ASHRAE Journal - September 2014 - 60
TECHNICAL FEATURE
Decoding the World
Of BAS Security
BY PHIL ZITO, ASSOCIATE MEMBER ASHRAE
A hacker accesses the smoke control system and overpressurizes a building, trapping
employees inside. A student causes a chiller motor to fail by accessing the building
automation system (BAS) and changing settings randomly. An employee accidently
resets a humidity setpoint, resulting in millions of dollars of damage to data center
equipment.
Preventing these nightmare scenarios means that
engineers need to understand the interrelationships
between IT and building automation and recognize
the threat of hackers whose intent, at best, is to access
a system and, at worst, is to cause catastrophic system
failures. The challenge is that because so many combinations of technology exist, specification writing has
become a gamble. Technology and security can be combined to form millions of options. How can the specifying engineer keep up?
Engineers deal with facts and therein lies the rub, how
do we provide a specification that is secure, modern,
and scalable without mastering each individual technology. We could rely on a series of guide specifications
from other manufacturers but that just makes us dependent on the manufacturer's expertise. To be able to
effectively manage the onslaught of technology, we need
to build a solid foundation. In this article we will build
that foundation by discussing how to design an effective,
secure, and scalable specification for our clients.
Close the Front Door
How'd you get in here? Through the front door.
One Saturday afternoon I was looking into IT security,
hackerism, and the like. It was during this time that I
found a website that exposes tens of thousands of BAS's
to hackers. This website allows the user to type in the
name of a common BAS, and using default password
for the BAS (which can be found with a simple Google
search), the user can gain administrator level access to
the control system. Furthermore, this website shows
what version of the web server the BAS is running, which
can be used to exploit the system. I will leave it to your
imagination to consider what havoc this could bring. In
Phil Zito is manager of technology integrations for Johnson Controls in Milwaukee. He also publishes the Building Automation Monthly blog (blog.buildingautomationmonthly.com).
60
ASHRAE JOURNAL
ashrae.org
SEPTEM BER 2014
ASHRAE Journal - September 2014
Table of Contents for the Digital Edition of ASHRAE Journal - September 2014
Contents
ASHRAE Journal - September 2014 - Cover1
ASHRAE Journal - September 2014 - Cover2
ASHRAE Journal - September 2014 - 1
ASHRAE Journal - September 2014 - 2
ASHRAE Journal - September 2014 - Contents
ASHRAE Journal - September 2014 - 4
ASHRAE Journal - September 2014 - 5
ASHRAE Journal - September 2014 - 6
ASHRAE Journal - September 2014 - 7
ASHRAE Journal - September 2014 - 8
ASHRAE Journal - September 2014 - 9
ASHRAE Journal - September 2014 - 10
ASHRAE Journal - September 2014 - 11
ASHRAE Journal - September 2014 - 12
ASHRAE Journal - September 2014 - 13
ASHRAE Journal - September 2014 - 14
ASHRAE Journal - September 2014 - 15
ASHRAE Journal - September 2014 - 16
ASHRAE Journal - September 2014 - 17
ASHRAE Journal - September 2014 - 18
ASHRAE Journal - September 2014 - 19
ASHRAE Journal - September 2014 - 20
ASHRAE Journal - September 2014 - 21
ASHRAE Journal - September 2014 - 22
ASHRAE Journal - September 2014 - 23
ASHRAE Journal - September 2014 - 24
ASHRAE Journal - September 2014 - 25
ASHRAE Journal - September 2014 - 26
ASHRAE Journal - September 2014 - 27
ASHRAE Journal - September 2014 - 28
ASHRAE Journal - September 2014 - 29
ASHRAE Journal - September 2014 - 30
ASHRAE Journal - September 2014 - 31
ASHRAE Journal - September 2014 - 32
ASHRAE Journal - September 2014 - 33
ASHRAE Journal - September 2014 - 34
ASHRAE Journal - September 2014 - 35
ASHRAE Journal - September 2014 - 36
ASHRAE Journal - September 2014 - 37
ASHRAE Journal - September 2014 - 38
ASHRAE Journal - September 2014 - 39
ASHRAE Journal - September 2014 - 40
ASHRAE Journal - September 2014 - 41
ASHRAE Journal - September 2014 - 42
ASHRAE Journal - September 2014 - 43
ASHRAE Journal - September 2014 - 44
ASHRAE Journal - September 2014 - 45
ASHRAE Journal - September 2014 - 46
ASHRAE Journal - September 2014 - 47
ASHRAE Journal - September 2014 - 48
ASHRAE Journal - September 2014 - 49
ASHRAE Journal - September 2014 - 50
ASHRAE Journal - September 2014 - 51
ASHRAE Journal - September 2014 - 52
ASHRAE Journal - September 2014 - 53
ASHRAE Journal - September 2014 - 54
ASHRAE Journal - September 2014 - 55
ASHRAE Journal - September 2014 - 56
ASHRAE Journal - September 2014 - 57
ASHRAE Journal - September 2014 - 58
ASHRAE Journal - September 2014 - 59
ASHRAE Journal - September 2014 - 60
ASHRAE Journal - September 2014 - 61
ASHRAE Journal - September 2014 - 62
ASHRAE Journal - September 2014 - 63
ASHRAE Journal - September 2014 - 64
ASHRAE Journal - September 2014 - 65
ASHRAE Journal - September 2014 - 66
ASHRAE Journal - September 2014 - 67
ASHRAE Journal - September 2014 - 68
ASHRAE Journal - September 2014 - 69
ASHRAE Journal - September 2014 - 70
