ASHRAE Journal - November 2013 - B19

Depending on the level of control of
entry to the facility, more or less security
for the control system will be required
inside the facility. For example, ultrasecure military installations might not
expend too much effort ensuring security of the HVAC system, since physical
access to the facility is tightly controlled
and all people that enter are escorted or
pre-vetted (assumed to be non-attackers). The opposite would be true for a
university where there is no restriction Figure 1: VPN connection.
on access, and some students would hack
the system just because it's fun, and they learned about control
Many VPN products are available, including open source
systems in their morning engineering class.
and commercial products.
Pros
Protection From the Internet
* Simple to setup
There are a couple of approaches that can be taken to secure the
* Inexpensive to deploy
control network, in all of the cases discussed here, it is assumed
* Secure/private connection
that the control system is separated from the Internet via ﬁrewall
* Allows non-browser based applications access to the conand that there are no ports opened in the ﬁrewall that allow access trol system
to the control network. Starting from that position, the following
Cons
approaches all provide good protection: virtual private network
* Vulnerable to attack from malware on computes that con(VPN); remote desktop; and control system web server.
nect to the control system network
* Allows any software on enabled computers to interact with
VPN
the control system
The VPN solution works by providing a secure tunnel from
the user's computer through the control system's ﬁrewall to the Remote Desktop
control system network. Once the VPN tunnel is established,
The most secure approach is to provide a remote desktop
it appears to the user as if the computer is connected to the solution. A remote desktop solution restricts the access to
control system network directly. The user then runs any control the control system network to programs installed on a single
system software and communicates with the control system computer that is directly connected to the control system.
through the VPN tunnel. All communications through the tun- In restricting access to the single computer, control over
nel are encrypted, ensuring that no one monitoring the com- which programs access the control system is easily restricted
munications can see the data transferred between the user's through management of the computer. If there is a central IT
computer and the control system.
department that manages computers for the site, they should
VPN client products come in two main ﬂavors: software be able to provide management of the control system comclients and hardware clients. With a software client, the VPN puter as well ensuring that security and software updates are
software is installed on the user's remote computer, and usually applied as available.
requires that the user enters her user name and password each
In this scenario, a computer is installed onsite directly
time she connects to the VPN. In addition, most VPN client connected to the control system. The software required to
software can be conﬁgured to require a shared secret, ensuring interact with the control system is installed on the computer
that only computers conﬁgured by the network administrator along with a remote desktop solution. Many commercial
can connect the VPN.
and open source desktop solutions exist. Depending on the
In contrast, a VPN hardware client is a box that is installed particular remote desktop solution installed, different ports
in the remote site giving a full-time VPN connection between on the ﬁrewall will need to be opened so that the computer
the remote site and the control system. This type of setup is can be contacted from outside the ﬁrewall. Only those ports
common for central monitoring stations that connect to mul- that are required for the remote desktop solution should be
tiple remote control systems, or for connecting satellite ofﬁces opened.
into a network, or connecting multiple disparate control system
Pros
networks through the Internet. Beneﬁts of the hardware VPN
* Secure / private connection
solution include the ability for an always on connection and a
* Better control over computers attached to control system
VPN that supports multiple devices (the hardware VPN con- network
nects the complete network to the remote network versus the
* Allows non-browser based applications access to the consoftware VPN that only connects the local computer).
trol system
N ovem ber 2013

ashrae.org

b A C N e t ® t o d Ay A N d t h e S m A rt G r i d | A S u p p l e m e N t t o A S H R A E J o u R n A l

B19

ASHRAE Journal - November 2013

Table of Contents for the Digital Edition of ASHRAE Journal - November 2013