Security measures
As large online security breaches have come to light in recent years, building professionals are increasingly asking about how to secure their Internet-facing building BAS. For the building design team, three cyber security best practices will improve the security of a building automation system against unauthorized access:
- ensure network isolation by deploying behind a firewall or on a virtual private network (VPN);
- use the security features built into the BAS; and
- configure the system securely by disabling guest user accounts and using strong password protection protocols.
Since BAS are networked throughout buildings (and often to the Internet) to enable remote access by facility managers, it is crucial to isolate the automation system from other internal networks, such as financial management or credit card processing. To accomplish this, the building design team should involve the client’s information technology (IT) experts early in the BAS selection process, as this is a specialized aspect of specification writing and usually requires acquisition and installation of additional hardware dedicated to protecting the building networks from both external and internal attacks. This hardware (e.g. firewalls, VPN routers) is extremely important and needs to be state-of-the art to combat the evolving means of attacking networks.
For the BAS itself, a control module with multiple Ethernet ports is an important security feature that helps to isolate the network. Such control modules physically separate the building systems from connections to outside networks. It is also important to specify a BAS that can be configured to use signed certificates for web connections to prevent ‘man-in-the-middle’ attacks when users log into the server. Beyond network connections, another security feature built into some BAS is a system that does not automatically execute code from USB thumb drives. This helps prevent a BAS user from inadvertently introducing a virus or other malware into the BAS.
Securely configuring the system once it is installed is important, so it is critical to ensure the BAS has a security manual that provides information on how to best accomplish this task, and then make sure the contractor follows those guidelines. Additionally, the BAS integrator should have documented the processes and procedures they followed for designing and implementing the system, which will be a crucial reference for the building owner.
Cyber-security threats change frequently, and need constant vigilance. Anyone who touches the system should be trained at a minimum in cyber-security awareness, and ideally should be certified to securely deploy vendor systems. It is also important they are aware of the building owner’s cyber security standards and practices. Building owners should also keep in mind the BAS will require maintenance, which might include patches to the operating system, and anti-virus software updates and management.
Strong cyber-security is a three-legged stool comprising:
- manufacturers and software vendors, who continually evaluate and improve the security of products;
- contractors and installers, who ensure their customers’ systems are properly and securely installed; and
- end-users, who build and maintain a culture of security within their organizations through the use of cyber security best practices.
Wall sensors
As with BAS software, a key differentiator among wall sensors is how easy they are to use—important for both facility staff and building occupants. Vendors have become increasingly sophisticated with designing wall sensors. One unit introduced in 2014 was designed according to what users are accustomed to seeing with their smartphones. For example, the unit includes easy-to-interpret icons for temperature control, and clear navigation tools to see interior and exterior temperatures, relative humidity (RH), and carbon dioxide (CO2) levels. To enable building occupants to see the HVAC operating condition from across the room, the unit has color light-emitting diode (LED) lights along its bottom to indicate either heating (red) or cooling (blue).
In terms of design styling, in commercial buildings, thermostats have often been visually ‘boxy.’ Now, manufacturers are focusing on aesthetics of these units in addition to performance. Some units are designed to be sharp and crisp with a low profile to complement modern architectural styling. Building owners and occupants have even gone so far as to say such units are ‘sexy.’ At any rate, a thermostat does not necessarily need to be a clunky box hidden around a corner, but can be a sleek addition to a room or hallway.
Conclusion
A properly equipped and configured automation system can save building owners tens of thousands of dollars or more on annual energy costs. Additionally, some facility professionals use the systems to save costs in other ways. For example, in Russellville, Arkansas, the school district officials use their BAS to monitor food and beverage freezers and coolers in schools throughout the area. The system sets off an alarm if temperatures begin to go out of range, which enables the facility staff to take prompt action and thereby avoid costly and wasteful spoilage.
To maximize the cost savings, when specifying an automation system it is important to think about each component—control module, software, and wall sensors—and consider how easy they are to use, and how flexible they are to changing technologies and building user needs.
Notes
1 For more, see “Building Automation Systems” at fpl.bizenergyadvisor.com. (back to top)
2 Visit “U.S. Building Automation Market Primed for Growth,” at technology.ihs.com. (back to top)
3 See note 1. (back to top)
4 See www.bu.edu/facilities/what-we-do/buildings/building-automation/ for more. (back to top)
5 Visit “EPA Building Commissioning Guidelines” at www.epa.gov. (back to top)
6 See “BACnet overview” at www.bacnet.org. (back to top)
7 See “Communication Systems for Building Automation and Control,” by Kastner, Neugschwandtner, Soucek, and Newman, Institute of Electrical and Electronics Engineers (IEEE), at www.researchgate.net. (back to top)
Kevin Callahan is a product marketing manager for Alerton, a Honeywell business. He has 38 years of experience in the building control technologies field, including control systems design and commissioning, facilities management, and user training. Callahan can be reached at kevin.callahan@honeywell.com.
