FMJ Facilities Management magazine providing industry-specific intelligence to FM and property professionals
With new technologies moving at pace, facilities managers are being warned of the hidden cyber security risks inside their building systems.
According to the latest UK Government Cyber Security Breaches Survey, 43 per cent of businesses reported a cyber security breach within the last 12 months, while the number of businesses which have adopted advanced controls like two-factor authentication (47 per cent) and user monitoring (30 per cent) remains low.
While FMs have been quick to embrace new technology and benefit from its enhancements, including Building Management Systems, access control and CCTV, which are becoming interconnected by digital platforms, David Robinson, Head of Cybersecurity at Restore Information Management says there are hidden cyber risks within digital building systems which FMs need to account for to increase security.
He said: “Many building systems still rely on default credentials straight out of the box. If these credentials aren’t changed, cyber criminals can gain access to critical systems with relative ease.
“As today’s digital building systems become more connected and cloud-based, facilities managers are chasing systems that are evolving quicker than they can protect them. Without the right controls, attackers could cause disruption in building systems and the organisation’s wider network.”
Below, Robinson provides five tips on how facilities managers can take control of their building technology to reduce cyber security risks.
1. Know what systems you have and how they are connected
It is crucial facilities managers know what building systems they have and how each one is connected. A simple way of doing this is by keeping a protected inventory of each system that is either networked or remotely accessible, including who supplies the system and how the access is provided.
This is the first step to improving your baseline security and protecting your business from advanced cyber criminals, who, once they have access to a system, can go anywhere in that network.
Do not leave this inventory to your IT team. When building systems fail, everyone notices it immediately – and staff will turn to the facilities management team first for help.
2. Eliminate shared logins and default passwords
On the surface, shared logins and default passwords are easy to remember and convenient. In reality, they’re one of the most common weaknesses in an organisation’s cyber security.
Facilities managers should ensure they have a password policy in place. This could include changing passwords every three months, reducing the number of employees who know the passwords, or changing passwords and logins every time an individual leaves the workplace.
It’s important to be proactive about password policies and not just rely on making changes when someone forgets their login.
3. Tighten controls
Facilities managers need to do their due diligence when it comes to remote access and control. The best way to do this is by taking ownership of who has access to what and for how long.
Carry out a monthly in-house audit of contractors who have had access to a building, whether they were admitted into the building by an employee or whether they had access themselves, whether their work is complete or not. If it is complete, access should be changed so they no longer have any company knowledge.
It’s a good idea to do a similar audit with employees and regularly check whether anyone has left the business, what they had access to, and to update these access routes to prevent external exposure.
4. Separate systems
It’s important building network systems are separated from corporate IT networks. In the event of a security breach, separated systems mean the breach will be isolated to that one network rather than the entire organisation.
Facilities managers should liaise with their IT team to push for that separation if it doesn’t already exist. Managers have the chance to be proactive and push for change in legacy systems, and this is an important one they should make.
5. Make cyber security your responsibility
Facilities managers need to have a proactive approach to cyber security and should engage with the IT team and across their entire organisation. Hold awareness training for all employees and teach them about the real-world consequences of a building system cyber-attack – such as doors failing, areas being unlocked, heating and cooling systems being disabled and CCTV feeds becoming unavailable.
Make sure everyone knows they have a part to play when it comes to cyber security and protecting the business.
What are the main issues for FMs and Service Providers in managing contracts and the front-line staff who deliver them?
Workday, the enterprise AI platform for managing people, money, and agents, has put together a short survey and is seeking views from professionals within the industry on your most pressing contract management issues, including recruitment and retention, maintaining compliance, and measuring performance, as well as your opinions on the adoption of data-driven solutions that help nurture staff and improve contract outcomes.
As a thank you, you’ll have the option to enter a free prize draw to win a £200 Amazon voucher.
To take part in the survey please click here.
