Cyber Security considerations in major building assets

1© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

The premise....• Systems controlling building management/

facilities (plant control, CCTV, access control) have moved from analogue/manual systems to digital TCP/IP based systems.

• These digital systems are frequently beyond the view and/or control of information security team – often susceptible to risks and consequences that don’t exist in corporate systems.

• Insecure network design might not be detected by usual security protocols.

In short – weaknesses in physical security and systems that were previously not TCP/IP based, are creating cyber security risks for building managers, owners and tenants

Some real world consequences:• Researchers identified that the

Google Sydney office building management system (BMS) could be compromised and used to control the air-conditioning system

• Target (US) Point of Sale breach – speculation that credentials were obtained from an HVAC service provider and were used in some way to obtain access

2© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

In addition, to the Google and Target examples, KPMG has been working with major property management organisations in Australia to help them better understand the risks

Overview• Very large retail shopping mall – suburban

• High rise office tower CBD

• Substantial recent expansion – new building works and fit out

• Sophisticated systems for building management, security, parking management, customer information etc.

KPMG Scope

• Review security (internal and external) protecting information assets

• Assess access integrity of key systems

• Consider operability and resilience

• Assess physical security related to information protection

3© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Finding Caused by

The building management system could be compromised.

• Poor systems access controls.• Lack of encryption systems.• Ineffective physical protection of communications

infrastructure.• Inadequate network design.

CCTV Security system could be disabled.

• Ineffective physical protection of communications infrastructure.

• Inadequate network design.

KPMG Demonstrated that.....

4© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Finding Caused by

CCTV stored footage could be anonymously viewed, modified or deleted.

• Poor systems access controls.• Lack of encryption systems.• Ineffective physical protection of communications

infrastructure.

Security systems and CCTV have excessive risk of failure

• Numerous single points of failure in network design.

Parking management systems can be disabled.

• Ineffective control of wireless data networks.

KPMG Demonstrated that.....

5© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Finding Caused by

Perimeter security can easily be compromised.

• Inadequate door design.• Doors not monitored or maintained.• Lack of CCTV surveillance on all entries.• Crawl spaces not secured.

Internal security (public Vs controlled space) is inadequate.

• Service corridors not secured• Lack of CCTV coverage• Failure to secure communications cabinets, electrical

services panels etc.

KPMG Demonstrated that.....

6© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Finding Caused by

Commercial systems can be compromised.

• Inadequate access controls.• Poor network design.• Lack of encryption.

KPMG Demonstrated that.....

Note that the deficiencies applied to all areas - the new development areas were not more secure than the original

structures.

7© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Gaining network access from an unsecured electrical services cabinet.

High voltage electrical distribution board unlocked.

Paparazzi...

8© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Connecting to the security network via an easily accessible cable termination point outside the centre complex at the edge of a car park Perimeter security!!

Paparazzi...

9© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Considerations for building managers and owners

Existing assets –Consider current risk profile

Acquisitions –Consider possible exposures and remediation costs

New developments –Ability to prescribe standards for IT infrastructure and systems

10© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

Considerations for tenants in large properties

What common property systems are you relying on to maintain the physical security of your premises?

Where are these systems and are they secure?

How is your network environment segmented from other tenants? And building management?

What assurances have you received from building management regarding the physical and logical security of these systems?

11© 2015 KPMG, an Australian partnership and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. The KPMG name, logo and "cutting through complexity" are registered trademarks or trademarks of KPMG International. Liability limited by a scheme approved under Professional Standards Legislation.

People can be the weakest link

Increase awareness –

Social engineering targets employees to bypass physical and system controls

Cyber Response –

Know who to bring together to manage response actions

Don’t forget paper based assets –

Handling and destruction of paper just as important as access to systems

Q&A