Setting safe foundations for IP linked building control systems

Setting safe foundations for IP linked
building control systems
Chris Topham

Abtec Group. Barents House, Compass Point, Market Harborough, Leicestershire LE16 9HW
Tel: 01858 438500 www.abtecnet.com
IT specialist that understands your market
• Established 1991
• Network, IT and communications specialists
• Cisco partner with our own accredited
engineers
• Independent ISP
• Clients include:

Building controls industry is changing
Definition: IP (Internet Protocol)
Primary transport mechanism used in networking, including the Internet
Discretenetworks
Modbus
BACnet
LonTalk
KNX
DALI
C-Bus
We are moving
away from
individual building
controls deployed
on discrete
networks…
IP (Internet Protocol) Network
Modbus
BACnet
LonTalk
KNX
DALI
C-Bus
To one where an IP
network is used as
the transit backbone,
with each building
control network
connecting to IP

Reasons for this change
Why
IP?
Common
network
protocol
Lower
costs
Manufact
urers
• New devices
support IP
• Multi-protocol
devices
• Fewer networks
• Less hardware
• Less resource to
manage
• 70% of users want
disparate systems
on a common
platform*
*Survey: March 2014

The challenges
Benefits
• Easier to deploy
• One backbone to connect to
• Improves resilience
• Easier to manage over it’s
lifetime
• Improved fault identification
• New services
• Remote monitoring
• New alarms
• Easier to combine disparate
control applications into a
single head end
Issues
• Existing standards
• Steep learning curve
• The domain of the IT team
• Speaking different languages
• Poor quality networking
choices
• Causing deployment delays
• Creating network issues
• Security
• Damage reputation

Some recent headlines….
• Cybercrime costs UK businesses £21bn1
• In 2012 8% of business premises
experienced some kind of cyberattack2
• By 2020 there will be 75bl devices linked
to the internet3
1. http://www.bbc.co.uk/news/uk-politics-12492309
2. Cyber crime: A review of the evidence Research Report 75, Home Office October 2013
3. www.businessinsider.com/75-billion-devices-will-be-connected-to-the-internet-by-2020-2013-10

Aims of this session
• Specify the right networks for
your building services projects
• Appreciate the benefits of
secure, resilient infrastructure
• Provide secure remote access to
building controls systems

The building blocks of network design
Network
management
Resilience and
redundancy
Remote access
Security
Easeofmanagement

Switches at the heart of the network
Lighting HVAC
Access
control
Switch
CCTV
PC
Switch Switch Switch
Blind
actuators

What is a network switch?
Switch
• Switches manage the transit
of data across a network
• Two different types
• Managed
• Unmanaged
Managed Switch
• Managed simply means that
the switch (and network) can
be configured.

Unmanaged ManagedFeature
Deliver network traffic 
Configure network 
Network monitoring 
Traffic re-routing 
Network
segmentation 

Where is the network problem?
Lighting HVAC
Access
control
Switch
CCTV
PC
Switch Switch Switch
Blind
actuators

Managed vs. Unmanaged
• Avoid the hidden costs of using
unmanaged switches
• Identifying faults – underlying
faults in the network no
visibility
• Broadcast storms
• Repeat visits

Access
control
network
HVAC
control
network
Lighting
control
network
Security
network
Traditional deployment

Security
network
Lighting
control
network
Access
control
network
HVAC
control
network
Traditional deployment
Multiple Networks
• More resources to install and manage
• Higher costs
• Underutilised hardware
• Increase in single points of failure

Access
control
network
Security
network
HVAC
control
network
Lighting
control
network
Deployment over IP network

A managed Ethernet switch can consolidate separate building
control networks into one.

Deployment over IP network
Security
network
Lighting
control
network
Access
control
network
HVAC
control
network
Converged
IP network
Converged Network
• Less hardware required
• Faster to deploy
• Easier to add, move or change
individual elements of network

Single IP network could increase risks
We mitigate this risk
by building
redundancy into the
network design

Redundant paths, a resilient network

Eliminating more risk from projects
Security Team
FM Team
Accounts Team

Single PC – not fit for purpose
Not built for 24/7 use
Multiple points of failure
Shared login – usually
administration account

Best practise: User accountability
• Individual login accounts encourage
responsibility
• Electronic footprint
• Tracking changes to an individual
• Regular password changes
• With a shared login no accountability
• Access to sensitive files
• Disgruntled employees making
changes to systems, or worse
• Virus/malware risk

Servers – a better solution
Resilience built in
Multiple power
supplies, fans and
disks
More secure
Permissions based accounts
Only access what is necessary
‘Lock down’ PC features
Better backup of data
Historical energy use
Controls system set up
Control application
Multiple PCs created from
a single server

Virtualisation improving resilience and
continuity
Virtualisation
• A Virtual Machine (VM)
replaces the PC
• If one server fails the
controls application and
data will still operate
• Applications and data
are stored centrally so
its easier to back up

Reducing your costs with remote access
Remote Access
• Reduce travel costs
• Number of site visits
• Faster diagnosis and
resolution of issues
• Additional levels of after
service care

Remote access best practise
Internet
Mitigating Cybersecurity Threats
• Host the BMS systems on a server rather
than standalone PCs
• Only allow log on from your headquarters
• Use Secure Socket Layers (SSL) or
create VPN between sites
Client
Your HQ

Avoid the Internet, use a private network
Private
Network
Mitigating Cybersecurity Threats
• Much more secure to avoid the Internet
• Private networks are similar to internet,
but more secure
Client
Your HQ

Simple connectivity
• Plugs in at client site
• Preconfigured VPN to match
client’s IT security protocols
• Uses 3G or 4G private
network avoiding the internet
• Ideal for monitoring defects
liability period
• Can be moved from project
to project

Summary
• Delivering projects over IP is growing
• Utilising the right type of IP network
can help your pojects
• If in doubt contact an IT specialist
that understands your market

Setting safe foundations for internet-linked
building control systems
Chris Topham

Setting safe foundations for IP linked building control systems

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Setting safe foundations for IP linked building control systems

Similar to Setting safe foundations for IP linked building control systems (20)

More from CIBSE_Yorkshire

More from CIBSE_Yorkshire (20)

Recently uploaded

Recently uploaded (20)

Setting safe foundations for IP linked building control systems