Building automation used to be isolated, proprietary and offline, which made security an afterthought. Now HVAC, lighting, access, lifts and metering are connected, often to the internet for remote access, and that connectivity has made operational technology (OT) a real target.
Why OT is vulnerable
Many building controllers were designed for reliability and long life, not security. They may run old software, use weak or default credentials, and sit on flat networks. An attacker who reaches them could disrupt services or use them to reach IT systems.
How to protect it
- Segment OT from IT and from the internet
- Change default credentials and manage firmware
- Control and log remote access tightly
- Monitor OT networks for unusual activity
- Keep secure, tested backups of configurations
Convergence needs coordination
As IT and OT converge onto shared infrastructure, security has to be designed across both. That is far easier when one accountable team designs the network, the building systems and the security together, rather than each in isolation.
See the full scope of what we deliver.