How cybersecure is the smart office?

In 2017, hack­ers stole sev­er­al giga­bytes of sen­si­tive data from a Las Vegas casi­no. It was lat­er dis­cov­ered that their point of entry to the net­work was a new­ly installed fish tank, which had an inter­net con­nec­tion enabling it to be mon­i­tored remote­ly. 

This case illus­trates the secu­ri­ty risks posed by the increas­ing use of the inter­net of things (IoT), espe­cial­ly in the shape of smart sen­sors that track the per­for­mance of com­mer­cial build­ings. Each one rep­re­sents a poten­tial chink in the network’s armour. 

Cyber­crim­i­nals can find vul­ner­a­bil­i­ties in devices that most of us might not even con­sid­er to be vul­ner­a­ble. For instance, when Joe Biden moved into the White House in Jan­u­ary, even his smart exer­cise bike was deemed too much of a secu­ri­ty risk.

Before the IoT rev­o­lu­tion, most build­ings’ sys­tems tend­ed to be self-con­tained and there­fore safe from hack­ers, says Nick Mor­gan, infor­ma­tion secu­ri­ty man­ag­er at prop­er­ty investor Der­went Lon­don. This began to change with the intro­duc­tion of remote man­age­ment via per­ma­nent­ly con­nect­ed smart sen­sors.

“Poor­ly con­fig­ured build­ing man­age­ment sys­tems, which han­dle aspects such as access con­trol and air con­di­tion­ing, or even a landlord’s net­work infra­struc­ture can pro­vide a gate­way to a remote attack­er,” he warns. 

Gap analysis

As IoT devices con­tin­ue to pro­lif­er­ate, the need to secure these from attack becomes para­mount, says William New­ton, pres­i­dent and MD of Wired­Score, a provider of cer­ti­fi­ca­tions rat­ing the qual­i­ty of dig­i­tal infra­struc­ture in build­ings.

“All IoT devices present pos­si­ble entry points for hack­ers,” he stress­es. Let­ting any one of these go unpro­tect­ed is “the dig­i­tal equiv­a­lent of leav­ing a small win­dow open down­stairs when you leave the premis­es. Every­thing that’s linked to your net­work – from light­ing to the CCTV sys­tem to the ele­va­tors – needs to be sub­ject to the same strin­gent secu­ri­ty pro­to­cols as data­bas­es con­tain­ing con­fi­den­tial infor­ma­tion.”

Sal­ly Jones, head of strat­e­gy, dig­i­tal and tech­nol­o­gy at prop­er­ty firm British Land, observes that the rapid adop­tion of tech­nol­o­gy in the built envi­ron­ment has left some peo­ple behind the curve. “We’re work­ing hard to edu­cate them as to why this area is so impor­tant and why it takes a long time to get a cer­tain sup­pli­er on board or to get every­thing con­nect­ed,” she says.

In April, Wired­Score start­ed offer­ing a cer­ti­fi­ca­tion called SmartScore. Jones reports that this new bench­mark­ing sys­tem is “help­ing us to bridge the gap in our organ­i­sa­tion. We’re using it to com­mu­ni­cate why cyber­se­cu­ri­ty is impor­tant and what it means to be a secure smart build­ing.”

Selective deafness

But it’s still too easy for even the biggest firms to ignore the cyber­se­cu­ri­ty risks in their eager­ness to adopt smart new proptech.

Craig Young is prin­ci­pal secu­ri­ty researcher at Trip­wire, a provider of threat-detec­tion soft­ware. He says that he once dis­cov­ered a vul­ner­a­bil­i­ty at WeWork that was leav­ing the cowork­ing giant’s build­ing con­trol sys­tems exposed to hack­ers.

“I was able to con­tact some­one there and they quick­ly changed their sys­tems, but often I can’t get any kind of response from peo­ple in this indus­try,” he says. “For instance, I know there’s a com­pa­ny in the con­struc­tion-safe­ty field that seems to be expos­ing its cus­tomers to a poten­tial attack. After months of phone calls and emails, I’ve been unable to get the ear of any­one who cares.”

Young believes that, in many such cas­es, firms find it hard to con­ceive that some­thing as seem­ing­ly incon­se­quen­tial as a ther­mo­stat can become the ide­al dis­creet entry point for a hack­er. His advice to prop­er­ty man­age­ment firms to “invest time and mon­ey in secu­ri­ty test­ing, mon­i­tor­ing and strat­e­gy now, rather than spend­ing it lat­er to clean up after a breach”.

Ed Cooke, CEO and man­ag­ing part­ner at Conexus Law, believes that there’s also a risk con­cern­ing the demar­ca­tion of respon­si­bil­i­ty for cyber­se­cu­ri­ty in many com­pa­nies. He explains that, while a firm’s head of IT will typ­i­cal­ly focus on pro­tect­ing oper­a­tional sys­tems, “build­ings are increas­ing­ly being run by com­put­ers that aren’t with­in the IT team’s remit. These are prob­a­bly man­aged by a facil­i­ties direc­tor or prop­er­ty direc­tor, depend­ing upon the size of the busi­ness. Indeed, they may even be man­aged by the land­lord.”

A call to action

The 2021 Queen’s Speech includ­ed pro­pos­als that would oblige man­u­fac­tur­ers, importers and dis­trib­u­tors to ensure that smart prod­ucts avail­able for pur­chase in the UK meet min­i­mum secu­ri­ty stan­dards. But what action can build­ing man­agers and own­ers take now to ensure the cyber­se­cu­ri­ty of new IoT instal­la­tions?

Luke Portel­li, build­ing man­ag­er at US real-estate giant CBRE, sug­gests that one obvi­ous way to mit­i­gate risk is to ensure that sen­sors in a build­ing are inde­pen­dent of the con­trol sys­tems. “This way, if the IoT is hacked, the most the cyber­crim­i­nal will be able to manip­u­late is sec­ondary data,” he says.

Portel­li cites WeMaintain’s secure, IoT-enabled ele­va­tor main­te­nance set-up as a case in point. This oper­ates in a secure pri­vate cloud, with the oper­at­ing and mon­i­tor­ing sys­tems oper­at­ing sep­a­rate­ly from each oth­er. This enables CBRE to retain con­trol over the oper­a­tion of the ele­va­tors and oth­er essen­tial sys­tems in the build­ing while still ben­e­fit­ing from the IoT data pro­vid­ed.

Prop­er­ty com­pa­nies should also ques­tion their build­ing man­age­ment part­ners, advis­es Tia­go Dias, a cyber­se­cu­ri­ty con­sul­tant at com­mer­cial prop­er­ty insur­er FM Glob­al. There’s a risk that these “third par­ties may be the weak­est link”, he says. If their sys­tems become infect­ed, “they’ll need to block the con­nec­tions that link to the build­ing man­age­ment equip­ment”.

He con­tin­ues: “Anoth­er exam­ple is where devices have weak secu­ri­ty fea­tures, such as hard-cod­ed default pass­words, that can be exploit­ed by attack­ers aim­ing to take con­trol of a sys­tem. They can use bot­nets to flood the net­work with high vol­umes of data, dis­rupt­ing tar­get­ed ser­vices in what’s known as a dis­trib­uted denial-of-ser­vice attack.”

Dias ends with a clear mes­sage for build­ing man­agers. “You need to ensure that your man­aged devices are ful­ly pro­tect­ed,” he urges. “These must not be exploit­ed or utilised as launch­pads for mali­cious gains