got access to the exact systems they needed, with MFA and session limits. All traffic was monitored in real time. No more open VPN tunnels. 

The result? Tighter control, better compliance, and no disruptions to building operations. 

Greg: 

That’s the sweet spot—better security, but nothing breaks. So, what are some best practices for firms trying to take this on themselves? 

Aaron: 

Here’s a simple roadmap we’ve seen work: 

1. Start with an asset and communication map. Know what’s connected and how it communicates.

2. Segment your network. Start coarse, then work toward micro-segmentation. 

3. Use role-based access and MFA. Make sure only the right people have access to the right systems. 

4. Replace VPNs with ZTNA. That alone is a major leap forward. 

5. Continuously monitor. Know what’s normal so you can spot what’s not. 

6. Roll out in phases. Don’t try to do the whole network at once. Start where the risk is highest. 

Greg: 

Last question, what do you say to the folks who still think Zero Trust is too expensive or complex? 

Aaron: 

I’d say they’re not wrong to worry, but they’re probably looking at the wrong solutions. Neeve was built specifically for OT environments, so we focus on using what’s already there. We don’t force forklift upgrades. We integrate gradually, and we secure networks that were never built to be secure. 

In most cases, we’re helping organizations improve security without increasing operational cost. That’s the power of doing it right. 

Greg:

This has been incredibly helpful, Aaron. For anyone serious about OT cybersecurity, this kind of approach isn’t just smart, it’s necessary. Zero Trust isn’t a buzzword. It’s a technical strategy that works. And with solutions like Neeve, it’s finally accessible to the people who need it. 

Aaron: 

Appreciate it, Greg. It’s always a pleasure to talk real-world security with someone who gets the OT side. Looking forward to more of these conversations, there’s a lot more ground to cover as this space continues to evolve. 

As OT networks become more connected and remote access becomes more common, a Zero Trust architecture, especially one that can be deployed without disrupting legacy systems, is becoming the new standard. With practical tools like Neeve and a phased deployment strategy, cybersecurity is no longer a barrier to smart building innovation. It’s the foundation. 

The post Part 2: Diving Deeper: The Technical Realities of Zero Trust in OT–A Conversation with Neeve  appeared first on Smart Building Design.

Greg Fitzpatrick, CxA, Business Development Leader, Cochrane Supply:

Hey, Aaron, thanks so much for sitting down to speak with me. Today I wanted to talk to you about Implementing cybersecurity in smart building design. It’s still kind of a new concept for a lot of consulting engineers and systems integrators. They’re often working with the owner’s IT department to integrate smart building technology with an existing IT setup, or they’re setting up a separate OT network. One big question that always comes up from the engineers and integrators is: what’s the best remote access strategy for the standalone OT network? “Zero Trust” comes up a lot, especially in IT circles, but for people who might not be familiar with it, can you explain what Zero Trust really means and why it’s so critical for remote access?

Aaron Brondum, Sr Director Business Development, Neeve:

Yeah, absolutely. Zero Trust is kind of a game-changer in cybersecurity. You know, the traditional approach is that once you’re inside the network, you’re trusted. Zero Trust flips that on its head—it’s more like, “never trust, always verify.” Every single user or device that’s trying to access any resource has to be verified, no matter where they are or how they’re connecting.

When you apply that to smart buildings, especially with remote access, Zero Trust becomes essential for making sure IT and OT systems—which run things like HVAC and lighting—are communicating securely. Let’s say someone’s trying to access the OT network remotely. With Zero Trust, you’re basically saying, “Okay, even though you’re on the network, we’re still going to verify who you are, what device you’re on, and whether you’re authorized to access this specific system.” It’s an extra layer of protection, especially when you’re dealing with sensitive infrastructure.

Greg:

So, it’s not just a blanket trust once you’re in. Every access point gets verified. That makes a lot of sense. And I guess the principle is the same whether you’re dealing with IT or OT networks?

