Q&A with Craig Chapman: Keeping smart buildings safe

To gain an understanding of some of the security issues faced by the smart buildings sector, ECD spoke to Craig Chapman, Chairperson at the KNX National Group Australia.

What are the biggest security threats to smart buildings at the moment?

The biggest threat from a security perspective comes from homes and buildings that are directly connected to the public internet. A physical attack upon a home or building is much more of a challenge for any hacker, as opposed to sitting at their desk and performing a cyber attack against homes/buildings from a computer that is directly connected to the public internet.

Even with unsecured wireless communications inside a home/building, a hacker would need to be within the geographic vicinity in order to be able to eavesdrop on the installation, or to try to hack into and attack it.

An obvious exception to the above is public buildings, such as hotels, schools, hospitals, shopping malls, etc, where it is really important within all publicly accessible areas for sensitive infrastructure and network equipment to be kept under lock and key (eg, within a locked distribution board and/or a locked room or cabinet).

Nowadays, a lot of smart home/building networks and systems utilise a cloud connection for various remote access functions and connectivity. So, any communication between the cloud and the physical device network within the home/building is communicated over the public internet and stored within a cloud server. In general, it is always advisable that any communication over the public internet is performed using a VPN (virtual private network), or that data is offered via a web server installed in the home/building which is then accessed by a cloud server with TLS (Transport Layer Security).

Are you observing any trends in terms of security threats?

Irrespective of the many and various cyber attack motivations that we are experiencing in Australia (see the below response) and around the world, it is safe to say that cybersecurity within any home or building is absolutely topical for the times that we are living in and vitally important for everyone to consider and preferably address.

Are there any threats particular to an Australian context?

We are all probably familiar with some recent high-profile corporate cyber attacks in Australia, where hackers have accessed and stolen sensitive financial and identification data and even the passwords of customers. There are other instances where entire critical networks or sensitive equipment are taken over and made inaccessible to the network operator/original installer, linked with a ransom request. Most of these are never made public, for fairly obvious reasons. There are further examples where hackers have infiltrated and temporarily taken control of, or inflicted some form of damage on, an installation just for fun, or as some form of vendetta.

While smart tech comes with obvious vulnerabilities, is there also a role the IoT can play in making buildings more secure?

The context of IoT won’t suddenly secure buildings against cyber attack.

Even with IoT, it is still paramount that the security protocols in place are observed by everyone involved with the building, including the building occupants. There is no use in having five deadbolts on a door, if an occupant still chooses to leave the door wide open. In other words, the building owner/manager must insist that security protocols and features within networks and products are properly employed by the installer and that strong passwords are utilised, as opposed to leaving networks and equipment in a default password state. This still happens more than anyone would like to admit!

And when a security algorithm is believed to be safe today, this does not necessarily mean that it will still be safe next week, or month, or year. Cybersecurity is a constant battle against weaknesses that get detected by hackers and hence, every system and every product must have a futureproof capability to be updated or upgraded to more modern and robust security measures in the future.

What does the KNX Association bring to the table in terms of mitigating these threats? Is KNX Secure part of this?

At the cradle of the KNX system, back in the 90s, the designers of the KNX system did not pay much attention to cybersecurity. At that time the connection of installations to the public internet was mostly non-existent and the wired installation was safely buried deep into the walls of the smart home or buildings of that time.

However, now that connection to the public internet is standard practice and wireless communication is much more widespread, a cybersecurity focus is an absolute must. In response, KNX extended its system several years back, with the possibility to protect KNX IP (= transmission of KNX messages across IP networks) with KNX IP Secure and KNX Data Secure for securing Twisted Pair and more important KNX Radio Frequency installations. Also with the KNX IoT extension, security has been built in by design, by using security mechanisms that are the work of the KNX Internet Engineering Task Force and will also be used by other smart home systems on the market.

So, in a nutshell: yes, KNX Secure was developed as a direct response and as an obvious next step to the question of cybersecurity for KNX networks and installations.

KNX Association is also taking this one step further by partnering with other Open Standards associations to develop common security standards for interoperability within buildings.

For more information about KNX Secure, visit: https://www.knx.org/knx-en/for-professionals/benefits/knx-secure/index.php.

To find out about how KNX Association is partnering with other Open Standards associations, visit: IP for Commercial Buildings | IP-BLiS (ipblis.org).

Image credit: iStock.com/Thinkhubstudio