Cyber Security for Building Management A CIOs view

Fortium Partners National consulting firm of senior CIOs and CISOs providing executive guidance to the middle and large business market ($50m-10b) F500 experience in IT strategy, operations, M&A and turnarounds Provide service in interim, fractional or project basis Brad Wheeler has been a F500 CIO in numerous international companies in financial services, internet services, defense and high tech, and has provided interim and fractional consulting to companies from $10m startups to $12b international conglomerates.

Cyber Crime Originally was focused on individual hackers, but now High School hackers Formalized cyber ‘gangs’ Competitors Dark web market for PHI and PII Nation state Additionallywe have the cyber risk related to ongoing operations (power, fire, network outages, service provider and cloud outages, disaster recovery, etc.)

CIOs Cyber concerns Financial and Admin systems (SOX, HIPPA, PCI, etc) Customer Facing (SAAS, Web, Cloud Shared Services) Operations Technology (BMS, EMS, FLS, PACS, HVAC) Risk Management (Planning, Assessment, Incident Mgmt, Cyber Insurance)

Cyber Incidents Majority are caused by employees falling for phishing incidents either giving away information (account names/passwords) loading malware without knowing (‘whale’ phishing, ransome ware, zero day) Target incident caused by 3rd party cyber hack of an HVAC vendor - using default passwords onsite Sony incident caused by system admins failing basic functions leaving default passwords (‘password’) in remote access certificates …..in other words, the vast majority of security incidents are due to a combination of back doors and weak controls over privileged accounts!

Building Management Systems (BMS) concerns BMS are commercialized versions of Industrial Control Systems (ICS) Inherently weak protocols and controllers Vendor products are not standardized and cyber weak by themselves Vendor installation and service personnel have immature cyber processes & procedures SMART buildings only concentrate networks and services, thereby heightening risks and outcomes

5 Key Areas of Cyber Concern Privileged Accounts - Password Management and Two Factor Authentication Network Management - websites, servers, apps User Management - limit access, MFA, age out accounts Software Management - patching, authorized software only Vulnerability Management - vendor security, assessment, scanning, testing, priority (bug bounty)

Current biggest area of concern 3rd party vendors, or which building managers are part of! CIOs/CISOs have control over their own teams, systems and tools But really zero control over 3rd party tools, services, appliances, etc This is changing as vendor contracts are now requiring some level of proactive cyber verification (SSAE 16 in data center speak) We don’t care about a vendor’s SOX status, but rather their customer face BOMA members are seen as 3rd party providers, with their own downstream providers that are just as critical to tenants and their CIOs!

3rd Party System VARs Typical building system VARs have limited expertise in network architecture, particularly with the middle layers Knee-jerk reaction is to seek VAR compliance with some security framework – but that is limited to questions asked A better approach is to have the VARs provide you with an affirmative statement of their cyber practices related to touching your building's systems Most VARs will need assistance in preparing this statement Nearly all VARs will be able to positively conform with the statement following a little training Fortium has an active practice in this very area because it is such a problematic and unmanaged area

Cyber Insurance Virtually all public firms have some level of cyber insurance as part of their risk mitigation strategy Early contracts focused on incident costs (~$256M in Targets case, and more for some banks) AON Risk Insurance is now seeing multi-levels on customer interface BOD risk assessment and appetite CIO/CISO/CSO on technical assessment, planning and remediation CFO and CRO on various Cyber lines, now including business interruption and client impact

Summary Human failings are the largest of all risks 3rd parties are currently the low hanging fruit for commercial hackers and need to be ‘managed’ Expect IT security budgets will jump from current 6-10% to 15-20% in next 3 years (up to 20% of operations security) Cyber risks are here to stay (because that’s where the MONEY is!)