Aaron:

Exactly, but there are some differences in how it’s applied. For example, in IT, you’ve got your standard devices—laptops, phones—things that already come with built-in security. But in OT, you’re working with legacy systems, like sensors and HVAC controllers that were never really designed with cybersecurity in mind. So, you have to adapt the Zero Trust methods in a way that doesn’t disrupt critical operations.

Another big thing is network segmentation. In IT, you might use more fine-grained access controls based on user roles. In OT, you’re segmenting the network to make sure critical systems are isolated, but still allow necessary communication. It’s all about understanding the physical processes of the building systems and securing them without shutting anything down.

Greg:

Got it. And what are some of the key factors to think about when you’re specifying a cyber solution for OT? I mean, it’s not just about security, but you’ve got to make sure it’s easy to deploy and doesn’t disrupt the operations, right?

Aaron:

Yeah, that’s the tricky part—balancing security with ease of deployment. One thing to always keep in mind is segmentation and isolation. You want to make sure that your OT network is separate from the IT network. That way, if there’s a threat in the IT network, it doesn’t spread to critical OT systems like HVAC or elevators.

And then there’s secure remote access. You need strong security, like multi-factor authentication, but also something that integrates Zero Trust principles. A lot of people still rely on VPNs, but the problem with VPNs is that once you’re in, you’ve got access to everything. With Zero Trust, you’re constantly verifying who’s accessing what.

Greg:

What about legacy systems? OT networks are full of older equipment. How do you secure those?

Aaron:

That’s a huge challenge. A lot of these systems weren’t built with cybersecurity in mind, so you’ve got to choose solutions that can work with what’s already there, without requiring expensive upgrades. It’s about securing the network layer, rather than trying to retrofit security onto each individual device.

Greg:

Makes sense. So, let’s say the owner wants a separate OT network. Can we look at a solution that gives remote access but with true firewall capabilities?

Aaron:

Yeah, definitely. The key here is placing a Zero Trust solution right at the edge of the OT network. That way, any communication between IT and OT gets verified. You’re basically creating a secure gateway between the two environments. And if you’re adding remote access, Zero Trust ensures that only authorized users get through, continuously verifying their identity. It’s like a firewall, but with the added security of constant authentication.

Greg:

It sounds like you’re tightening things up at every level, from the edge to the individual systems. How does a solution like NEEVE’s Zero Trust help with the specific challenges of securing remote connectivity in OT systems?

Aaron:

And then, there’s network segmentation again. We create smaller zones within the OT network. So even if someone gets into one area, they can’t jump around and access everything.

NEEVE’s approach is all about continuous identity verification, using things like multi-factor authentication, so it’s not a one-and-done check. Every time someone tries to access the OT system remotely, we verify their identity and the security of their connection. Plus, all the communication is encrypted, so no one’s snooping in on sensitive data.

Greg:

So, even legacy systems are covered under this?

Aaron:

Exactly. A lot of people think Zero Trust can’t work with older OT systems, but that’s not the case. You’re securing the network and monitoring traffic between devices, so you don’t necessarily need to upgrade every single piece of equipment.

Greg:

And what are some of the misconceptions about Zero Trust in OT environments that you run into?

Aaron:

Oh, there are a few. Some folks think Zero Trust will disrupt their operations or be too complex to implement. But the reality is, if it’s done right, it’s actually pretty smooth. For example, with NEEVE, we take a step-by-step approach, integrating it into existing infrastructure without causing downtime. It’s all about making the process as seamless as possible.

And there’s this idea that OT devices can’t support Zero Trust, which, again, isn’t true. Even if the devices are older, we secure the network layer to make sure they’re part of the architecture.

Greg:

It’s like you’re providing a modern security solution, but without needing to overhaul the whole system. That’s huge for these older setups.

Aaron:

Exactly! And it’s also cost-effective. People think Zero Trust is going to break the bank, but we work with what’s already there, so you can roll it out without a massive upfront investment.

Greg:

This has been super insightful, Aaron. Thanks for breaking it down so clearly. Zero Trust seems like a no-brainer for securing OT networks, especially as they’re becoming more integrated with IT.

