Unpacking Zero Trust in Operational Technology: A Deep Dive into Smart Building Cybersecurity

The Escalating Threat Landscape

In 2023, a ransomware attack on a U.S. hospital’s HVAC system necessitated emergency patient relocations when the attackers locked the climate controls (CISA Alert TA23-074A). This incident, alongside a 2023 ransomware attack on a U.S. casino’s HVAC system, which was initiated through an unsecured IoT fish tank sensor (CISA Alert IN23-131A), exemplifies the growing vulnerability of Operational Technology (OT) in building automation systems. Despite rising threats, many organizations remain entrenched in a compliance-first mindset, relying on outdated security frameworks that fail to withstand sophisticated attacks.

This article examines critical areas where the industry must evolve, with a focus on the paramount importance of Zero Trust architectures, advancing beyond traditional detection methods, and clarifying liability within the OT security chain.

What Exactly is Zero Trust?

The term “zero trust” is a hot topic in cybersecurity, but what does it mean for the built environment?

As Aaron Brondum, Sr. Director Business Development at NEEVE, emphasizes, Zero Trust is a “game-changer in cybersecurity.” He explains: “The traditional approach is that once you’re inside the network, you’re trusted. Zero Trust flips that on its head—it’s more like, ‘never trust, always verify.’ Every single user or device that’s trying to access any resource has to be verified, no matter where they are or how they’re connecting.”

Mike McMahon, Consulting Engineer at Nukem + Boyd, describes it fundamentally as, “I don’t trust anybody.” He elaborates that it’s a methodology that “pairs a thing with a person,” allowing for precise control over who and what are interfacing on a network.

Jim Lee, President of Cimetrics, offers a compelling analogy: “If you imagine an old castle with a moat around it, what we’ve done… is build a moat to protect our systems.” Zero trust takes this further by putting “cybersecurity certificates or keys down in the lowest level devices,” like variable air volume boxes. This means, “if you don’t have the key… You can’t get in.” He also introduces the concept of authorization – “who gets to do what” – preventing, for example, a chiller from writing commands to a boiler.

Aaron simplifies it further with a hotel analogy: “We all can walk right in the front door [of a hotel]… and then we have to get a card to get to our room, and that’s the only place we can get to.” This contrasts sharply with traditional VPNs, which are like “just going through the front door” and having full access to everything. Zero trust, or Zero Trust Network Access (ZTNA), ensures you’re “locked down… to that specific endpoint.” It’s about verifying and continuously verifying, monitoring for anomalies, and shutting down connections immediately if something suspicious occurs.

While the core principle remains consistent, its application differs between IT and OT networks:

The Major Hurdles: Challenges in OT Cybersecurity

Despite the clear benefits, integrating robust cybersecurity into OT environments faces significant challenges:

1. Ownership and Responsibility: The question “Who owns it?” is a perennial one. System integrators (SIs) often point to owners, and owners to SIs. Aaron highlights that IT-purpose-built solutions typically don’t fit OT, resulting in wasted money and ineffective protection.
2. Funding Paradigm: Jim Lee points out a fundamental economic disconnect: “Everything that we do in this industry is based on economics around products or projects… discreet in time.” Cybersecurity, however, is an ongoing process – an operating expense, not a capital cost. This makes securing long-term funding difficult.
3. IT vs. OT Divergence: While IT initially seemed poised to “subsume OT,” the complexity of OT systems deterred them. IT now prefers OT specialists to handle daily operations, but still wants oversight.
4. Third and Fourth-Party Risk: Unlike IT, OT projects involve a broader ecosystem of stakeholders: construction managers, consulting engineers, system integrators, and commissioning agents. Each introduces a potential risk that needs to be managed.
5. The Legacy Challenge (“Feral Cats”): Building Management Systems (BMS) often operate on decades-old protocols, such as BACnet IP and Modbus TCP, which lack modern encryption (NIST SP 800-82 Rev. 3). Full system replacement is rarely feasible due to cost and operational constraints. Mike McMahon coined the term “feral cat” for devices dropped onto a network without proper security, resulting in vulnerabilities. Many OT devices lack certificate-based authentication, use default credentials (e.g., “admin:admin”), and are unable to support agent-based security.

Paving the Way Forward: Solutions and Best Practices

The experts offered actionable strategies to address these challenges:

Implementing Zero-Trust for Legacy BMS: Practical Implementation

The consensus is clear: “You need to stop using VPNs.” VPNs grant excessive trust and are obsolete for OT. Zero Trust requires continuous authentication.

