
The Internet of Things has revolutionized the way that we think of connectivity. In the past, the internet was a way for people to communicate -- now, virtually anything can, with minimal human interaction. Internet connectivity has allowed facility managers to automate more tasks than they would have thought possible just a decade ago, but at what cost? Today's hacker is savvy and knows how to find tiny vulnerabilities to exploit. All around the world, major utilities, businesses, and government entities alike have been experiencing cyberattacks. How can facility managers keep their businesses from being the next on the list?
The Colonial Pipeline Hack
On May 7th, 2021, an oil pipeline system suffered from a ransomware attack. This is a specific type of cyberattack that holds a company's data hostage until a ransom is paid. In Colonial's case, their billing system was compromised and the entire operation had to shut down until the problem could be dealt with. Later that month, on May 14th, the Health Service Executive of Ireland suffered an attack. All of its systems needed to be shut down, impacting hospitals, clinics, and patients nationwide.
Experts identified evidence of a well-known penetration testing tool in the HSE's systems, which had been used to secretly install and run the software responsible for the attack. In early 2020, Michigan schools fell prey to a ransomware attack that gained access through the HVAC system. This led to the closure of three schools as the district scrambled to rectify the situation. If a system is vulnerable, hackers will find a way into it.
Recognizing Vulnerable Systems
It can be hard to picture which systems in a facility might be potential openings for a hacker, but it's really fairly simple: If it can connect to the internet, it's vulnerable. If it connects to something that can connect to the internet, it's vulnerable. If it's operated by someone with access to the company's data, it's vulnerable. In the HSE's case, the attack was performed using a cybersecurity tool: A penetration test. This is a kind of purposeful hacking that's designed to test a system's vulnerability, identify weaknesses, and collect data for a risk assessment. This testing technology fell into the wrong hands, allowing it to be used by hackers to exploit vulnerabilities in the HSE's systems.
For facility managers, building management systems can be a major weakness. Vendors and offsite staff often have to use these for various purposes, so it's important for managers to have strict security protocols in place. Some facilities even have physical network access in several areas, which any stranger can walk up and take advantage of. Employees can be a vulnerability, themselves. Most hackers don't even have to bother with sophisticated software -- all they have to do is contact a random, unsuspecting employee, then ask the right questions to trick them into giving up account numbers, passwords, and more.
How to Protect Your Facility
If this sounds daunting, don't worry. While the convenience of connectivity has saved a lot of money, time, and labor, the tradeoff is the need for strong cybersecurity. There are several steps that facility owners and managers can take to protect their data and keep hackers at bay:
Thoroughly school employees.
Make sure workers know not to give their usernames, passwords, or other account information out for any purpose. Perform regular tests by staging phishing emails or phone calls, and make sure that any employee that falls for them gets a refresher course on cybersecurity.
Find physical access points, and remove them.
A facility can have physical access points in areas accessible to guests, and the owner or manager might not even know they exist. Perform a thorough physical inspection of the building (or buildings) to spot DSL or ethernet hookups, and have them removed or secured promptly.
Protect networks.
It probably sounds like common sense to password protect and encrypt facility networks, but protecting them goes a bit deeper. Are there any filters in place to keep employees from accessing dodgy websites? If not, they may inadvertently download malware, rendering all of those other protective measures moot.
Run penetration tests.
The tools used to hack the HSE are usually used for good. Facility managers can take advantage of them to get risk assessment data that will help them harden their systems against hacking. IT experts can assess vulnerabilities in new systems before purchase, so managers can make educated decisions on which option best fits into the facility's security ecosystem.
Know how to get everything secured quickly.
It's important to understand that no system is immune to hacking. If it connects to the internet or anything internet-enabled, it's vulnerable. While preventing a breach is always best, facility managers should work with building controls companies that can lock everything down shortly after an attack in order to minimize the damage. Good cybersecurity isn't a one-and-done, it's an evolving strategy to deal with an evolving threat. With these steps, facility managers can help keep their data safe.
If you're an IFMA-LI member, please login so you can comment on this article.
Read More










