ScottZiegenfusCEM,CLEP,CDSM,GGP,GPCP,LEEDAP

Manager,GovernmentandIndustryRelations

HubbellLighting,Inc.

Picture

ItiseasytounderstandyouareundercorporateITmanagementwhentheBuildingowner/developertalksaboutthevisionofputtingalltheenvironmentalandbuildingsystemsonthesameITBackbonesoallEnvironmentalSystemscansharethedata.

•  NeedsITcoordinationandBuy-in–  Designphase–  Constructionphase–  Startup

•  Documentation–  ITspecifications–  NetworkDiagrams

INTERNET

TELEPHONETELEPHONE

SECURITY

LIFESAFETY

ACCESS

EthernetBackboneEthernetBackbone

ELEVATORELEVATOR

WATER

LIGHTING

HVAC

CorporateITDepartment/InstitutionalITDepartment/PropertyManagementITDepartment/etc.“WhatIhaveseen”•  ThebiggerthenetworkedlightingprojectthemoreinvolvedIT

becomes.

•  ITdoesnotgetpraisedforkeepingthenetworkrunning.“Greatjob,weallwereabletologontoday”Neverhappens

•  ITgetsintroubleforitnotrunningsoanythingthatisunfamiliarorcan’tcontrolisBAD

•  HomeWi-FiwirelessrouterisnotcorporateIT.

•  HowCorporateITthinksaboutthisdevice•  “ThetermWi-Firouterkind-ofamisnomer,actuallyits”:1.  Wirelessaccesspoint(WAP)

2.  Layer2bridgebetweenIEEE802.3(Ethernet)andIEEE802.11(Wi-Fi)

3.  Layer2unmanagedswitch

4.  Layer3routerbetweenyourISPandHomeLAN

5.  DHCPserver

•  CorporateIThandleseachpartindividuallySouthParkStudios

OSIModel•  Networkingismade-upof7operatinglayerswhichwork

togetherandatthesametime•  Hardwareandsoftwareareseparate

•  MixandmatchLayers•  TheOSImodelisthebasisforeveryITdepartment

5

Softwareand

SoftwareAddresses

Connectionsand

HardwareAddresses

TCP/UDP

Telnet

FTP

HTTP

=

=

IP

Ethernet

Wi-Fi

7<Layers>1

2Data

1Physical

3Network

4Transport

5Session

6Presentation

7Application

=

=

LikeadinnermenuwhereyoucanselectAppetizerfromcolumnAEntreefromcolumnBDesertfromcolumnC

•  Layers1to4–  networkcommunications

•  Mediumsendingthemessage•  Packagingofthemessage•  Identifyingthemessage

•  Layers5to7–  applicationlayers

•  Messageformat•  Messagestructure

6

TCP/UDP

TelnetFTPHTTP

IPEthernet

Wi-Fi

2Data

1Physical

3Network

4Transport

5Session

6Presentation

7Application

=

=

MACAddress

IPAddress

Ports

switch

Cables

Router

=

Ports

JUSTFORFUN“TheTrueStoryOfNetworklayering”https://www.cs.purdue.edu/homes/dec/essay.network.layers.html

TriggersthatCANputAsystemundercorporateITmanagementwhenyoudidnotthinkitwasØ  TheobviousiswhenusingtheexistingcorporateITequipmentlikenetwork

switches,routers,servers,fiberorcopperrunsBUTusingANYpartoftheexistingITinfrastructuremayputyouunderITlike:–  Usingthefiberbetweenbuildings•  Don’tthinkyouwillbediggingyourowntrench

–  NeedingRemoteAccess•  Unlessyouraresettingupyourowncellularhotspot•  Don’tassumeyoucanbringinaseparatelinewithyourownISP

–  WiFiforapp•  Don’tassumeyoucanputinyourownwirelessasacompetingnetwork

–  Interconnectingdifferentbuildingsystems•  ConnectingtotheBMSorProAVnetworkalreadyonthecorporateintranetputsyouonthecorporateintranet.

–  Cloudaccessovertheinternet•  SEEREMOTEACCESS,IT’STHESAMETHING

DonotassumenetworklightingisnotunderthecorporateITpolicies?Example:YouweretoldbythemanufacturertouseaserverwithtwoNetworkInterfaceCards(NICs)toisolatetheLightingnetworkfromthecorporateintranet.TheonlythingcorporateITneedstoworryaboutistheserver.

