What does the Facilities Manager need to know about cyber security? by James Willison
Today’s Facilities Manager works in a complex and ever-changing environment and is often challenged by numerous issues whilst seeking to maintain a facility at optimal levels of operations. The organisations and people vary widely, some are highly sophisticated with advanced technological capabilities, others are older and more reliant on aging systems. If an FM is working for a larger company, there will be a mixture of old and new systems and this will present a range of problems from maintenance to safety and resilience. High on the agenda will be operational efficiencies, energy savings, spatial occupancy levels, business continuity planning, health and safety reports, canteen and gym provision, cleaning, relations with IT support to ensure customer satisfaction, visitor management, physical security, fire and bomb evacuation procedures. In crises it is crucial for health and safety practises to be in place across many sites and to be prepared for concerns from staff and possible inspections from government officials. Perhaps understandably then the issue of cyber security is not necessarily seen as a high priority. But this has to change.
In this article we will explore the cyber security issues which should be of particular interest to a Facilities manager. There are a range of others which can be considered in the final section on further reading and security courses. It is the intention here to demonstrate why cyber security is now more relevant to Facilities managers and highlight areas which affect day to day operations.
- Why is cyber security a serious concern to building safety?
- What can a Facilities Manager do about potential cyber attacks?
- Health and Safety risks
- Recommended reading and cyber security courses.
1. Why is cyber security a serious concern to building safety?
Cyber security normally falls under the remit of IT and providing advice is followed by staff who use the corporate IT infrastructure through security awareness training programmes then that should cover it? This kind of thinking seems very reasonable but is no longer sustainable. In recent years cyber security has entered the Facilities arena in the form of the Internet of Things (IoT). Many of the systems which operate in a building from CCTV, access control, HVAC, Building Management (BMS), Lighting, Energy and Safety are connected to the internet and can be classified as IoT. They are also often quite simple devices, such as lights, with little security in place be that physical or cyber. These are then connected to the building system and provide an easy way into the organisation for an attacker. The concerns first started in earnest in 2016 when hackers successfully used CCTV DVRs to disrupt many companies across the internet. The outage lasted several days and affected significant sections of the web so that Amazon, Twitter and Netflix were down. (KrebsonSecurity, October 2016 “Hacked cameras, DVRs Powered Todays Massive Internet Outage:
https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/
Then more worryingly WannaCry ransomware emerged and forced NHS hospitals and surgeries to close in May 2017 with thousands of appointments and operations cancelled impacting about a third of NHS trusts ( NHS ‘could have prevented’ WannaCry ransomware attack; https://www.bbc.co.uk/news/technology-41753022). Both were recognised as low-level attacks.
Today many more connected technologies are being deployed. The Facilities manager may have a dashboard view of all these and together with the security and building services teams manage them on a daily basis. The actual real time monitoring will fall to analysts and security specialists, but these can be impacted by random or targeted attacks. The infamous example of a casino’s connected fish tank’s thermostat being hacked gave access to the business IT network. It enabled attackers to steal details of the clients, and whilst amusing, surely does speak volumes to an FM who might now reconsider the security of such items. This insightful interview from Johnson Controls,“Building Connections: Jason Christman on Cybersecurity”, examines the importance of securing building systems and at the conclusion discusses the impact of this event https://www.youtube.com/watch?v=gd_wMFiXx8M (Starts 08.34).
In the movie,‘IT’, we see the dramatic impact of how one temporary member of staff can gain access to a CEO’s home and then disrupt an entire business. (I.T. Official Trailer (2016): Pierce Brosnan Movie
https://www.youtube.com/watch?v=hfnDTvbtDUI).
The Facilities team will be called on to help manage such crises and may also find themselves accountable for systems’ failures. In a post event investigation, it might be evidenced that the FM had procured and was responsible for the maintenance of a poorly designed and secured system. Some larger FMs provide the solutions themselves. It is therefore very important to check these have been tested and proven to work well in your organisation’s IT environment throughout the systems’ lifecycle.