Aaron:

Absolutely, Greg. It’s becoming more essential every day, especially as smart buildings and OT environments get more complex. Always a pleasure to chat about this stuff! I’m looking forward to diving into a more technical level with you next time.

As the integration of IT and OT systems in smart buildings continues to grow, the importance of a robust cybersecurity strategy, grounded in Zero Trust principles, becomes undeniable. By incorporating Cyber Harmony as an industry-wide approach and applying Zero Trust as a guiding framework, consulting engineers and systems integrators can better protect today’s complex built environments. In our next article, we’ll dive deeper into the technical specifics, exploring advanced Zero Trust architectures, practical deployment strategies, and best practices for overcoming real-world challenges in OT cybersecurity. Stay tuned as we uncover how to fortify smart buildings at every layer.

The post Part 1: Implementing Zero Trust in Smart Buildings, A Cybersecurity Guide for OT Environments appeared first on Smart Building Design.

Cyber Harmony: A Holistic Approach to Cybersecurity

Cyber Harmony is a collaborative framework that ensures all stakeholders involved in a project—engineers, integrators, owners, end-users, and more—are aligned in their understanding and implementation of cybersecurity practices.

Key Principles:

• Importance: With the increasing complexity and interconnectedness of IT (Information Technology) and OT (Operational Technology) systems, a harmonized approach to cybersecurity is vital to protect project integrity and data.
• Goal: Embed cybersecurity best practices into every aspect of hardware and software solutions, from initial specifications to final coordination drawings.
• Roles and Responsibilities: Clearly define the roles and responsibilities of each stakeholder in maintaining a secure environment. This includes engineers, integrators, owners, and IT professionals.
• Layered Approach: Combine technology (e.g., encryption, firewalls) with human elements (e.g., training, awareness) for a robust defense.
• Early Engagement: Engage IT professionals early in the project lifecycle to ensure seamless integration of network and security requirements.
• Owner’s Project Requirements (OPR): Develop a comprehensive OPR document that outlines the owner’s cybersecurity expectations and guides the project’s security measures.

Implementation Phases:

1. Initial Discussions: Understand the owner’s vision and specific requirements for cybersecurity integration.
2. Design: Incorporate cybersecurity measures into the design of both hardware and software solutions.
3. Commissioning: Ensure that all security settings are accurate and systems are updated before deployment.
4. Ongoing Monitoring: Regularly audit networks, update software, and conduct security drills to identify and address vulnerabilities.

Challenges and Considerations:

• Cloud Adoption: While beneficial, cloud migration requires careful planning, leadership buy-in, and addressing security concerns.
• Data Encryption: Implement strong encryption at all levels to protect sensitive information.
• Unauthorized Access: Employ a multi-layered approach, including firewalls, VPNs, and user access controls.
• Backup and Recovery: Establish a dedicated team and process for regular backups and disaster recovery.
• Compliance: Adhere to industry standards (e.g., ISO 27001) and regulations (e.g., SEC) to ensure compliance and maintain a secure network.

Recommendations:

• Consider VPN routers and cellular modems to enhance security and connectivity.
• Evaluate both combined appliances and separate components to determine the best fit for the system.
• Prioritize regular network audits and security updates.
• Integrate information technology asset management (ITAM) to track and manage IT assets effectively.
• Foster collaboration between different departments to address cybersecurity challenges collectively.

The post The Engineer’s & Integrator’s Role in Creating Cyber Harmony appeared first on Smart Building Design.