Proven Mitigation Strategies:

• Network Microsegmentation: Isolate critical subsystems into protected zones using VLANs or software-defined perimeters (NISTIR 8374). This ensures that if a threat breaches one segment, it cannot easily spread to critical OT systems like HVAC or elevators. The National Institute of Standards and Technology (NIST) recommends this approach.
• Protocol-Aware Firewalls: Deploy OT-specific solutions, such as Tofino Xenon, that can inspect OT traffic (like BACnet/IP) without disrupting legacy devices (Dragos, 2023 OT Cybersecurity Year in Review).
• Command Whitelisting: Research from the Idaho National Laboratory demonstrates how allowing only pre-validated device commands can prevent 92% of OT attacks (INL/EXT-22-68496).
• Secure Remote Access: ZTNA solutions should link access to a “unique persona,” ideally through company email, single sign-on (SSO), and multi-factor authentication (MFA). This ensures granular control and continuous monitoring. NEEVE’s model includes MFA for all users, device posture checks before granting session-based access, and encrypted tunnels for all remote connections. (Implementation benchmark: ISA/IEC 62443-3-3).

Case Study: A University of California campus secured its 1990s-era BMS by implementing application-aware segmentation, reducing attack surface by 78% (UC Case Study, 2022; UC Berkeley Facilities Report, 2023).

AI-Driven Anomaly Detection: From Theory to Practice

Limitations of Traditional Methods: Signature-based tools fail to detect novel attack patterns. The 2021 Colonial Pipeline attack demonstrated how legacy systems miss living-off-the-land techniques (DOJ Press Release 21-551).

Emerging Best Practices:

• Behavioral Baseline: The MITRE ATT&CK for ICS framework now includes machine learning detection techniques for OT environments (MITRE ICS-T0015). This involves learning normal behavior and flagging deviations.
• Hybrid Deployment Models:
  • Passive network monitoring with tools like Nozomi Guardian for OT traffic analysis.
  • Embedded runtime protection from vendors like Claroty.
• Validation Requirements: The ISA 62443-4-2 standard now addresses AI model testing for false positive rates in industrial environments.

Collaboration and Governance

• Implement Basic Cyber Hygiene: Mike emphasizes simple yet impactful steps:
  • Change Default Passwords: Avoid standard defaults, such as “admin.”
  • Disable Unused Interfaces: Turn off wireless networks or ports not in active use.
  • Collaborate with IT: Identify if an IT group exists and understand their cybersecurity policies.
• Integrate Cyber into Design (OPR): The RECC is developing Owner’s Project Requirements (OPR) with embedded cybersecurity language. This provides a “Northstar” for designers and ensures security is a foundational element from the outset.
• Foster “Cyber Harmony”: Greg introduced the concept of “Cyber Harmony,” likening it to an orchestra where “everybody has to be on the same sheet of music.” This means ensuring all stakeholders – from designers to commissioning agents – understand their role in securing the facility.
• Establish an OT Governance Team: Owners should consider forming a dedicated OT governance team, ideally with representatives from both facilities and IT. This team can vet manufacturers, protocols, and networking practices and ensure cyber requirements are enforced throughout the project lifecycle.

Leveraging BACnet Secure Connect (BACnet SC)

Jim Lee highlighted BACnet SC as a robust, interoperable cybersecurity standard for BAS. Approved by ASHRAE, it uses web sockets and traditional IT cybersecurity principles, adapted for OT. Crucially, Addendum CP, approved five months prior, introduces authorization and authentication directly into the standard, allowing for granular control over device permissions.

5. Liability in the OT Security Chain

The Shared Responsibility Dilemma is a growing concern. Recent litigation (e.g., Johnson Controls International PLC v. City Hospital) highlights growing disputes over:

• OEM’s responsibility for vulnerable firmware (CVE-2022-3715)
• Integrator accountable for default credentials
• Owner obligations for patch management

Contractual Solutions:

• Extended Security Support: Demand minimum 10-year vulnerability disclosure policies from OEMs (modeled after Microsoft’s IoT Security Commitment).
• Cyber Insurance Requirements: Marsh’s 2023 Global Insurance Market Report shows 62% of OT claims now require third-party vendor coverage.
• Incident Response Protocols: The NIST Cybersecurity Framework (CSF 2.0) provides template language for breach response responsibilities.
  

Conclusion: A Proactive Security Posture

The discussion underscored that cybersecurity in OT is not a one-time project but an ongoing process. Ransomware attacks are a daily reality for system integrators, making proactive measures imperative. The building automation industry must transition from:

• Compliance checklists → Continuous threat monitoring
• Isolated systems → Collaborative defense
• Reactive patching → Secure-by-design

Sources

• CISA Alert TA23-074A (2023)
• CISA Alert IN23-131A (2023) – Casino HVAC Attack
• NIST SP 800-82 Revision 3 (2023) – OT Security Guidelines
• NISTIR 8374 (2023)
• Dragos, 2023 OT Cybersecurity Year in Review (2023)
• Idaho National Laboratory (INL/EXT-22-68496)
• UC Case Study, 2022 / UC Berkeley Facilities Report (2023) – Segmentation Case Study
• DOJ Press Release 21-551 (2021)
• MITRE ATT&CK for ICS Matrix (2024)
• ISA 62443-4-2 Standard
• Johnson Controls International PLC v. City Hospital (2022)
• Marsh’s 2023 Global Insurance Market Report (2023)
• NIST Cybersecurity Framework (CSF 2.0)