Cybersecurity and Green Buildings

Vulnerabilities to cyber attack exist literally everywhere.

Just this week, Wired reported of hackers remotely killing a Jeep while it was moving on the highway (earlier Range Rover suffered from a software bug that allowed hackers to unlock vehicle doors remotely).

In more salacious news, cheater website Ashley Madison was hacked with the hackers demanding that the site be shut down immediately or millions of cheaters would be exposed.

And while you may not drive a Jeep or be interested in having an affair, you probably use electricity.

A recent document published by international risk sharing syndicate Lloyds (formerly Lloyds of London) reports that severe yet plausible risks exist of a cyberattack against the U.S. power grid.

The effects of a successful attack in the Northeast U.S., New York, Washington, D.C., etc... could cause a blackout leaving as many as 93 million people without power.

The report was created by the University of Cambridge Center for Risk Studies which evaluated real life case studies to develop a model evaluating the likelihood of various scenarios.

The total impact to the U.S. economy could be between $243 billion and $1 trillion, in the most extreme scenario.

Green Building Automation and Exposure to the Web

The promise of green buildings is for us to benefit from smarter, highly efficient, almost living, systems that respond to our needs as occupants.

Indeed, with greater connectivity and increasingly complex systems, green buildings have the potential to constantly monitor themselves. In turn, they can respond to environmental data by raising or lowering temperatures, micro conditioning areas for optimal comfort, changing light levels, optimizing heating, ventilation, air conditioning, etc.

All of this requires management, which requires software, which is connected to the Internet, and to the grid.

Building Automation Systems (BAS) or Building Management Systems (BMS) make all of this possible.

Building Automation Systems

A building automation system (BAS) is a centralized, networked system of hardware and software within a building that is used to monitor the environment of operational systems.

A BAS is different from software that would be used to just monitor what a building is doing, for instance, so that the owners can make changes or recognize problems.

A BAS will act on its own, according to the data it has.

BAS installations are almost always connected to the Internet, as well as to an intranet (local area network or LAN) from where the system may be monitored and controlled. Systems are increasingly connected to the cloud.

The goal of a BAS is to ensure operational performance of the facility as well as occupant comfort... As such, a BAS usually has direct control over lighting, chillers, boilers, air handling units, rooftop units, fan coil units, heat pump units, variable air volume boxes, and more.

On the plus side, with this type of integration, monitoring and automation, the BAS can limit environmental impact, while helping building owners save on energy costs.

The systems also compile vast amounts of data to help building managers determine ways to further cut costs and increase the efficiency and comfort of their buildings over time.

A visible example of how this data can be compiled for the average building occupant is in the case of LEED's Dynamic Plaque. The Dynamic Plaque provides real time feedback for building occupants on building activity, such as how efficient the building is at a given moment.

Cybersecurity Concerns

Although networked automation systems have many benefits, a great number industry experts are saying the biggest weakness of a BAS may be cyber-security threats and/or potentially crippling system malfunctions.

Many building automation systems run on a version of Microsoft Windows, which has its own security concerns... After all, how many times have you seen an Internet Explorer popup like this one below warning you of a potential threat?

Building automation systems originated in a time when security was considered a peripheral issue... The Internet was even more nascent than it is today and the "Internet of Things" was mostly science fiction.

Historically a failure or breach within one area of a system might not lead to danger elsewhere. Systems were not linked and did not communicate with each other or rely on each others' instructions...

In other words, a failure could occur locally that could be contained and addressed without causing massive system-wide shutdowns if one component went awry.

However as building automation evolves, there is an increasing importance of integrating security-critical services that were formerly provided by isolated, non-networked subsystems.

As they function now, most Building Automation Systems do not possess a robust security framework that can deal with possible Internet-based intrusions and malfunctions to ensure process safety and integrity.

Indeed, if major multi-hundred billion dollar market value companies such as Home Depot or Bank of America, or the U.S. government for that matter, cannot seem to protect themselves from cyber attacks, how much faith should we have in minor appliances to accomplish the job?

The major problems contributing to the security issue stem from using old systems that have slow reaction speeds, incompatibility, political and competitive fears and silos of proprietary isolation.

With the exception of a ground-up construction project that is coordinated from start to finish, BAS installers face integration with a hodgepodge of different kinds and brands of energy equipment that is not seamless or secure.

On a rudimentary level, a typical commercial office facility uses security tools such as video cameras, locks, keys and access controls, intrusion monitoring, and fire safety. Separately, the building will have operational systems including lighting, heating, cooling, and ventilation. These are typically operated on separate networks.

To avoid one point of failure, backup systems are ideal... However, a structure of redundant networks and labor may not be the most efficient, convenient, or cost effective.

As technology continues to advance, building engineers, facility managers and building owners must be aware of the risk of cyberattack.

If disparate building automation systems can integrate and leverage existing energy equipment no matter the manufacturer and/or physical security information management (PSIM) systems used, both efficiency and security goals can be achieved.

-----

Photo credit: HackNY via Flickr