While CISOs have given greater attention to improving their OT cyber maturity in recent years, it can be extremely challenging to gain visibility over every connected asset, identify every cyber risk and take the necessary steps to remediate the most critical vulnerabilities.

An important area of cybersecurity that receives little attention from organisations is IoT, particularly as it relates to Building Management systems, or BMS. These systems consist of a diverse range of technologies, which are critical for the safe and secure operation of a facility, such as a hospital or manufacturing facility. BMS includes door access systems, heating, ventilation, and air conditioning (HVAC), closed-circuit television (CCTV), fire safety panels, and other systems.  

The reality is many of these systems were installed when the building was originally constructed, which could be decades ago. Therefore, this technology is very unlikely to have been deployed with cybersecurity in mind, nor kept up to date with critical security patches.

Alternatively, the BMS system may have been installed or upgraded as part of a more recent renovation, which likely results in a mixture of legacy and newer technologies from different third parties, who are only responsible for securing their specialty product. This creates an unnecessarily complex and messy environment for security teams to monitor and fix if a vulnerability arises.

As a result, many organisations with building management systems, such as property trusts and large retail organisations, have an unaddressed blind spot when it comes to their cybersecurity. What vulnerabilities exist in these systems? What other corporate networks are they connected to? What could be the impact on their tenants and customers if these assets were to suffer a major cyberattack? 

The consequences of a cyber breach on a BMS system can be significant: it could lead to unauthorised physical entry into the building, an inability to access certain parts of the building or physical discomfort to people inside the building, for example, if the interior was too hot or too cold.

When addressing these blind spots, the first question CISOs typically ask is, “Where do I start?” The first step is assessing the attack surface by completing a full asset and network inventory. This helps CISOs understand what connected assets even exist in a building in the first place, how they are connected to one another, and what external connectivity leaves the door open for attackers to manipulate building infrastructure.

From there, organisations will be able to understand the highest priority risks in their BMS for the first time and use this intel to take focused action on the most critical ones. This process enables organisations to demonstrate a measured risk reduction in their BMS infrastructure and be equipped to respond to cyber incidents that occur within the BMS, no matter whether they start internally or externally.