ASHRAE Journal - November 2013 - B21

Within a facility, there are more people
with logical and physical access to networks within the building. Depending
on the type of facility the number and
variety of individuals with access to the
networks within the building will vary
widely. In a school there can be thousands of people who are authorized to
use the network, and there can be many
people unauthorized to use the network
but may have easy physical access to
it (open network ports, unlocked com- Figure 5: Protect the control network with its own firewall.
puter labs, open wireless networks). In
contrast many ofﬁces have severely restricted access policies
That said, keeping separate infrastructure can mean that those
making physical access to the network much more difﬁcult for operating the control system will need to supply their own netunauthorized users.
work support, or convince IT to operate the network but to keep
If your control network shares the IT computer network, are it separate. Being a building operator does not usually mean
all of the controllers providing their own security? Is the IT that one is skilled in maintaining a computer network. The IT
network providing security? Or is the control network open to department can provide support for an Ethernet/IP related netanyone who can get inside your building?
work segment, but they most likely have no training when it
If your control network is segregated from the IT network, comes to the other network technologies that control systems
there are still threats. Are there any computers directly connect- use (control system speciﬁc routers, other network media, etc.).
ed to the control network? Are there any networked controllers
Once segregated, the connections between the corporate netthat are in the user space (networked thermostats, supervisory work and the control network can be limited and protected with
controllers in unlocked closets, etc.?)
ﬁrewalls.
Is there any equipment that is outside the building, such as roofTreat the IT network as hostile as the Internet. Once the
top units? Are there network controllers attached to the exposed control network is segregated from the IT network, treat the
equipment? If an attacker can get access to a controller, the attacker IT network as hostile. Protect the control network from the IT
can probably take over the controller's connection to the network.
network using one of the solutions that would be used for proWhen deciding which of the mitigations to employ, one tecting it from the Internet.
should evaluate the likelihood of the threat occurring, and the
Turn off unused network ports. If there are connection
possible adverse impact. In some cases the likelihood and/or points to the control network that are not used, or which are
the impact is too low to warrant the effort.
provided solely for service tools, ensure they are turned off
Segregate the control network from the IT network. Seg- when not in use. Do not make it easy for an attacker to connect
regation from the IT network reduces the attack points for a into the control network by leaving a spot on the wall he can
control network. To start, it means that users on the IT network plug into.
do not have carte blanche access to the control network. It also
Use simple sensor networks for controllers in the user
ensures that slipups in security on the IT network have a re- space or apply network security on sensor networks. Any
duced chance of impacting the control network.
equipment that is in the user space (i.e., in the occupied portion
Segregation can be achieved through IT technology (VLANs of the building instead of in mechanical rooms or locked in
and managed switches) or through physical separation. While cabinets), should be separated from the main control network.
some costs can be reduced by using the same infrastructure, The most common controller found in the user space is a smart
using a completely separate network also has advantages. The thermostat. An attacker can pull it off the wall, and plug in a
controls industry seems to be split when it comes to whether computer to gain access to the control network.
to share IT infrastructure or to provide a completely separate
The simplest method to protect against stealing a smart senphysical network. From a security perspective, providing com- sor's network connection is to use a simple sensor network inpletely separate infrastructure can be the better choice.
stead of more powerful network, or use dumb sensors in the
With seemingly constant changes to IT networks, each space and leverage the intelligence of supervisory controllers.
change is a source for the introduction of security holes. It
Or simply install secure products. There are some options
is not uncommon for IT to forget that there is even a control available for secure user space smart sensors, but they are not
network installed (until their equipment loses its AC) and that the norm.
changes they make can cripple a control system network. HavProvide users with individual usernames and passwords.
ing a completely separate infrastructure reduces the probability A common approach to HVAC control user authorization is to
that the day-to-day changes made to the IT network will nega- share a single login credential. People will be less diligent with
tively impact the control network.
their login information if everyone has access to the same creN ovem ber 2013

ashrae.org

b A C N e t ® t o d Ay A N d t h e S m A rt G r i d | A S u p p l e m e N t t o A S H R A E J o u R n A l

B21

ASHRAE Journal - November 2013

Table of Contents for the Digital Edition of ASHRAE Journal - November 2013