Cybersmart Government Buildings: Securing Investments in Connectivity and Automation

ALEX RUNNER Jason Rosselot Sedar labarre Will Farrell Johnson Controls Director Thought Leadership & Executive Communications Jason Rosselot Johnson Controls Director Product Security Sedar labarre Booz Allen Hamilton Vice President Commercial Cyber Strategy Will Farrell Booz Allen Hamilton Director Booz Allen Dark Labs

WHY ARE WE HERE TODAY? BOTTOM LINE Yesterday: Partial Connectivity Today: Smart Buildings Tomorrow: Smart Cities All industries are making smart building investments (seeking reward) Cyber incidents threaten the smart building value proposition Cybersecurity must become a core tenet of building design and operations (to guarantee that investment) BOTTOM LINE

WHAT IS A “SMART” BUILDING? On the outside, smart, data-driven solutions may not be apparent… …but connectivity is creating value for building owners and operators.

HOW ARE KEY SECTORS AFFECTED? INDUSTRY-SPECIFIC SMART BUILDING SOLUTIONS HEALTHCARE GOVERNMENT Real-Time Location Systems (RTLS) Critical temperature control Operating room environments Electronic record-keeping Integrated patient care Access controls & physical security Energy management Sensitive environment monitoring Smart infrastructure Integrated asset tracking HIGHER EDUCATION TRANSPORTATION Streaming video management Campus-wide system alerting Mobile-friendly presentation spaces Integrated class registration Optimized lighting Real-Time Location Systems (RTLS) HVAC temperature control Physical security Passenger identification systems Arrival/departure prediction K-12 EDUCATION COMMERCIAL BUILDINGS Smart whiteboards Optimized lighting HVAC, data-driven building management Space scheduling integration District-wide performance tracking Access controls & physical security HVAC temperature control Energy management Real-time data analysis Meeting space optimization Across industries, technology is redefining how buildings and occupants interact – saving energy, increasing security and optimizing operations

ANTICIPATED INVESTMENT BREAKS APART INVESTMENT AT RISK NEW VALUE PROPOSITION ANTICIPATED INVESTMENT BREAKS APART CYBER RISKS Automated Management Predictive Maintenance Denial of Service Attack Vendor IoT Product Compromise Energy Efficiency Asset Location Finding Occupant Data Theft Hijack of Command & Control App As an owner/operator/manger, you’re trusting you’ll get ROI: optimized operations and lower facility costs, while increasing safety and sustainability But these rewards are at risk: you’ve established a large attack surface and cyber threat actors are after this environment This also means critical infrastructure is at risk – our society, economy, security, and health SECURITY IMPERATIVE Pervasive connectivity means more vulnerabilities across a larger attack surface Many threat vectors can potentially harm connected infrastructure Occupant health/safety and environment now depends on cyber security

FACING OUR CURRENT REALITY REPORTED INDUSTRIAL CONTROL SYSTEM VULNERABILITIES SAMPLE CYBER INCIDENTS 500 400 LARGE INTERNET SEARCH PROVIDER Researchers hack building control system of key facility; able to obtain command and control 300 200 100 CHINESE HOTEL Hacker infiltrated hotel room automation system via Wi-Fi; established ability to manipulate room control systems and steal customer data Source: ICS-CERT 2015 Annual Vulnerability Coordination Report SOURCES OF THREATS TO INDUSTRIAL COMPUTERS Internet Removable Media INTERNET DOMAIN NAME SYSTEM PROVIDER Largest distributed denial-of-service (DDoS) attack in history uses massive number of compromised IoT devices to swarm its target and cause major internet outages Email Clients Archives (Backup) Network Shares Windows Backup Copies Cloud Storage Source: Kaspersky Lab ICS CERT, Threat Landscape for Industrial Automation Systems in the Second Half of 2016

BUILDINGS NEED TO BE CYBERSMART WHAT’S A CYBERSMART BUILDING? WHO PLAYS A ROLE? Security by design for new; retrofit options for established buildings IT and operational technology (OT) assets are mapped and zoned for risk management Vulnerability management function in place for connected devices and infrastructure Passive monitoring for critical assets to understand non-baseline anomalies (e.g., network scanning, controller re-flash) Cyber incident response plan is developed and exercised by relevant stakeholders EVOLVING GUIDANCE

KEY CONSIDERATIONS FOR TAKING ACTION WHAT TO DO Observe and orient around your specific challenge 1 LIFECYCLE PHASE Forget old silos — cybersecurity requires cross-functional teaming 2 Acquisition Deployment Operations & Maintenance Change the culture — speak up for cybersmart buildings Consider Security Requirements Assess Build in Security Update Regularly Test, Monitor & Respond 3 Build the right capabilities to enable – not hinder – smart building adoption 4 Cyber Capabilities Finally, get operational 5