Another case of a cyber attack on a building was reported by the BBC in 2019. A reporter visited a Norwegian company, which spent £45 million to restore the computer systems, the factory’s machinery and building systems following a ransomware attack on its 170 sites and over 35,000 staff. People from sales were drafted in to do production line work. (“How one ransomware attack cost £45m to fix – BBC News”: https://www.youtube.com/watch?v=7yHsiTmUnPk)
It is vital for Facilities Managers to protect building management systems both from physical and cyber attack. Whilst the area of physical security might be easier to understand it can be compromised with fewer staff and less patrols being carried out in a crisis. Hence a hacker could obtain access to a server and upload malware to the system thereby potentially gaining control of the corporate email. Unless this is identified by IT, it could mean that an attacker is able to take over a senior manager’s account and raise fake invoices with thousands of pounds lost. This is much more sophisticated than a phishing attack and so checks need to be made to ensure requests are genuine.
2. What can a Facilities Manager do about potential cyber attacks?
In light of the considerable breadth of issues a Facilities Manager has to address, pivotal, is leadership in a role to support the business. It is not necessary to become a cyber security expert, but it is essential to bring people in who can help. This may mean arranging meetings with the cyber security team, if there is one, to look at the risks with physical security and building services. Team building is a skill in its own right and should be the focus of the FM to ensure the facility is fully operational. It may require the vision of an FM to lead this endeavour. In their latest standard ASIS International and (ISC)2 state the need to “Establish cross-functional security teams to identify cyber physical risk in the digital/smart environment”.
(ASIS International Security Awareness Standard – 2020: https://store.asisonline.org/security-awareness-standard-e-book.html)
Increasingly the systems in the environment are connected and if it doesn’t seem smart it is digital. Reports and Frameworks over the past twenty years have demonstrated that different departments and teams in a facility often work in silos and do not collaborate on risk management. The NIST Framework for Cyber Physical Systems, 2016, states,
“The properties of safety, reliability, cybersecurity, and resilience have, for the most part, evolved within distinct silos ….Likewise, risk management activities have often been conducted within each silo, rather than across them. …Ideally, personnel responsible for each property will consider the interdependencies among all five properties throughout the system lifecycle” (p 82) https://pages.nist.gov/cpspwg/.
The World Economic Forum Global Risks report, 2016, concludes, “While there are many “C” level owners (CISO, CFO, CEO, CRO, Risk Management), each of these owners has differing but related interests and unfortunately often does not integrate risk or effectively collaborate on its management” (p 78).
http://www3.weforum.org/docs/GRR/WEF_GRR16.pdf.
Homeworking has only made things worse. Without a leader this might remain the case. However, the opportunity for a Facilities Manager is to propose monthly calls with the physical, cyber, HR and Installers teams so that common risks to the BMS can be discussed with plans of action agreed. This collaborative approach will mean that cyber security professionals can help identify vulnerabilities in a BMS which can be checked, and results fed back to the group for further analysis and necessary remedial actions.
In preparation for disaster and recovery planning it is necessary to monitor and improve the information systems and given the data which often is sitting on these physical and building management systems (‘The organisation shall continually improve the suitability, adequacy and effectiveness of the information security management system’. ISO 27001: 10. 2). https://www.iso.org/isoiec-27001-information-security.html
This means considering the use of new real time technologies which can alert the person, managing the BMS, of incidents in the building that require response and lockdown. Quarantining technologies working with AI and other systems can make the difference between building closure, business collapse and recovery. These new technologies need to be researched and procured with both cyber security and privacy in mind. The EU GDPR is quite clear that Data Protection Impact Assessments are to be carried out on surveillance systems and new technologies. These technologies range from heat sensing, face mask detection, social distancing analytics, audio/visual communications and occupancy analysis. The ICO explains, When do we need to do a Data Protection Impact Assessment?
What is the general rule?
Article 35(1) says that you must do a DPIA where a type of processing is likely to result in a high risk to the rights and freedoms of individuals:
“Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.”
Article 35(3) sets out three types of processing which always require a DPIA:
Systematic and extensive profiling with significant effects:
“(a) any systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person.”
