security solutions

In modern industrial automation systems, BAS, also known as building automation systems, has become the core operation hub. However, its network security is often ignored. With the deep integration of OT and IT networks, BAS faces increasingly severe network threats, ranging from equipment manipulation to data leakage, which may cause serious consequences. Developing a comprehensive network security list is not optional, but a necessary measure to ensure the stable operation of the system.

Why BAS needs specialized cybersecurity measures

There are essential differences between traditional IT systems and BAS. BAS is composed of PLC, DCS, sensors and actuators, and it runs industrial protocols such as , etc. However, these protocols lack security authentication and encryption mechanisms from the beginning of the design. The deployment cycle of many BAS devices is as long as 15 to 20 years, and there is no way to update patches as frequently as IT equipment.

During actual deployment, the BAS network is often directly connected to the enterprise management network, but lacks sufficient security isolation measures. Once an attacker successfully breaks through an enterprise's IT defense line, they can directly enter the control system without any hindrance. There was once a manufacturing company that suffered an intrusion into its BAS system, causing the entire temperature control system to lose functionality, causing the production line to stop running for three days, causing losses exceeding one million yuan.

How to assess the current security risk status of BAS systems

Start the risk assessment with the asset list. First, compile a complete BAS device list including controllers, field devices, servers, and workstations, and record the models, firmware versions, and network locations. Then, identify the vulnerabilities of each asset. This identification operation can be carried out with the help of professional vulnerability scanning tools. However, it should be noted that the scanning behavior may have an impact on the real-time control system. This scanning work needs to be carried out during the maintenance window.

The core link is threat modeling. It is necessary to analyze which systems are most vulnerable to attacks, and to evaluate the possibility and impact of attacks. For example, if the HVAC system is attacked, it may cause the environment to go out of control, but if the lighting system fails, it will affect employee safety. These risks must be quantified, high-risk projects should be prioritized, and targeted mitigation measures should be formulated.

Best practices for BAS network isolation

Network segmentation is the cornerstone of BAS security. It is recommended to divide at least three areas, namely the enterprise IT area, industrial DMZ, and BAS control area. The industrial DMZ plays the role of a buffer. It is necessary to deploy and alarm servers, etc., not only to allow data to flow, but also to prevent direct access to the control layer. By using next-generation firewalls to implement rules, only necessary protocols and ports are allowed.

Within the control network, VLAN isolation also plays an important role. Different VLANs must be divided according to functions, such as HVAC, lighting, security systems, etc., to remain independent. Strict access control lists also need to be configured to restrict cross-VLAN communications. Physical isolation cannot be ignored either. Key control systems should be completely isolated from the office network and use one-way gatekeepers for data exchange.

How to protect field devices in BAS systems

Basic security measures are the starting point for on-site equipment protection. Change all default passwords, adopt a strong password policy, and change them regularly. Unused ports and services, such as the device's web interface or services, must be disabled. For PLCs and controllers, firmware reinforcement should be implemented and unnecessary functional modules should be removed.

Physical security is often ignored by people, but it is crucial. The control cabinet should be locked to limit the contact of relevant personnel. Intrusion detection sensors should be deployed to monitor the opening status of the cabinet. Anti-tamper labels should be used on the terminal blocks to prevent unauthorized wiring. On-site equipment should be inspected regularly to check whether there are abnormal connections or unknown equipment access.

BAS data security and communication encryption solution

BAS communication encryption must balance security and performance. For sensitive data such as user credentials and control commands, TLS or IPsec encryption must be used. For /IP and other protocols, the /SC (secure communication) version can be deployed to provide authentication and encryption. Historical data storage also needs to be protected. The database must be encrypted and access logs must be fully recorded.

Key management is the key to successful encryption. It is necessary to build a complete key life cycle management system, covering generation, distribution, rotation and destruction. For devices with limited resources, lightweight encryption algorithms need to be considered. Backup solutions are absolutely indispensable. The purpose is to ensure that encrypted data can be restored in the event of a disaster. At the same time, the backup data itself also needs to be protected through encryption.

BAS safety monitoring and emergency response process

Continuous monitoring plays a key role in detecting threats. An industrial SIEM system must be deployed to collect BAS device logs, network traffic and alarm information. Use behavioral analysis technology to establish a baseline to detect abnormal operations, such as determining whether configuration changes are made during non-working hours. Anomaly detection brought about by network traffic can detect data exfiltration or scanning behavior.

Emergency response plans should be detailed and well-drilled, with clear procedures for handling various incidents, such as malware infection and unauthorized access. A dedicated emergency response team is set up, which includes automation engineers, IT security personnel and operations personnel. Red-blue confrontation exercises should be carried out regularly, mainly to test the effectiveness of the response plan, so as to continuously improve it. Provide global procurement services for weak electronic intelligent products!

Regarding your BAS security practice, which aspect do you think is the most challenging? Welcome to share your experience in the comment area. If you find this article useful, please like it and share it with your colleagues.