________________________________________________________________________________________________________________________
how poorly secured operational technology environments are becoming attractive targets for cybercriminals.
But it’ s one thing to understand operational vulnerability, yet another to design an intelligent, or smart, environment with processes in place to combat it.
Removing silos- but concentrating risk
Another major trend is the growth of unified platforms, where multiple building functions are integrated into single operational ecosystems.
Access management, surveillance, visitor systems, HVAC controls and occupancy management can now operate through interconnected platforms designed to streamline operations and improve visibility. All of which are transforming the user experience and ultimately improving public safety.
But we must be wary that the removal of silos, including those which saw physical and cyber security operating independently, can also create concentration of risk. Especially now we see hybrid threats across physical, cyber and aerial domains.
For instance, a compromised access management platform could potentially affect physical entry points across an entire building. A vulnerable building management system may provide pathways into wider corporate networks. And increasingly, cyberattacks are targeting operations, not just data.
There have been well-documented cases of breaches through smart technology, too. Albeit around seven years ago, one‘ infamous’ incident involved cybercriminals gaining access to a North American casino network through a smart fish tank thermometer, ultimately allowing them to extract sensitive data from the organisation’ s systems.
In addition, the UK’ s National Protective Security Authority( NPSA) has highlighted how HVAC systems and building automation controls can create potential vulnerabilities within modern buildings if security is not properly considered. It warns that building automation and control systems should be carefully secured, with organisations needing clear oversight of who can access and control systems remotely.
As smart infrastructure becomes more deeply embedded within commercial developments, building resilience is increasingly dependent on securing both physical and digital environments together. And the risk escalates, with( massive) IoT, which is designed to extract data from multiple, potentially hundreds of thousands of smart technology points, in commercial and domestic settings across the globe.
20