Large scale use of sensitive data:
“(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10.”
Public monitoring:
“(c) a systematic monitoring of a publicly accessible area on a large scale.”
For those who surmise that large scale doesn’t apply the ICO states, “Examples of large-scale processing include:
- a hospital (but not an individual doctor) processing patient data;”
There are established FM providers which deploy technologies across large facilities and profile persons and so they must carry out a DPIA. Of course, a DPIA expects an organisation to protect the data on the system and so if this can be accessed by an attacker you must secure it using reasonable means as described in article 5.
Article 5(1)(f) of the GDPR concerns the ‘integrity and confidentiality’ of personal data. It says that personal data shall be:
‘Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures’.
The template provided by the ICO asks, “Do you plan to consult information security experts” (p 4) https://ico.org.uk/media/about-the-ico/consultations/2258461/dpia-template-v04-post-comms-review-20180308.pdf about the new technology being used. It also indicates that smart technologies, biometrics and some IoT devices and systems are high risk and so require a DPIA as described in recital 91. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/
Sarb Sembhi and James Willison, Unified Security Ltd, outlined hundreds of control mechanisms to consider for IoT projects and the GDPR. Here is a selection.
Data protection related control mechanisms
| Description | Stakeholder | Target |
| Project manager or other appropriate staff should conduct a Data Privacy Impact Assessment | Any | PM |
| Project teams should limit how and what processing can take place in line with policies and procedures | Any | Project team |
| Project teams should use data anonymisation techniques at all opportunities | Any | Project team |
| Project managers should only agree to share personal data where there is a legal basis to do so | Any | PM |
| Project teams must ensure that data subjects will be able to exercise their GDPR rights | Any | Project team |
| Project managers ensure that requesting data processing consent is made user friendly and understandable | Any | PM |
| Project teams ensure that devices and applications are designed to inform data subjects using appropriate interfaces | Any | Project team |
| Project managers ensure that data subjects will be informed about the type of data collected (by sensors) and any additional processing and analysis that will be undertaken with the data once it is collected | Any | PM |
| Project manager to communicate to relevant controllers and processors when a data subject withdraws consent or opposes the data processing | Any | PM |
| Project manager to ensure that granular choices are provided when granting access to applications in relation to the data that may be processed | Any | PM |
| Project manager to ensure that location tracking using fingerprinting is both limited and controllable by data subjects | Any | PM |
| Project manager to ensure that transparency and user controls can be enforced with tools provided to read, edit, and modify data before it is transferred to any data controller / processor | Any | PM |
Smart GDPR assurance for a smarter world (p 22).
Further advice from the White paper, “Smart GDPR assurance for a smarter world,” is available here: http://www.axis-communications.com/smart-assurance-wp
The benefits however to the people in the facility will mean companies that provide safe and secure working environments will prosper against those which do not.
3. Health & Safety risks
The area of Health and safety is also affected by systems’ performance. Air quality, lighting, heating and building maintenance are increasingly controlled by IP technologies and they need to perform efficiently. If they fail and a member of staff or visitor is injured or becomes sick as a result, then compensation might be sought. The UK Govt’ HSE states that employers have a duty ‘of care’,
‘This means making sure that workers and others are protected from anything that may cause harm, effectively controlling any risks to injury or health that could arise in the workplace’ (HSE.GOV.UK).
The clearest statements on cyber security by the HSE are made with respect to reducing the risk of a major incident to an Industrial Automation and Control System (IACS),
“IACS are commonly programmable (software based) and may, therefore, be vulnerable to cyber threats, potentially leading to undetected faults, failure, downtime and ultimately an increased risk of a major accident occurring.”
The HSE has recently developed guidance to protect against cyber attacks in its document,
Cyber security for Industrial Automation and Control System (IACS),
https://www.hse.gov.uk/foi/internalops/og/og-0086.pdf
This is a technical document but it does recognise a range of measures to implement. Some of the high level recommendations will apply to FMs especially those which provide technological solutions to support these environments. For example,
“Procedures should be in place for the following:
- Suitable procedures should be documented and implemented for all activities
that are required to ensure the countermeasures are appropriately managed.
