Cyber Harmony: A Holistic Approach to Cybersecurity

Cyber Harmony is a collaborative framework that ensures all stakeholders involved in a project—engineers, integrators, owners, end-users, and more—are aligned in their understanding and implementation of cybersecurity practices.

Key Principles:

• Importance: With the increasing complexity and interconnectedness of IT (Information Technology) and OT (Operational Technology) systems, a harmonized approach to cybersecurity is vital to protect project integrity and data.
• Goal: Embed cybersecurity best practices into every aspect of hardware and software solutions, from initial specifications to final coordination drawings.
• Roles and Responsibilities: Clearly define the roles and responsibilities of each stakeholder in maintaining a secure environment. This includes engineers, integrators, owners, and IT professionals.
• Layered Approach: Combine technology (e.g., encryption, firewalls) with human elements (e.g., training, awareness) for a robust defense.
• Early Engagement: Engage IT professionals early in the project lifecycle to ensure seamless integration of network and security requirements.
• Owner’s Project Requirements (OPR): Develop a comprehensive OPR document that outlines the owner’s cybersecurity expectations and guides the project’s security measures.

Implementation Phases:

1. Initial Discussions: Understand the owner’s vision and specific requirements for cybersecurity integration.
2. Design: Incorporate cybersecurity measures into the design of both hardware and software solutions.
3. Commissioning: Ensure that all security settings are accurate and systems are updated before deployment.
4. Ongoing Monitoring: Regularly audit networks, update software, and conduct security drills to identify and address vulnerabilities.

Challenges and Considerations:

• Cloud Adoption: While beneficial, cloud migration requires careful planning, leadership buy-in, and addressing security concerns.
• Data Encryption: Implement strong encryption at all levels to protect sensitive information.
• Unauthorized Access: Employ a multi-layered approach, including firewalls, VPNs, and user access controls.
• Backup and Recovery: Establish a dedicated team and process for regular backups and disaster recovery.
• Compliance: Adhere to industry standards (e.g., ISO 27001) and regulations (e.g., SEC) to ensure compliance and maintain a secure network.

Recommendations:

• Consider VPN routers and cellular modems to enhance security and connectivity.
• Evaluate both combined appliances and separate components to determine the best fit for the system.
• Prioritize regular network audits and security updates.
• Integrate information technology asset management (ITAM) to track and manage IT assets effectively.
• Foster collaboration between different departments to address cybersecurity challenges collectively.

The post The Engineer’s & Integrator’s Role in Creating Cyber Harmony appeared first on Smart Building Design.

Some The Key Points:

• CISA’s RFI, published in the Federal Register, seeks information to enhance its Secure by Design campaign.
• Topics include integrating security early into the software development life cycle (SDLC), education, recurring vulnerabilities, AI, operational technology (OT), and addressing the economics of secure design.
• CISA emphasizes the need for diverse perspectives and feedback to strengthen its campaign.
• The President’s National Cybersecurity Strategy calls for a shift in security responsibility from customers to software manufacturers.
• Co-sealed by 18 U.S. and international agencies, CISA’s Secure by Design guidance aims to reduce cybersecurity burdens on customers.
• The RFI seeks feedback on effective security tactics in the SDLC, with a focus on smaller software manufacturers struggling to implement robust practices.
• Input is requested on examples of educational initiatives linking commercial entities, universities, and online programs to enhance security knowledge.
• CISA inquires about the costs incurred by manufacturers in developing secure-by-design products and seeks information on how vulnerabilities impact both manufacturers and customers.
• The RFI addresses customer perceptions of security and explores ways customers request secure products.
• Recurring vulnerabilities are a focal point, with CISA seeking input on barriers to elimination and changes to CVE and CWE programs.
• Threat modeling, especially in OT systems, is highlighted, seeking examples of public threat models and best practices for demonstrating robust threat modeling programs.
• CISA urges manufacturers and stakeholders to provide written comments by Feb. 20, 2024, to inform future iterations of their whitepaper and collaborative efforts with the global community.

In conclusion, the information gathered through CISA’s Request for Information (RFI) serves as a crucial resource for enhancing the cybersecurity of Operational Technology (OT) deployments. By addressing key areas such as integrating security into the software development life cycle, education, recurring vulnerabilities, and threat modeling in OT systems, the insights obtained can guide the development of more cyber-secure OT solutions.

The emphasis on diverse perspectives, feedback from manufacturers, and understanding the economic aspects of secure design contributes to a comprehensive approach. Ultimately, this initiative facilitates the creation of robust, secure-by-design OT deployments, aligning with CISA’s global campaign to reduce cybersecurity burdens on customers and foster a safer technological landscape.