ASHRAE Journal - September 2014 - 71
ASHRAE Journal - September 2014 - 72
ASHRAE Journal - September 2014 - SCover1
ASHRAE Journal - September 2014 - SCover2
ASHRAE Journal - September 2014 - S1
ASHRAE Journal - September 2014 - S2
ASHRAE Journal - September 2014 - S3
ASHRAE Journal - September 2014 - S4
ASHRAE Journal - September 2014 - S5
ASHRAE Journal - September 2014 - S6
ASHRAE Journal - September 2014 - S7
ASHRAE Journal - September 2014 - S8
ASHRAE Journal - September 2014 - S9
ASHRAE Journal - September 2014 - S10
ASHRAE Journal - September 2014 - S11
ASHRAE Journal - September 2014 - S12
ASHRAE Journal - September 2014 - S13
ASHRAE Journal - September 2014 - S14
ASHRAE Journal - September 2014 - S15
ASHRAE Journal - September 2014 - S16
ASHRAE Journal - September 2014 - S17
ASHRAE Journal - September 2014 - S18
ASHRAE Journal - September 2014 - S19
ASHRAE Journal - September 2014 - S20
ASHRAE Journal - September 2014 - S21
ASHRAE Journal - September 2014 - S22
ASHRAE Journal - September 2014 - 73
ASHRAE Journal - September 2014 - 74
ASHRAE Journal - September 2014 - 75
ASHRAE Journal - September 2014 - 76
ASHRAE Journal - September 2014 - 77
ASHRAE Journal - September 2014 - 78
ASHRAE Journal - September 2014 - 79
ASHRAE Journal - September 2014 - 80
ASHRAE Journal - September 2014 - 81
ASHRAE Journal - September 2014 - 82
ASHRAE Journal - September 2014 - 83
ASHRAE Journal - September 2014 - 84
ASHRAE Journal - September 2014 - 85
ASHRAE Journal - September 2014 - 86
ASHRAE Journal - September 2014 - 87
ASHRAE Journal - September 2014 - 88
ASHRAE Journal - September 2014 - 89
ASHRAE Journal - September 2014 - 90
ASHRAE Journal - September 2014 - 91
ASHRAE Journal - September 2014 - 92
ASHRAE Journal - September 2014 - 93
ASHRAE Journal - September 2014 - 94
ASHRAE Journal - September 2014 - 95
ASHRAE Journal - September 2014 - 96
ASHRAE Journal - September 2014 - 97
ASHRAE Journal - September 2014 - 98
ASHRAE Journal - September 2014 - 99
ASHRAE Journal - September 2014 - 100
ASHRAE Journal - September 2014 - 101
ASHRAE Journal - September 2014 - 102
ASHRAE Journal - September 2014 - 103
ASHRAE Journal - September 2014 - 104
ASHRAE Journal - September 2014 - Cover3
ASHRAE Journal - September 2014 - Cover4
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_MCDEBX
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_WNYSQY
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_XATVOD
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_FJSHSS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_CCBZDS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_XDEFVG
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2023november_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2023november
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_VHGNBL
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_WPKBNJ
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_UUVCDE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_RTGDEW
https://www.nxtbook.com/nxtbooks/ashrae/ashraemexico_2023
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_LKRFXS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_AZSOFG
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_ERCDBH
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_QWDFRV
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_JHGVDF
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_OPUYHG
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_SREIBM
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_LRTGLK
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_OKRFGH
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2022november_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2022november
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_TZSERA
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_LVRUIX
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_RPTVYZ
https://www.nxtbook.com/nxtbooks/ashrae/mini_pub_catalog
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_XIYTGD
https://www.nxtbook.com/nxtbooks/ashrae/ashraemexico_2022
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_RFGDOB
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_PABXNU
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_REMKLS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_PICVBT
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_AOYTVW
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_JQOPLS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_IOYTBC
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_SGAJJF
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_IGHYER
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_PDRKLS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2021november
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2021november_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_XCODFR
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_QSLFGO
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_ILKVNM
https://www.nxtbook.com/nxtbooks/ashrae/ashraemexico_2021
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_OPDJKD
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_VJKSRY
