Smart Connected Buildings - Cybersecurity Maturity Model (SCB-CMM): Proliferate Cybersecurity Maturity Level in Smart Connected Buildings To Facilitate Secure Integration with Smart-Grids and Micro-Grids

By Mangaya Sivagnanam and Dr. Massoud Amin

The Smart Connected Buildings (SCB) represent a convergence of latest cutting-edge technologies including Self-awareness, Predictive Maintenance, Convergent Networks, Wireless Retrofits, and Biometric, all with security built-in as a design criterion. They continuously integrate and interact with the Smart-Grids and Micro-Grids to optimally achieve functions such as Combined Cooling-Heating-Power, Solar-Photovoltaic, Wind Generation, Energy Storage and sophisticated grid controls and optimization software.

The SCB is the inner-most element within a smart grid and the fact that buildings are the number-one energy consumption nodes and also the most significant producer of distributed renewable energy. The role of buildings in the Smart-Grid infrastructure is very crucial. As many of these net-zero energy buildings operate with less energy and less operating cost; these improvements make them more appealing on many fronts – with the cost of operation to LEED certification, predictive maintenance, full-life-cycle asset management, Demand Response, and more.

Currently, SCB across all critical infrastructure do not have the same cybersecurity maturity levels and do not necessarily align with smart grid standards. So, integrating the two entities (SCB and Smart-Grids) with different maturity levels makes SCB more vulnerable (due to mismatches and holes in the seams where they connect and exchange information). At the same time, it makes smart grids susceptible to various eavesdropping and attacks as these buildings can potentially become an easy-entry point for intruders.

So the recommendation is to proliferate cybersecurity maturity level of the SCB to match features, technologies, and maturity with the connected micro or smart grids.

Resilient buildings and cities are prerequisites to support the vision of “Resilient Nation” discussed and presented in various settings, during the past 20 years (including Y2K, post 9/11, persistent cyber-physical attacks, post major natural disasters, and more.). Therefore, before infusing external security and intelligence into our buildings, it is more prudent if SCB can intrinsically secure itself and become smart, secure, resilient, and sustainable. Security needs to be built in as part of its design, the Smart Connected Buildings Cybersecurity Maturity Model (SCB-CMM) supports this strategy.

The model helps infuse Command, Control, Communication, Computation, and Intelligence (C4I) in buildings; and create cost-effective and risk-informed improvements to the cybersecurity standards and programs (across all sectors with various backgrounds and sizes). More specifically, the SCB-CMM focuses on the implementation and management of cybersecurity standards and programs on SCB considering the deployment of information technologies (IT) and operational technologies (OT) integrated within the cyber-physical systems (CPS) in the environments which they operate. This system/model includes several tested/proven benefits, which include:

• Strengthen cybersecurity standards and capabilities and enables a very secure integration and interaction with smart grid and micro grid.
• Enable SCB to evaluate the threats, risks, and capabilities frequently, and improves buildings efficiency and resiliency.
• Provides a layered security approach protecting endpoints, applications, data, networks, and digital space.

Structure

This system/model provides flexible, agile and scalable standards and guidance to benefit SCB to improve cybersecurity maturity levels. The model comprises of 12 main domains to group the cybersecurity standards, programs, and practices. Each domain delivers a purpose for the organization's cybersecurity measures. They are “Flexible and Agile OT/IT Network Governance”, “Risk Management Framework”, “Asset and Configuration Management”, “Access Management”, “Threat-Vulnerability Management Process”, “Patch Management “, “Network Assessments”, “Situational Awareness”, “Information Sharing and Communication”, “Incident Response and Business Continuity Program”, “Supply Chain and Vendor Management”, and “Cybersecurity Training”.

The model provides an edifice and contingencies plan for handling uncertainty in heterogeneous systems in network governance. It influences the enterprise’s governance by evaluating standards, policies, procedure, regulations, audit process, and compliance with other IT/OT/CPS requirements. It cogitates innovations in building-technologies along with the growing risk, threats, and vulnerabilities in the industries. Thus the model develops a stimulus approaches capable of adjusting and improving the cybersecurity maturity level in organizations and 16 critical infrastructures functioning in the SCB. Seamless integration of all 12 domains develops a secure SCB.

Progression

The model’s domains serve specific objectives, roles and practice plans to increase the cybersecurity standards in the SCB. The recommendations are implemented in the bottom-to-top approach progression. The progression has both short-term and long-term implementation plans comprising of six main phases. Phase 1 starts by setting a foundation with proper “cybersecurity training.” Phase 2, for network security, the organization needs to establish an appropriate foundational approach like “Asset-Configuration Management,” “Access-Management,” “Network-Assessments,” “Information-sharing and Communication.” Phase 3, the organization needs to strengthen its“Situational-Awareness” by maintaining appropriate process and technologies to collect, analyze and ingest cybersecurity information efficiently.

The first 3 phases are the recommended short-term goals that help the organization to set a proper background and gain the necessary momentum to support effective implementation and functioning of other domains/functionalities.

For example, with proper implementation and initial focus the “Network Assessment” domain will indirectly improve the maturity level of “Risk and Threat–Vulnerability Management” domains in the longer-term initiatives. Similarly, the “Asset-Configuration” and “Patch Management” domains are interlinked; so improving the maturity in the first will facilitate effective patching in all edge systems in the building networks.

Also, with appropriate “Situational Awareness” security controls in place will advance the organization’s “Incident Response” capabilities.

Phases 4, 5, and 6 are part of longer-term recommendations. In phase 4, the organization can enhance overall cybersecurity standards by “Risk Management Framework,” “Threat-Vulnerability Management,” “Patch Management,” and “Supply-Chain and Vendor Management.” Phase-5 “Incident Response and Business Continuity” program improve immediacy to respond to incidents. Finally in phase 6, “Flexible-Agile-Governance” develops synergy among all 12 domains and supports the organization to become a stimulus to react to threats with technology advancements and innovations.

Conclusion

Cyber connectivity has provided many benefits. However, it has increased the complexity of systems. Enterprises aiming to modernize their facilities, need to overcome significant challenges before massive deployments of smart-technologies in their buildings, to predict, prevent, contain and terminate cyber-physical attacks. The model presented helps organizations to proactively respond to increased cyber-physical attacks as an integrated part of emerging technologies and innovations in building technologies.

Broad use of the SCB-CMM model across all critical infrastructures supported benchmarking sector's cybersecurity maturity and provided a roadmap to secure smart cities. A resilient infrastructure builds a resilient city and a resilient nation. In summary, the SCB-CMM develops resilient, self-diagnosing, self-healing buildings, and facilitate secure integration with smartgrids; thus aids in building secure smart cities, and helps achieve the vision of a “Resilient Nation.”

Finally, in the complex SCB networks, the human participants themselves are the most susceptible to failure and the most adaptable in the business recovery. So proper cybersecurity training and awareness are mandatory for employees since no technology can replace qualified security professionals.

Figure 1: SCB-CMM Maturity Approach Progression in an Organization  

Figure shows the graphical representation of how 12 domains of the model are structured and layered in the maturity approach progression in an organization along the area of focus where it is People, Process, and technology

Contributors