Building Cybersecurity

Understanding a smart building's management systems and security features is an important step in preventing and mitigating the risks of cyberattacks. With the proper cybersecurity strategy, products, as well as training you can improve your building security and be more resilient in the growing landscape of cyber threats. Flip through to review key steps you can take.

Everyone connected to an organization should be accountable for keeping it secure. Cybercriminals will find and exploit any potential attack point in a building system’s defense. Companies that create a culture of cybersecurity awareness, with strong policies that promote best practices and continual security training, can effectively reduce their risk of a cyberattack.   

The best defense against cyberattacks is a good offense. A threat and risk assessment that approaches cybersecurity from a hacker’s perspective is a useful tool to identify and resolve vulnerabilities, and help organizations stay one step ahead of cybercriminals. Staging a mock attack against the building security infrastructure, or partnering with Siemens to perform a cybersecurity assessment, will uncover and verify potential access paths and provide proof points to justify additional security infrastructure investments.

Take a holistic approach that considers critical security controls like network segmentation and segregation, boundary protections, remote access, least privilege, accountability and firewall rules. Owners and operators should understand how these security features are applied. Documentation from integrators and other third-parties should also be required to show what they have done to ensure systems are configured appropriately to support an overall building cybersecurity strategy that is aligned with the enterprise architecture and information security policy framework.

People are the first line of defense against cyberattacks. Continuous training will help keep cybersecurity top of mind and prepare anyone who connects to the building network to follow best practices for preventing malicious access. Training is also essential to prevent unintentional damage caused by employees who are unaware of the proper use and operation of systems and equipment.

Organizations that have a strong backup process are able to mitigate damage and recover from cyberattacks faster.  A strong plan should address roles and responsibilities, list assigned personnel and their contact information, and detail activities associated with responding to and restoring system operations after a disruption or failure. A recovery plan is only effective if it is operational, so organizations should periodically exercise these plans to ensure the system can be recovered within the specified Recovery Time Objective and Recovery Point Objective.