Some The Key Points:

• CISA’s RFI, published in the Federal Register, seeks information to enhance its Secure by Design campaign.
• Topics include integrating security early into the software development life cycle (SDLC), education, recurring vulnerabilities, AI, operational technology (OT), and addressing the economics of secure design.
• CISA emphasizes the need for diverse perspectives and feedback to strengthen its campaign.
• The President’s National Cybersecurity Strategy calls for a shift in security responsibility from customers to software manufacturers.
• Co-sealed by 18 U.S. and international agencies, CISA’s Secure by Design guidance aims to reduce cybersecurity burdens on customers.
• The RFI seeks feedback on effective security tactics in the SDLC, with a focus on smaller software manufacturers struggling to implement robust practices.
• Input is requested on examples of educational initiatives linking commercial entities, universities, and online programs to enhance security knowledge.
• CISA inquires about the costs incurred by manufacturers in developing secure-by-design products and seeks information on how vulnerabilities impact both manufacturers and customers.
• The RFI addresses customer perceptions of security and explores ways customers request secure products.
• Recurring vulnerabilities are a focal point, with CISA seeking input on barriers to elimination and changes to CVE and CWE programs.
• Threat modeling, especially in OT systems, is highlighted, seeking examples of public threat models and best practices for demonstrating robust threat modeling programs.
• CISA urges manufacturers and stakeholders to provide written comments by Feb. 20, 2024, to inform future iterations of their whitepaper and collaborative efforts with the global community.

In conclusion, the information gathered through CISA’s Request for Information (RFI) serves as a crucial resource for enhancing the cybersecurity of Operational Technology (OT) deployments. By addressing key areas such as integrating security into the software development life cycle, education, recurring vulnerabilities, and threat modeling in OT systems, the insights obtained can guide the development of more cyber-secure OT solutions.

The emphasis on diverse perspectives, feedback from manufacturers, and understanding the economic aspects of secure design contributes to a comprehensive approach. Ultimately, this initiative facilitates the creation of robust, secure-by-design OT deployments, aligning with CISA’s global campaign to reduce cybersecurity burdens on customers and foster a safer technological landscape.

Greg is currently the Business Development Leader for Building IoT and Integration for Cochrane Supply & Engineering. In 2022, Greg was was appointed to the role of Executive Director for the Real Estate Cyber Consortium (RECC), promoting “cyber harmony” through leadership and insight on best practices, policies, and procedures for real estate owners, operators, and solution providers.

The post CISA’s challenge to a major stakeholder in the “Cyber Harmony” Model- The Manufacturer appeared first on Smart Building Design.

For the past five years, I’ve traveled across the country, engaging in discussions with consulting engineers about the integration of IP technology into their smart building designs.  In most cases, I’ve found that these firms are enthusiastic about incorporating IP Technology into their strategies.

In June 2023, I authored an article for Realcomm’s Edge Magazine titled “Creating A Path To Cyber Harmony – Challenging Commercial Real Estate’s Supply Chain,” where I briefly emphasize the significance of cyber awareness for commercial real estate owners and all project stakeholders, including consulting engineers.

While IP technology holds immense potential for smart building design, its implementation introduces new challenges in terms of cybersecurity and potential risks for consulting engineers. The consulting engineering community must recognize that cybersecurity is pivotal in deploying Operational Technology (OT) during the construction process.

OT systems, such as building automation and control systems, are increasingly interconnected and susceptible to cyber threats. The recent cyberattacks to MGM & Caesars properties in Las Vegas, and to building controls manufacturers, underscore the urgency of addressing cyber risks in the construction industry.

Robust cybersecurity measures safeguard not only sensitive construction data but also the physical infrastructure. This protection prevents potential disruptions, unauthorized access, or sabotage, ensuring the safety, efficiency, and integrity of construction projects. But, as we are experiencing, these devices are limited for shielding against the growing sophistication of the costly ransomware of today’s hackers.

Concentrated threats to properties and controls manufacturers are alarming, and with SEC’s approval of new cybersecurity disclosure rules, consulting engineers must elevate their cyber awareness and comprehend how to incorporate the necessary hardware and software to address cybersecurity concerns in their designs and specifications.

Cybersecurity Expertise to Achieve “Cyber Harmony”

With over 30 years in the consulting industry my aim has always been to simplify the process of designing and specifying OT and integration, making it as clear and concise as possible. Cybersecurity is no exception.

