Businesses often focus on protecting traditional IT systems while overlooking the technologies responsible for securing their buildings, according to David Robinson, Head of Cybersecurity at Restore Information Management, pictured. He says: “Many building systems still rely on default credentials straight out of the box. If these credentials aren’t changed, cyber criminals can gain access to critical systems with relative ease. “As today’s building systems become more connected and cloud-based, security often fails to keep pace. Without the right controls, attackers could disable CCTV, interfere with access control systems, unlock doors or use vulnerable building systems as a route into the wider corporate network.”
Hence here are his five ways that a business can strengthen the cyber security of connected building systems, and reduce the risk of physical security incidents.
- Know what systems you have and how they are connected
Security begins with visibility. Organisations should maintain an up-to-date inventory of every network-connected or remotely accessible building system, including access control, CCTV, Building Management Systems and other operational technologies. This should include who manages each system, who has access and how remote connections are provided.
Understanding the environment is the first step to reducing opportunities for attackers.
- Eliminate default passwords and shared accounts
Default credentials and shared logins remain among the most common weaknesses in connected security systems. Manufacturer passwords should be replaced immediately, shared accounts removed, and every employee or contractor provided with an individual account that can be monitored and disabled when no longer required.
Strong access management makes it significantly harder for attackers to gain unauthorised access.
- Tighten remote access controls
Remote maintenance is essential for many security and building systems, but unmanaged access creates unnecessary risk. Organisations should regularly audit contractor and employee accounts, remove dormant users and ensure all remote access is approved, time-limited and reviewed throughout the lifecycle of a contract.
- Separate security systems from corporate networks
Where possible, building systems should operate separately from wider corporate IT networks. Network segmentation limits the impact of a successful cyber attack by preventing attackers from moving laterally into other business-critical systems.
Facilities, IT and security teams should work together to identify opportunities to improve resilience across legacy infrastructure.
- Treat cyber security as part of physical security
Cyber security should be embedded into every security strategy rather than viewed as an IT issue alone. Regular awareness training, closer collaboration between security and IT teams, and designing new systems with security in mind can reduce the likelihood of compromise.
As buildings become smarter, protecting physical assets increasingly depends on securing the digital systems that control them.