WhatequipmentwillbeontheCorporatenetwork?Whatarethe2NICsfor?NOTHEYDON’T!Thatwouldbasicallybridgethenetworks!Letsstartatthebeginningandtellmeallaboutyourlightingnetwork!!!

Weonlyneedawindowsserverwith2NICs.Theyseparatethelightingnetworkfromyournetwork.TheyDon’t????Oh?HUMM?????

IT

YOU

DonotassumenetworklightingthatisnotIPisnotunderthecorporateITpolicies?Example:YouweretolditsinceitisZigbeeorBluetoothwirelessorsomethingelsethatisnotIPsoitisnotunderITpolicy.

Ihearyouareusingwirelessat2.4GHz?Whattypeofwirelessprotocolisit?Isitconnectedtoourintranet?NowIammoreworriedthenever!!!!

Yesbutitis_______andnotWi-Fi.ItsfollowsIEEE802.15.4andisAES128encrypted.Yes,butthroughagatewaysoyoudon'thavetoworryaboutit.

JUSTFORFUN“AStickFigureGuidetotheAdvancedEncryptionStandard(AES)”http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html

IT

YOU

Serverneeds

Cloudandremoteaccess Physical

Network

Buyingtheequipment

Security?

•  WhoareyoutalkingtointheITdepartment?•  Neverthesameorgchart,NotallITdepartmentsarecreated

equal.

•  Doyouneedtotalktomultiplepeople?

•  Isittherightpeople?

ITdepartmentsarelikesnowflakes

everyoneisdifferent

•  DoyouneedtousethecorporateEthernetorWi-Fi?

•  WhoprovidesstandardnetworkHardware/cables?

•  MeetwithITmanagementifpossibleforanyspecialpoliciesshouldbeputinspecsecurity/equipment?

ThedesigngroupmighthaveacharretteandinviteIT

LIGHTING DESIGNERARCHITECH ELECTRICAL

ENGINEER

•  WhatEnvironmentalSystemswillbeoperatingonthesharednetwork,Lighting,BMS,A/V,etc?

•  PlacedinDivision23or26or27or25orall?

•  IsInternetaccessrequired?”

•  SystemDependentontheNetworkordistributedintelligence?

LIGHTING DESIGNERARCHITECH ELECTRICAL

ENGINEER

•  Doesthenetworkhavetobeinplacepriortosystemcommission?

•  IstheITauthorityonsiteyet?

•  IstheSystemnetworkinfrastructurestayingseparateuntiltheend?

•  AnyNetworkpre-testingrequirement?

•  Doessystemstartupneedsecureroomaccess?

•  InstallersshouldmeetwithITgroupsPreinstallationsServices/Applications/NetworkServices/Security?

•  ActiveDirectory?

•  Adminaccessforinstallationofsoftware?

•  StartupmeetwithITgroupsduringinstallationsServices/Applications/NetworkServices/Security?

•  Remoteaccessformaintenanceprocedure?

•  Seversetup,cloudorlocal?

ANetworkDiagram•  Isnotareflectedceilingplan,orone-line•  OnlyshowingItemsrelevanttotheCorporatenetwork•  IfithasanIPaddress•  Shouldshowatleast:

–  Whatdevicesinthelightingsystemareonthenetwork–  Physicalwiredorwirelessstructure(Ethernet,Cabletype,etc.)–  Hardwaretypesandplacement(switch,router,…)–  Networkaddressingschema(IPv4,IPv6,ClassA,etc…)–  Servertypesandplacement(webserver,data,cloud,edge..)–  Basicmethodology(unicast,multicast,broadcast)–  Protocolsused(Ethernet,UDP,PIM,IGMP,CoAP,etc.)–  UIconnectivityandplacement–  Anyadditionalnotes

– 

ITSpecificationorGuide•  Notinstallationinstructionsorproductspecs

•  YouarenottellingITwhatyouneedbutseeingifyourrequirementsisallowedbythecorporateITguidelines.