Earlier this year I accepted the role as the Executive Director of the Real Estate Cyber Consortium (RECC), where I’m striving to foster a movement towards ‘Cyber Harmony’ across the industry.

It is important to bridge the gap between facilities and IT departments, and implementing internal OT teams. My goal is to achieve “Cyber Harmony” through increased collaboration among diverse stakeholders, promoting activities such as knowledge sharing, best practice documentation, podcasts, and other communication channels to ultimately develop best practices and standards for the industry.

My objective is to streamline the fundamental cybersecurity requirements for consulting engineers, making these principles an integral part of the designer’s drawings and specifications when creating construction documents for building systems.

In any given project, there is typically a discovery phase where the designer must ask essential questions before proceeding. Incorporating cybersecurity into your design follows a similar pattern. Here are some key points to clarify during the discovery phase to determine your cybersecurity strategy:

1. Determine whether you are deploying IP devices on the owner’s network or designing a separate OT network that supports various building technologies. If the owner manages all OT, the designer’s responsibility is to ensure data encryption, while firewalls and VPN strategy fall under the owner’s IT department.

2. If the designer is responsible for a separate OT network, they must understand how to incorporate cybersecurity into the design.

Strategy First: Planning for Cybersecurity is Paramount

When considering essential design prerequisites for cybersecurity in your OT Network, assuming the owner prefers complete separation of the OT from their IT network (air gapped), I recommend these four tips:

1. Ensure that the specified OT Network solution offers robust port security capabilities, both in software and through the ability to bind device MAC addresses. This is critical to safeguard against unauthorized access. Optigo provides an OT network solution with the necessary port security and unified management through a user-friendly interface.

2. Implement robust data encryption mechanisms for network traffic, which can be achieved through various methods, including BAS system web supervisors, dedicated gateway devices, or BACnet Secure Connect (BACnet SC) using Tridium’s Niagara. This ensures data confidentiality and protection against threats.

3. Prioritize security when facilitating remote access to the network via the internet. Specify a firewall solution and establish a secure Virtual Private Network (VPN) appliance and strategy for remote access. This multi-layered approach enhances network security.

4. Collaborate with the end user on a VPN strategy for remote access and select a secure VPN appliance. TosiBox offers a product known for its ease of deployment and security features, popular among systems integrators.

Incorporating Your Cybersecurity Strategy into Your Construction Documents

Once a cybersecurity strategy is determined for our design, the question often arises: “How do I incorporate cybersecurity into my construction documents?

As a general practice, it’s wise to include as much detail as possible on your drawings and provide further clarification in the specifications. I advocate for the use of a detailed “Systems Integration Drawing” as the foundation for conveying intent to the master systems integrator (MSI). This drawing should display the OT network layout and the hardware used in your cybersecurity strategy.

The use of this drawing allows the designer show:

• Deployment location of the supervisory software
• VPN hardware/software
• Cell Modem
• Firewall
• OT Network router
• OT Network management switch(s)
• OT Network media
• IP switch types and locations
• Gateway devices
• Server (where applicable)
• Subnetwork media
• Technology being integrated
• OT Network MDF location and installed hardware

SmartBuildingDesign.com has the resources to help you need for ensuring strong cybersecurity for any OT Network

At SmartBuildingDesing.com we have detailed Systems Integration Drawings available here: https://www.smartbuildingdesign.com/system-architecture/

Regarding specifications, I recommend using Division 25 – Integrated Automation as the section for hardware and software related to your cybersecurity strategy. Examples of Division 25 specifications are available on our Guide Specifications page.

Incorporating these measures into your OT Network design not only reduces your risk as a designer but significantly enhances your client’s cybersecurity posture, reducing vulnerabilities and ensuring the safety and integrity of their critical operations.

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Cybersecurity Awareness 2023: Achieving Cyber Harmony in a Fragmented Industry appeared first on Smart Building Design.

