ASHRAE Journal - November 2013 - B22

dential. And, if a security incident does occur, there will be less
audit trail information to evaluate.
When users no longer require access to the control system,
remove their login credentials.
Remove default usernames and passwords. Most control
system products come with default usernames and passwords
to allow for initial system conﬁguration. These default login
credentials should be removed.
Ensure the use of strong passwords. Since IT is not usually
responsible for software on the control network, frequently IT
password policies are not enforced on control network. While
no users enjoy having the change their passwords, or having to
remember yet another password, if a strict password policy is
required to protect the IT network, why would it not also be in
place to protect the control network?
Ensure that control system security patches are up to
date. Any control system product reachable from the IT network should have security patches installed. Many control
system products are based on common operating systems, web
server applications, and protocol stacks. Security patches for
these products should be ﬁeld tested and then installed.
Install tamper alarms on all equipment cases. For the really paranoid who have to protect against malicious insiders with
access to roam about the facility and into mechanical rooms,
the installation of tamper alarms on all equipment cases can
provide an indication not only when someone might be physi-

www.info.hotims.com/44638-58

cally damaging equipment, the tamper alarms also provide a
warning that someone might be attempting to take over the network connection of a device.
If your site has tamper alarms, don't ignore them. When one
goes off, physically inspecting the unit is required.

Take the Time
Take the time to evaluate your needs, your budget and your
level of risk tolerance then select the approach that best suits
your situation. And remain vigilant; revisit the security of your
control network regularly to ensure that it remains secure.

References
1. Wikipedia. 2013. "Stuxnet." http://tinyurl.com/mc3cypd.
2. Donohue, B. 2013. "Researchers Hack Google Ofﬁce's Building
Management System." 7 May. http://tinyurl.com/mk2s4ue.
3. FBI Cyber Alert Network Division. 2012. "Vulnerabilities in Tridium Niagara Framework Result in Unauthorized Access to a New Jersey
Company's Industrial Control System." http://tinyurl.com/lr5rs84.
4. Menn, J. 2013. "Researchers warn of cyber ﬂaws in Honeywell
control systems." Reuters, 5 February 2013. http://tinyurl.com/lzwnugc.
5. Krebs, B. 2013. "Backdoors Found in Barracuda Networks Gear."
Krebs on Security. 24 January. http://tinyurl.com/kqvtgs2.
6. United States Computer Emergency Readiness Team. 2013. "Cisco
Releases Security Advisories." 25 April. http://tinyurl.com/cn6f3qq.
7. Krebs, B. 2010. "Experts Warn of New Windows Shortcut Flaw."
Krebs on Security. 15 July. http://tinyurl.com/2668tfx.

ASHRAE Journal - November 2013

Table of Contents for the Digital Edition of ASHRAE Journal - November 2013