•  OnlyreferencingItemsonthenetworkandhowrequirementsoftheconnection.−  Theydon’tcarethatyouhaveanopenorcloseloopdaylightsensor.

JohnsonControlsLIT-1201578

ITSpecificationorGuidetohandtoIT

•  Basicnetworkinformationsuchas:–  NetworkArchitectureoverview(multicast,VLAN,etc.…)–  Hardwareandwiringconfiguration(physicalanddatalinklayer)–  AddressConfiguration(networklayer)–  Ports(Transportlayer)–  PCand/orserverrequirements–  Protocolsused(HTTPS,PIM,Ethernet,etc….)–  ServerArchitecture(N-Tier,Remote,OS,etc…)–  AccessRequirements

•  “SecuritybyObscurity”isgoneforourindustry.

•  Productswithamicrocontrollerarenotthoughttobeimmuneanymore!

•  DepartmentofHomelandSecurityputsoutweeklyfoundvulnerabilitiesonsoftwareandoperatingsystemshttps://www.us-cert.gov.

•  ProductsfromourindustryincludingPLCshavemadethecut!

AllLayersarevulnerable

Tellmeaboutyoursecurity?And?Thattellsmeaboutlayer1and2butwhatabouttheotherlayersoryourapplication.Likearethepasswords,justtxt,Hashed,Salted?

WeuseAES128!AndWhat?Applications?HUMM????

IT

YOU

https://www.us-cert.gov/security-publications/DDoS-Quick-Guide

•  PortsaretheGatewaybetweenApplicationsandtransportofData.

•  Basicmechanismfirewallsrelyonforallowingordenyingnetworktraffic.

•  Makesureportsareonyourdocumentation

TCP/UDP

Telnet

HTTPS

HTTP

IP

Ethernet

Wi-Fi

Port23

Port443

Port80

Foryourwebserverwhatportdoyouneedopen?Wedon’tallowHTTPonlyHTTPSonournetworkrequiringTLSatleastVersion1.1securityOK!

443and80.443itis!

IT

YOU

•  MoreaboutITsecurityproceduresthenprotocolsandspecifics–  Meaningdifficulttoaddtospecifications–  https://www.nist.gov/cyberframework

•  NIST800ComputerSecurityPublications–  computer/cyber/information,securityguidelines,recommendationsand

referencematerials–  http://csrc.nist.gov/publications/PubsSPs.html

•  NIST1800NISTCybersecurityPracticeGuides–  practical,user-friendlyguidesforSP800s–  http://csrc.nist.gov/publications/PubsSPs.html

•  DefactoITsecuritypolicyformanysensitiveinstallations–  ExampleC137.2proposedCybersecurityRequirementsforLightingSystems

forParkingFacilitiesreferencesNISTCybersecurityextensively

YoumightberequiredtohaveItemslike:•  VenerabilityAssessment–  Anonintrusivesearchforweaknesses/exposuresinordertoapplya

patchorfixtopreventacompromise

•  GSArequiresavenerabilitytestfordevicesconnecting/usingtheirnetwork

•  PenetrationTesting(pentesting)–  Anauthorizedsimulatedattackonahardwareconnectedtoa

networkandreportingresults

•  HardeningDocument–  Documentonremovingallnon-essentialprogramsandutilitiesand

closingallnon-essentialportsfromthedevice

ULCybersecurityAssistanceProgram(CAP)•  UsingUL2900standards

•  Initialstandardjustpublishedsummerof2017–  2900-1Generalstandard(out)–  2900-2-1Industrial(coming)–  3900-2-2Healthcare(coming)–  2900-2-3lifeSafety(coming)

•  Hasthepotentialforeasierspecification

1.   TheearlieryoutalktotheITdepartmentthebetter2.   Don’tassumesinceyoutalkedtooneITadminyoutalked

tothecorrectpersoninIT.3.   Don’tdictate,collaborate.4.   TheITdepartmentdoesnotcareaboutitemsnotontheir

network.5.   Don’tassumebecauseyouhavebeentoldthesystemora

partofyoursystemisseparatefromthenetworkITwillagreewithyou.

6.   Iftheyunderstandsystemarchitecturetheycanfillthesecuritygaps,

7.   KeeptheITdepartmentinformedalongtheway.