Hey folks, Phil Zito here and welcome back. In the past two posts, we've been diving very deep into how to secure your building automation system. In this post, we are going to kind of take what we've covered so far, and we're going to add a little bit of color to it. However, we're mainly going to focus in on BAS attack methods.

Hey folks, Phil Zito here and welcome back. In this post, we're going to continue discussing how to secure your building automation system and we are going to be looking at a couple different things. In the previous post, we went through fundamentals, cybersecurity, talked about a couple things related to cybersecurity risks, risk assessments, controls, etc. Now we're going to look at cybersecurity capabilities of a BAS, we are going to look at and discuss the limitations of cybersecurity controls, and we're going to look at the human aspects of cybersecurity.

Hey folks, Phil Zito here and welcome back. In this post, we are going to start a 3-part series on how to secure your building automation system. So, in this post, we are going to explore potential threats to building automation systems, how to assess risk, and common cybersecurity controls. This is mainly going to be a conceptual post and then the next two posts, we're going to get a little bit more hands-on, with the third post being very hands on. Be sure to read all 3 posts because if you skip this post, you won't understand most of the concepts. So, definitely don't skip this post.

Hey folks, Phil Zito here and welcome back. In today's post, we are going to be continuing our trend of looking at selling building automation systems. We are going to be talking about how to sell more services to avoid pipeline dips. This is something that everyone should be considering, but folks tend to struggle with doing.

Woke up to news early this week, IBM X-Force hacked a Building Automation System using a combination of common vulnerabilities. Based on the report IBM produced, here is what happened.

I recently received an e-mail question via the Contact Phil Section of my blog. I enjoy writing articles for my blog but I enjoy even more when I get interaction from my readers.

The question posed by my subscriber is pertinent to so many people that I felt it deserved to be posted in its entirety.

BAS Hacking 101: Scanning and Enumeration

In the BAS Hacking series I am diving deep into the bowels of building automation networks and systems! I am going to take you through the full process of exploiting a system so that you can better understand the thought process of your attackers. The series consists of 4 articles:

In the BAS Hacking series I am diving deep into the bowels of building automation networks and systems! I am going to take you through the full process of exploiting a system so that you can better understand the thought process of your attackers.

My article How to Hack a Building Automation System is one of my most read articles. However, one of the criticism's I received was that it didn't go into how to actually hack a BAS. Being that December is Data Security Month, I am going to walk you through the a BAS Hack on a system I have here in my house.

Wow! What an eventful week I have had. I read through the Cylance Google Hack article again and after fully digesting the information around the hack I had an epiphany.

Most facility owners are just a few clicks away from a multi-million dollar due care/due diligence lawsuit.

I will get into the how in a second but let's first describe what due care and due diligence means.