Here are 10 of the main take-aways from his article:

• Real Estate Cyber Consortium (RECC) was formed in 2016 to address rising cyber threats in commercial real estate.
• RECC is a leading force in driving cybersecurity standards for the built environment.
• RECC represents over 45 organizations responsible for 12.5 billion sq. ft. of property management worldwide.
• RECC’s leadership board meets monthly to share insights on best practices and industry trends.
• 2023’s hot topics include network monitoring tools, risk frameworks, incident response plans, and integrating cyber into construction.
• Focus on the effect of operational technology (OT) on managing and securing built environments.
• Goal is to achieve “Cyber Harmony” through collaboration and adoption of best practices and specifications.
• There is a need for thought leaders to come together from various disciplines in the industry.
• It is important to bridge the gap between facilities and IT departments and implementing internal OT teams.
• The industry need to collectively develop a commercial real estate OT playbook, with advancements in technology and industry protocols.

Read Full Article Here

The post Real Estate Cyber Consortium (RECC): Creating a Path to Cyber Harmony appeared first on Smart Building Design.

This year marked my first attendance at the RealComm | IBCon Conference, and I must say that describing it as exciting would be an understatement.

RealComm | IBcon 2023 commemorated its 25th anniversary from June 13-15 in Las Vegas. The 3-day commercial real estate technology conference commenced with a day of pre-conference programs, where I led the day off with The Real Estate Cyber Consortium’s CRE Cybersecurity Forum.

Beginning at 9:00 am Tuesday morning, the CRE Cybersecurity Forum was eagerly anticipated by industry experts, professionals, and thought leaders, with few seats left unfilled. The session fostered discussions on the ever-evolving landscape of cybersecurity in real estate and technology.

We covered a wide range of topics, from nation state threats to the integration of cyber measures into the construction process. With an engaged audience of approximately 300 people, the session generated valuable takeaways. It was both an honor to host and participate in the event’s discussions.

Check out some highlights from “Integrating Cyber into New Construction and Commissioning Across Asset Classes” with Thano Lambrinos of QuadReal Property Group and Fred Gordy of Michael Baker International.

Throughout the conference, the vendor showroom buzzed with activity, featuring special interviews on the RealComm Live stage. I was ecstatic with overall traffic the RECC booth attracted while I shared the exhibit floor with some of the top manufacturers in the building controls industry showing the latest automated business solutions and state-of-the-art enterprise technologies tailored for the commercial and corporate real estate industry.

On the third day, I had the pleasure of leading an OT Network Design and Configuration Workshop, as one of the final sessions of the entire conference. Despite my initial expectations of a lightly attended session, the room was packed with an enthusiastic audience, eager to ask questions and share their experiences. By the workshop’s conclusion, participants had gained practical knowledge and skills necessary to effectively configure and manage OT networks. This newfound expertise enables them to enhance operational efficiency, resilience, and cybersecurity within their respective real estate organizations.

RealComm 2023 was brimming with countless memorable moments, leaving a lasting impact on both myself and the attendees. The industry will undoubtedly continue buzzing until 2024, when we come together once again for another remarkable event!

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Realcomm | IBcon 2023 Recap: Creating Cyber Harmony in Commercial Real Estate and Its Supply Chain appeared first on Smart Building Design.

Here are some key points mentioned during the conversation:

1. Greg’s role: Greg mentioned that he works with consulting engineers to help them understand and write specifications based on new technologies and network requirements in building automation controls.
2. New website for consulting engineers: Cochrane Supply is launching a new website specifically for consulting engineers. This website will provide resources and best practices for smart building and building automation controls and control networks.
3. Differences between IP controls and traditional controls: Greg talked about the shift towards IP controls and more IoT-type technologies. He discussed the differences between IP (Internet Protocol) and MSTP (Master-Slave/Token-Passing) and highlighted the importance of understanding IP network solutions for the facility world.
4. Basic design principles for IP networks: Greg mentioned the importance of following basic design principles when setting up an IP network for building automation. This ensures a reliable and secure network infrastructure.
5. Consultants as trusted advisors: Greg emphasized the role of consulting engineers as trusted advisors. They play a crucial role in guiding clients and helping them make informed decisions regarding open systems and new technologies.
6. Evolution of consulting engineering: The discussion touched upon the evolving nature of consulting engineering, moving from one-to-one interactions to a more comprehensive and consultative approach.
7. Importance of consulting engineers: Greg highlighted the significance of consulting engineers and their contributions to the industry. He shared his own experience working for a small firm in the early 90s and the value consultants bring to projects.
8. Greg’s roadshow and ICcon: Greg talked about his roadshow, which is different from the early days of building automation controls. He also mentioned his upcoming involvement at ICcon (presumably an industry conference) and the cyber forum scheduled for the event.
9. Cybersecurity and real estate industry: The concept of “cyber harmony” was discussed in relation to the real estate industry. Best practice groups and the Real Estate Cyber Consortium were mentioned as initiatives focused on promoting cybersecurity in the industry.
10. Continuous learning and expertise: Greg emphasized the importance of staying relevant and understanding what an expert looks like, even if one may not be an expert in every aspect. Continuous learning and awareness of industry trends are key.

We want to thank Eric for having Greg on his show to share his expertise and knowledge.

The post Interview: Greg Fitzpatrick joins Eric Stromquist of ControlTrends Podcast (6/9/2023) appeared first on Smart Building Design.

Greg Fitzpatrick, CxA

Business Development Leader- IoT and Integration-Cochrane Supply and Engineering

Interviewed:

The BAS Team from Limbach Company Pontiac, MI.

• John Glaeser – Controls Group Manager 
• Ernie Bristle
• Chris Panek
• Kody Immink
• Irawat Singh
• Rob Melvin

One of the things that always helps with establishing best practices in any industry, is a deep dive into lessons learned.  When exploring the world of IP technology and OT networks, there are several areas of deployment that can present a learning curve.  I had the pleasure of speaking with the controls group at Limbach Company about some of their experiences while deploying this new technology.

1.  GREG: How long has Limbach been exploring the possible use of IP devices and what made you comfortable in deploying these devices and their supporting networks in your customer’s buildings, considering that this technology is still new to the industry?

Ernie:  Over the course of the last two years we have seen the interest grow, more so with our new construction projects. It has been mostly a customer-driven request.

John:  We have also had situations in existing buildings where the existing MSTP network was not in the area where we needed to add a device but extending the IP network was a much easier and cost-effective option.

Kody: Our control division at Limbach has been considering the use of IP-based controllers since their inception. The determining factor has always been either the design specification or the customer’s preference. We have influence over this decision on a case-by-case basis. In general, we prefer the use of IP controllers for primary equipment (AHUs, Plant Controllers, primary systems, etc.)

2. GREG: According to technical documentation everywhere, we know that BacNet over IP devices can be up to 1,000 times faster than the fastest MS/TP devices.  As an MSI how have you found this increase in communication speed to benefit the overall performance of the network and the Building Management System?

Ernie: There is a better response time to accessing the information from IP Based devices.  The one area that still needs improvement is with Distech’s Envysion software.  Its graphical interface doesn’t load quickly.  The ability to take advantage of the increased communication speed depends on the underlying network layout and topology.

Rob: Programming devices and downloading controllers is much quicker and easier with IP networks and devices.  It cuts down on programming and commissioning time.

Chris: Having greater control over the BMS network installation provided a number of benefits on a new construction project.  We were able to have the network ready to go for commissioning and for running and monitoring temporary heating and cooling. 

Kody: We primarily see the benefits of this speed increase when it comes to programming and commissioning. The substantial speed increase allows our control technicians to tune PID loops and control logic at a faster pace. We are also able to tune the BACnet network for faster polling when utilizing IP-based controllers. This allows for more responsive graphics and trend charts.

3. GREG: We know that BacNet MS/TP devices are supported by an RS/485 network, unlike IP devices that are supported by an IP/OT network.  How would you describe your installation group’s experience with designing, deploying, and commissioning an IP network………  Has it been a major learning curve?  If so, has the learning curve been worth it to your company considering you’re now able to provide the latest technology to your customers?