Greg is currently the Business Development Leader for Building IoT and Integration for Cochrane Supply & Engineering. In 2022, Greg was was appointed to the role of Executive Director for the Real Estate Cyber Consortium (RECC), promoting “cyber harmony” through leadership and insight on best practices, policies, and procedures for real estate owners, operators, and solution providers.

The post CISA’s challenge to a major stakeholder in the “Cyber Harmony” Model- The Manufacturer appeared first on Smart Building Design.

For the past five years, I’ve traveled across the country, engaging in discussions with consulting engineers about the integration of IP technology into their smart building designs.  In most cases, I’ve found that these firms are enthusiastic about incorporating IP Technology into their strategies.

In June 2023, I authored an article for Realcomm’s Edge Magazine titled “Creating A Path To Cyber Harmony – Challenging Commercial Real Estate’s Supply Chain,” where I briefly emphasize the significance of cyber awareness for commercial real estate owners and all project stakeholders, including consulting engineers.

While IP technology holds immense potential for smart building design, its implementation introduces new challenges in terms of cybersecurity and potential risks for consulting engineers. The consulting engineering community must recognize that cybersecurity is pivotal in deploying Operational Technology (OT) during the construction process.

OT systems, such as building automation and control systems, are increasingly interconnected and susceptible to cyber threats. The recent cyberattacks to MGM & Caesars properties in Las Vegas, and to building controls manufacturers, underscore the urgency of addressing cyber risks in the construction industry.

Robust cybersecurity measures safeguard not only sensitive construction data but also the physical infrastructure. This protection prevents potential disruptions, unauthorized access, or sabotage, ensuring the safety, efficiency, and integrity of construction projects. But, as we are experiencing, these devices are limited for shielding against the growing sophistication of the costly ransomware of today’s hackers.

Concentrated threats to properties and controls manufacturers are alarming, and with SEC’s approval of new cybersecurity disclosure rules, consulting engineers must elevate their cyber awareness and comprehend how to incorporate the necessary hardware and software to address cybersecurity concerns in their designs and specifications.

Cybersecurity Expertise to Achieve “Cyber Harmony”

With over 30 years in the consulting industry my aim has always been to simplify the process of designing and specifying OT and integration, making it as clear and concise as possible. Cybersecurity is no exception.

Earlier this year I accepted the role as the Executive Director of the Real Estate Cyber Consortium (RECC), where I’m striving to foster a movement towards ‘Cyber Harmony’ across the industry.

It is important to bridge the gap between facilities and IT departments, and implementing internal OT teams. My goal is to achieve “Cyber Harmony” through increased collaboration among diverse stakeholders, promoting activities such as knowledge sharing, best practice documentation, podcasts, and other communication channels to ultimately develop best practices and standards for the industry.

My objective is to streamline the fundamental cybersecurity requirements for consulting engineers, making these principles an integral part of the designer’s drawings and specifications when creating construction documents for building systems.

In any given project, there is typically a discovery phase where the designer must ask essential questions before proceeding. Incorporating cybersecurity into your design follows a similar pattern. Here are some key points to clarify during the discovery phase to determine your cybersecurity strategy:

1. Determine whether you are deploying IP devices on the owner’s network or designing a separate OT network that supports various building technologies. If the owner manages all OT, the designer’s responsibility is to ensure data encryption, while firewalls and VPN strategy fall under the owner’s IT department.

2. If the designer is responsible for a separate OT network, they must understand how to incorporate cybersecurity into the design.

Strategy First: Planning for Cybersecurity is Paramount

When considering essential design prerequisites for cybersecurity in your OT Network, assuming the owner prefers complete separation of the OT from their IT network (air gapped), I recommend these four tips:

1. Ensure that the specified OT Network solution offers robust port security capabilities, both in software and through the ability to bind device MAC addresses. This is critical to safeguard against unauthorized access. Optigo provides an OT network solution with the necessary port security and unified management through a user-friendly interface.

2. Implement robust data encryption mechanisms for network traffic, which can be achieved through various methods, including BAS system web supervisors, dedicated gateway devices, or BACnet Secure Connect (BACnet SC) using Tridium’s Niagara. This ensures data confidentiality and protection against threats.

3. Prioritize security when facilitating remote access to the network via the internet. Specify a firewall solution and establish a secure Virtual Private Network (VPN) appliance and strategy for remote access. This multi-layered approach enhances network security.

4. Collaborate with the end user on a VPN strategy for remote access and select a secure VPN appliance. TosiBox offers a product known for its ease of deployment and security features, popular among systems integrators.

Incorporating Your Cybersecurity Strategy into Your Construction Documents

Once a cybersecurity strategy is determined for our design, the question often arises: “How do I incorporate cybersecurity into my construction documents?