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_SDHUTC
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_JPPKRR
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_SDLTTH
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_CKLLES
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_SLDOX
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_HJETUK
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_OLUHGE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2020october
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2020october_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_ZERDGH
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_QVMNEO
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_RTPOKE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_BBATRE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_STUBMW
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_TPEMPE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_JNMKDS
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_FBTTPA
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_WQMMNE
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_TVBRYN
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_showguide2020
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_KTUZMA
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_ABEDGD
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201910
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201909
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2019septmeber_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2019september
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201908
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201907
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201906
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201905
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201904
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_2019april
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201903
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_2019march
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201902
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201901
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_showguide2019
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_2018december
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_2018november
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2018fall_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2018fall
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_2018october
https://www.nxtbook.com/nxtbooks/ashrae/ashraemexico_2018
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201810
https://www.nxtbook.com/nxtbooks/ashrae/ashraeinsights_201806
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201805
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201804
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201803
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201712
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201711
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201710
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2017fall_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2017fall
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201709
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201705
https://www.nxtbook.com/nxtbooks/ashrae/ashrae_meetinginsert_201610
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2016fall_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2016fall
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_acrexindia
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2015summer_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_amca_2015summer
https://www.nxtbook.com/nxtbooks/amca/2014summer2
https://www.nxtbook.com/nxtbooks/amca/2014summer
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_acma_2014summer
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201311
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201309
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_acmasupp_2013fall
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201305
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201303
https://www.nxtbook.com/nxtbooks/ashrae/pubcatalog_2013winter
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201211
https://www.nxtbook.com/nxtbooks/ashrae/achr_expo_mexico2012
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201209
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201208_v3
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201208_v2
https://www.nxtbook.com/nxtbooks/ashrae/pubcatalog_2012summer
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201205
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201203
https://www.nxtbook.com/nxtbooks/ashrae/pubcatalog_2012winter
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201111_v2
https://www.nxtbook.com/nxtbooks/ashrae/ashraejournal_201109_v2
https://www.nxtbook.com/nxtbooks/ashrae/pubcatalog_2011summer
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201105
https://www.nxtbook.com/nxtbooks/ashrae/meetingplanner_201103
https://www.nxtbookmedia.com