- security screening of new and existing personnel with IACS roles (see also
IEC62443-3-1 clause 10.2): Verification checks (character references, verification of qualifications, CV and identity) prior to (internal or external) appointment to an IACS role.
- More detailed verification (e.g. criminal records, credit review, security
clearance) should be considered for roles with more privileged access to
the IACS where it is legally permitted.
- Defining employment terms and conditions setting out confidentiality,
legal, equipment and information handling requirements, disciplinary procedures etc. Monitoring of performance, behaviour and conflict of interests with respect to cyber security responsibilities. Managing those leaving IACS roles including access to IACS equipment and systems”.
Cyber security for Industrial Automation and Control System (IACS), (p 23).
Some actions.
In conclusion it might seem to be a complex threat environment but there are some key actions FMs can take to limit the risk. The Internet of Things Security Foundation (IoTSF) and The Institute of Workplace and Facilities Management (IWFM) produced these top 10.
Checklist for BMS with remote or Corporate network access for operations or maintenance
- Assess the potential cyber security risks and agree, with the building stakeholders (Owners, Facilities Managers, IT /Cyber Security teams), a mitigation plan and process for continual review/action.
- Check/scan for unknown IoT devices that may be connected to your network/systems.
- Ensure that any IoT devices are secured behind a firewall/DMZ with appropriate network segmentation deployed.
- Change any factory default credentials and ensure passwords are unique per building/account/devices. Enforce password policies (password history, minimum characters & complexity). If you can use 2FA (like an authentication app or SMS code) then do so.
- Rename default accounts, and disable any unused accounts.
- Check that the systems and devices software/firmware are at the latest version as specified by the system/device vendor. Any required updates should be conducted securely.
- If possible, offer authorised staff remote access to your BMS via a corporate network VPN, rather than you directly connecting from the Internet.
- Ensure any staff or third-party contractors with access to the BMS who are working from home follow suitable security guidance such as the UK’s National Cyber Security Centre (NCSC) issued ‘Home working: preparing your organisation and staff’
- Ask your IT/Cyber Security function to monitor attempts to access your BMS system (both unsuccessful and successful) and agree how they can alert you to suspicious activity.
- Check that your systems/device suppliers have a Vulnerability Disclosure Policy and how security vulnerabilities will be reported to you if any are discovered.
COVID-19 Crisis: Cyber Security Advice for Building Owners and Facilities Managers
It is important to check that engineers are suitably competent to maintain the systems (cf. ‘determine the necessary competence of person(s) working on them that affects its information security performance’ ISO 27001: Section 7.2 https://www.iso.org/isoiec-27001-information-security.html). Increasingly this means they should understand the cyber risks and so change passwords and usernames. They should also help with any needed updates and configure the systems securely.
- Recommended reading and cyber security courses.
Where do we go from here?
It is important for those who have responsibility for physical, IoT and building management systems to be aware of relevant standards and frameworks if they are to understand the risks and controls required in their own organisation and reduce them. Most people are unlikely to have time for full time university courses or even part time distance learning programmes. It is certainly worth reading some books on computer and information security and doing some short online courses. Here is a list to start:
Coursera: This website has free courses from Universities and companies across the world. There are many free courses on cyber security including:
Information Security: Context and Introduction offered by Royal Holloway, University of London
https://www.coursera.org/learn/information-security-data?
ISO 27001: 2018 Information Security Management
https://www.iso.org/isoiec-27001-information-security.html
National Institute of Standards and Technology, “Framework for Improving Critical Infrastructure Cybersecurity”
https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
National Institute of Standards and technology, Risk Management Framework for Information Systems and Organizations
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Open University:
Introduction to cyber security: stay safe online:
The UK National Cyber Security Centre recommends a range of courses from awareness to application and courseware. Most of these are hosted by training companies and there are fees with exams and certifications.
https://www.ncsc.gov.uk/information/certified-training