You need to accept as fact that eventually your facility will be the target of a cyber-physical attack. The only choice you have in this matter is how your building will be attacked by reducing the number of possible attack vectors. The best you can hope for is a situation where a cyber-physical attack is detected quickly, building equipment automatically shuts down gracefully (before any damage is done or anyone is injured), and building systems can be rapidly restored to normal operation.

This book does not focus on how hackers can get in to your BCS. I don’t explain how hackers can overcome firewalls or defeat sophisticated security software. I leave that to others to explain. I don’t spend a lot of time discussing how to tell if a cyber-physical attack is underway (when everything shuts down—especially unrelated building systems, you know something’s wrong). The objective of this book is to plan how best to respond to a cyber-physical attack so you can make decisions quickly and take proper action to mitigate the impact of the attack. When a cyber-physical attack occurs, the last thing you want to do is make things up as you go. This book advocates a dynamic attack surface —automated on-the-fly changes of a building control system’s (BCS) characteristics and defensive counter-cyber operations to thwart actions of an adversary.

You can spend millions of dollars beefing up the secure perimeter of a building against a physical attack, but that can all be defeated by a hacker causing equipment already inside the facility to destroy itself or even explode simply by executing a well-planned cyber-physical attack. Having an active and effective malware detection program in place to protect your facilities is great, but it would be meaningless without a well-designed plan that tells building maintenance personnel what to do when a cyber-physical attack is underway.

Of course, building engineers assume a cyber-physical attack can’t happen because of safety devices installed to prevent catastrophic events. It’s true that many building control systems have hard-wired safeties designed to shut down equipment and these hard-wired safeties typically are not controlled by the BCS. However, a hacker can use these safety devices as part of the attack—in fact, the hacker is counting on safety devices turning things off. Keep in mind that the Chernobyl nuclear plant also had safety devices that were turned off—by insiders. ² Sad to say, 40 percent of cyber-attacks are carried out by insiders. In addition, it is not uncommon for insiders to turn off safety features that tend to set off frequent false alarms. The first thing a hacker does after he installs a backdoor is disable safety devices. A second factor to consider is that multiple pieces of equipment will be attacked simultaneously in a well-planned cyber-physical attack. A hacker won’t just disable your boilers—he’ll disable everything that he can.

Facility engineers rely on equipment alarms to warn when equipment and processes approach dangerous situations and to (hopefully) allow equipment to power down gracefully. Generally, that is the case—unless of course if a hacker changed the configuration setpoints so the building controls “thinks” that a boiler’s 322°F water temperature and 1,500 psi pressure in a gas line designed for 400 psi are “normal” setpoints.

Of course, not every equipment failure or power outage is a cyber-physical attack. When your building is attacked, you probably won’t suspect it was a hacker—until you see a pattern. Lots of equipment will act “squirrelly” and you’ll know—it’s a cyber-physical attack !

When a cyber-physical attack occurs, it can mean years of court cases, job losses, higher insurance rates, and criminal litigation. Organizations with a high profile in the community have a responsibility to assess the vulnerability of their facilities to disruption by hackers. For example, it is not enough for a hospital to say that they took the normal standard of care in their industry—they will be called upon to show that they took every reasonable precaution. It also takes years to overcome the loss of safety credibility to employees and the local community.

Taking the right steps ahead of time, and equipping your facility and employees with the training, knowledge, and tools they need to prevent an attack and deal with one when it occurs may save lives. If you think I’m kidding, read about how a hacker can degrade or destroy your building equipment in the following chapters. If your building is connected to the Internet (directly or indirectly), a hacker may be able to install ransomware and take complete control of your building.

Take my advice and do the following:

• Completely disconnect your building controls system from the Internet immediately.

• Segregate the BCS from all other computer networks.

• Remove all modems and wireless cards from all computers, printers, and servers.

• Stop vendors from connecting remotely to your BCS. If they must connect to the BCS for maintenance, allow vendors to only use your laptops. These are laptops that stay in the building under lock and key and that are scanned for malware before and after they are used.