As a general practice, it’s wise to include as much detail as possible on your drawings and provide further clarification in the specifications. I advocate for the use of a detailed “Systems Integration Drawing” as the foundation for conveying intent to the master systems integrator (MSI). This drawing should display the OT network layout and the hardware used in your cybersecurity strategy.

The use of this drawing allows the designer show:

• Deployment location of the supervisory software
• VPN hardware/software
• Cell Modem
• Firewall
• OT Network router
• OT Network management switch(s)
• OT Network media
• IP switch types and locations
• Gateway devices
• Server (where applicable)
• Subnetwork media
• Technology being integrated
• OT Network MDF location and installed hardware

SmartBuildingDesign.com has the resources to help you need for ensuring strong cybersecurity for any OT Network

At SmartBuildingDesing.com we have detailed Systems Integration Drawings available here: https://www.smartbuildingdesign.com/system-architecture/

Regarding specifications, I recommend using Division 25 – Integrated Automation as the section for hardware and software related to your cybersecurity strategy. Examples of Division 25 specifications are available on our Guide Specifications page.

Incorporating these measures into your OT Network design not only reduces your risk as a designer but significantly enhances your client’s cybersecurity posture, reducing vulnerabilities and ensuring the safety and integrity of their critical operations.

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Cybersecurity Awareness 2023: Achieving Cyber Harmony in a Fragmented Industry appeared first on Smart Building Design.

Here are 10 of the main take-aways from his article:

• Real Estate Cyber Consortium (RECC) was formed in 2016 to address rising cyber threats in commercial real estate.
• RECC is a leading force in driving cybersecurity standards for the built environment.
• RECC represents over 45 organizations responsible for 12.5 billion sq. ft. of property management worldwide.
• RECC’s leadership board meets monthly to share insights on best practices and industry trends.
• 2023’s hot topics include network monitoring tools, risk frameworks, incident response plans, and integrating cyber into construction.
• Focus on the effect of operational technology (OT) on managing and securing built environments.
• Goal is to achieve “Cyber Harmony” through collaboration and adoption of best practices and specifications.
• There is a need for thought leaders to come together from various disciplines in the industry.
• It is important to bridge the gap between facilities and IT departments and implementing internal OT teams.
• The industry need to collectively develop a commercial real estate OT playbook, with advancements in technology and industry protocols.

Read Full Article Here

The post Real Estate Cyber Consortium (RECC): Creating a Path to Cyber Harmony appeared first on Smart Building Design.

This year marked my first attendance at the RealComm | IBCon Conference, and I must say that describing it as exciting would be an understatement.

RealComm | IBcon 2023 commemorated its 25th anniversary from June 13-15 in Las Vegas. The 3-day commercial real estate technology conference commenced with a day of pre-conference programs, where I led the day off with The Real Estate Cyber Consortium’s CRE Cybersecurity Forum.

Beginning at 9:00 am Tuesday morning, the CRE Cybersecurity Forum was eagerly anticipated by industry experts, professionals, and thought leaders, with few seats left unfilled. The session fostered discussions on the ever-evolving landscape of cybersecurity in real estate and technology.

We covered a wide range of topics, from nation state threats to the integration of cyber measures into the construction process. With an engaged audience of approximately 300 people, the session generated valuable takeaways. It was both an honor to host and participate in the event’s discussions.

Check out some highlights from “Integrating Cyber into New Construction and Commissioning Across Asset Classes” with Thano Lambrinos of QuadReal Property Group and Fred Gordy of Michael Baker International.

Throughout the conference, the vendor showroom buzzed with activity, featuring special interviews on the RealComm Live stage. I was ecstatic with overall traffic the RECC booth attracted while I shared the exhibit floor with some of the top manufacturers in the building controls industry showing the latest automated business solutions and state-of-the-art enterprise technologies tailored for the commercial and corporate real estate industry.

On the third day, I had the pleasure of leading an OT Network Design and Configuration Workshop, as one of the final sessions of the entire conference. Despite my initial expectations of a lightly attended session, the room was packed with an enthusiastic audience, eager to ask questions and share their experiences. By the workshop’s conclusion, participants had gained practical knowledge and skills necessary to effectively configure and manage OT networks. This newfound expertise enables them to enhance operational efficiency, resilience, and cybersecurity within their respective real estate organizations.

RealComm 2023 was brimming with countless memorable moments, leaving a lasting impact on both myself and the attendees. The industry will undoubtedly continue buzzing until 2024, when we come together once again for another remarkable event!

Greg Fitzpatrick, CxA
Business Development Leader- IoT and Integration, Cochrane Supply and Engineering
Executive Director, Real Estate Cyber Consortium

The post Realcomm | IBcon 2023 Recap: Creating Cyber Harmony in Commercial Real Estate and Its Supply Chain appeared first on Smart Building Design.