Ernie: I cannot speak of new installations. However, the site that I have been working on already was using IP Based equipment and we are replacing it. No real learning curve there.  As an experienced IT person, I have found the customer’s existing IP infrastructure can be improved for more efficiency and fewer single point of failure.

Kody: We have had tremendous success when installing a dedicated OT network. The use of Optigo Network’s fiber optic technology has allowed us to program, integrate and commission our systems at a faster pace. It also allows us to be more agile and responsive to our customer’s future requests. Having the ability to add IP devices, assign IP addresses, create VLANs, and secure switch ports on an OT network has proved to be extremely beneficial for new and existing projects.

4. GREG: I’ve talked to a few MSIs across the country and they say that programming and commissioning IP devices is much faster than MS/TP devices and that they have experienced significant labor savings.  Has Limbach gotten to the point where you see those benefits?  Either way can explain the feedback that you are getting from your installation group regarding the differences between the two devices.

Ernie: Based on using Distech IP-based equipment, I can see the quick response while commissioning the controllers.

Kody: IP-based controllers are absolutely faster in regards to programming and commissioning. The responsiveness and faster update times when making changes to the control logic is an absolute game changers.

5. GREG: Do feel like your experience with deploying IP/OT networks will make your company that much savvier when attacking large integrations with several technologies being deployed by multiple contractors?  If so, which areas do you think will benefit the most…….  Does it help in areas like coordination, commissioning, and data aggregation or are you seeing other areas?

Ernie: With proper planning and design, the biggest benefits will be commissioning along with troubleshooting.  With BacNet, every piece of equipment is daisy-chained and with an IP backbone that isn’t required.

Kody: The utilization of an OT network is absolutely crucial when it comes to being able to program, integrate and commission DDC controllers with a more efficient, reliable, and cost-effective approach. We have seen a significant reduction in the amount of time required to get our equipment connected and programmed when utilizing an OT network.

6. GREG: One of the major areas of concern with owner IT departments, when MSIs install these networks and connect them to the internet, is cyber security.  Have you found that the industry has provided products that address cyber security while giving you VPN access?  If so, have these products been easy to deploy?

Ernie: An IT department can set up VLANs strictly for the BMS Equipment and they can not only create firewall rules on the managed switches but also create a secure single point of entry from the internet, thus removing the potential need to have cyber security on each piece of BMS equipment.

Kody: Cyber security is absolutely a valid concern in today’s world. The advantage that installing an OT network has is that it is largely isolated from the customer’s production IT network infrastructure. Utilizing Optigo Network’s ‘OneClick Secure’ we are able to whitelist authorized MAC addresses and block any unauthorized access to edge switch ports. This allows us, as the MSI to take a security-first approach. We have also been able to have secure VPN remote access through the use of the Tosibox Lock 500. Tosibox’s use of industry-standard encryption has allowed us to maintain confidence that accessing the remote customer site is safe and secure.

7.  GREG: Do you see Limbach using IP devices more often when doing negotiated work and design-build projects where you are making the decision regarding the technology being deployed in your customer’s buildings?

Ernie: Limbach will continue to pursue using IP devices when the choice makes
the most sense. In new installations, we will recommend it to the customer for
speed, efficiency, and down-the-road troubleshooting.
Kody: Limbach will certainly continue to recommend the use of OT networks for
the underlying BMS infrastructure in every project. We will also continue to
recommend the use of IP-based controllers for primary equipment such as AHUs,
Plant Controllers, and primary systems.
GREG: It sounds like Limbach has embraced the rapid change in our industry and you
guys are attacking it head-on! After experiencing the advantages and efficiencies
during installation, and hearing Kody use words like “Game Changer”, it appears that
you guys will be rapidly moving out of the “MSTP Zone” and moving toward offering
the latest building technology and future-proofing your customer’s buildings!
John: That’s Definitely the plan!

The post NEW IP Technology is being deployed in BAS projects today appeared first on Smart Building Design.