Have a professional perform a vulnerability assessment and report the results directly to top management. If you do these things, you will be able to sleep at night. Don’t be “that guy.”

I wrote this book because I searched unsuccessfully for cyber-physical attack recovery procedures specifically written for building controls or SCADA. I only found recovery plans when a hacker steals information or defaces websites. I did not find any that specifically address how to stop a cyber-physical attack intended to damage building equipment or how to react after a building has been attacked. This book should give you an idea how bad things can get, and how serious a problem a well-planned cyber-physical attack can be. Throughout this book, I use jargon taken from electrical and mechanical engineering fields as well as information technology and physical security environments. I include a definition of some terms that readers may not be familiar with in a text box or footnote. Otherwise, most definitions can be found in another book I wrote, the Cybersecurity Lexicon (Apress, 2016).

This book contains step-by-step instructions, checklists, and forms that you can use to develop your own Cyber-Physical Attack Recovery Procedures. Just as no two buildings are alike, no two Recovery Procedures are alike. Only a Recovery Procedures document that has been prepared by qualified engineers for your specific facility should be implemented. The appendix is merely a suggested template to be customized for your specific facility. A soft copy of the template is available for download (with fillable fields) on the Apress web page for this book ( www.apress.com/9781484220641 ).

This book is not a crisis management plan. It is not a COOP plan (Continuity of Operations Plan). It is not a business continuity plan, IT application response plan, or an IT infrastructure response plan. Those are designed to prepare for a cyber-attack on an enterprise IT system (database) or organize a response team prior to a natural disaster. Other folks have already written those.

This book assumes hackers have already gained entry to your building controls. I describe the damage hackers can do, and suggest how maintenance personnel should respond to avoid prolonging the attack, and how to recover from the attack. The Recovery Procedures document is a template for you to modify based on the specific equipment in your facility with instructions on how to restore building equipment to normal operation when systems begin to act erratically, or fail completely. When hackers shut off the building water, turn off the power, disable the sewage effluent pumps, and activate the fire alarm, you have to do something quick. You won’t have time to figure out the proper Sequence of Operations for your boilers and chillers. You need to quickly turn things off before a hacker can do any more damage. And, hackers can damage multiple systems in multiple buildings at the same time—from the other side of the planet. This book will help you create custom checklists for your equipment.

Normally, the response to a physical attack and the speed with which security staff reacts is a function of the type of attack. For example, a well-trained security force is able to respond to an active shooter in mere seconds. Unfortunately, a professional hacker can disable multiple pieces of critical building equipment in milliseconds, so monitoring the BCS for precursors of a cyber-physical attack, and an automated response based on intrusion detection is essential to prevent damage to expensive building equipment.

To make matters worse, unlike an active shooter who is no longer a threat once he has been dealt with, a hacker’s handiwork persists long after you’ve cut the cord, and a hacker can continue to damage your equipment even if he no longer is in direct communication with the building controls system. A “sneaky” hacker (as Jack Nicholson says, “Is there another kind?”) will install cyber booby-traps before making his presence known. Before maintenance personnel sound the all-clear, they will have to isolate each and every piece of equipment from the BCS and be prepared to operate all systems manually—just like the old days. Maintenance personnel will have to go to the equipment to read dials, turn valves and open dampers to bring the building back on line—safely.

Lastly, I want to mention the business case for putting Recovery Procedures in place for when a cyber-physical attack occurs. The cost to replace a 2 MW diesel backup generator is at least $2 million. An average chiller costs $200,000; a medium-size boiler probably $600,000. Normally, replacing any of these would take six months because these are long lead items. You may be able to repair some damaged equipment—provided you can get parts. Another thing to consider is that you will likely not be the only one attacked. Once the floodgates open and all-out cyber warfare begins, you will be ordering equipment at the same time as other victims of cyber-physical attacks.

Oh, one more thing that I forgot to mention. An adversary can cause physical damage to your facilities, but there is another aspect to their activities that needs attention. The fact is, hackers are monitoring your company activities using your building controls and other building-related systems that your IT and security staff are probably unaware even exist.