The smart

buildings
report 2017
The installed base, benefits
and challenges, cyber threat
and barriers to adoption
Introduction
IFSEC Global recently canvassed 860 professionals in order
to understand the changing ‘smart building’ landscape and
how the industry can best harness new technologies.
The concept of intelligent buildings is nothing new. A
book published in 1988 referred to an intelligent building
as one “which totally controls its own environment”. Thirty
years later and the definition remains much the same;
however, the delivery vehicle for that vision has evolved
beyond all expectation.
While intelligent standalone systems still represent
exceptional value for building owners, it is the integration of
these systems that is propelling buildings from the realm of
intelligent to the heights of ‘smart’.
Smart buildings are the direct result of the continuing
convergence between operational and information
technology. With the Internet of Things (IoT) is gaining more
traction by the day, great advances are being made in the
world of building control.
Not only can smart buildings ensure that occupants remain,
healthy, safe and productive, but they can now help to drive
bottom-line profits. Facilities should no longer be viewed as
overheads; but strategic assets that can help organisations
realise their objectives.
IFSEC recently surveyed 860 security professionals, facility
managers and building owners, in order to understand the
changing smart building landscape.
This report provides in-depth analysis of those responses,
looking at the perceived benefits, applications and
challenges of smart functionality within the building
control landscape.

Survey highlights
CONTENTS
•O f the 860 professionals surveyed, approximately half
(50%) said they classified their building systems as ‘smart’. Survey respondents................................. 3
•O
 ut of the 435 respondents who did not regard their
building systems as ‘smart’, 46% said that they expected What exactly is the difference between
smart functionality to be introduced within the next 12-24 ‘intelligent’ and ‘smart’?........................... 4
months.
•O
 f the 425 respondents who classified their building as It’s all about data and analytics................... 6
smart, 70% felt that there was room for improvement.
Installed based and perceived benefits....... 7

Challenges/barriers to adoption.............. 10

Cyber security....................................... 14

Conclusion........................................... 16

2 A trend report from IFSEC Global

Survey respondents
Which of the following best describes Which type of building(s) are
your job function? you responsible for?
Answer Options % Answer Options %
Security 18% Office 66%
Consultant 14% Industrial/
40%
Senior executive 12% warehouse
Installer/integrator 12% Residential 35%
IT 11%
Education 26%
Facilities management 10%

Health and safety/ Hotel 26%

8%
fire safety
Retailer 22%
Contractor 5%
Manufacturers/ Healthcare 22%
distributors/suppliers 4%
Leisure 21%
Other 3%
Transport 18%
Architect 1
House builder 1 Other 3

Which technological areas of the building are you involved with?

Answer Options %
Access control 68%

Video surveillance 58%

Fire safety systems 53%

intruder alarms 49%

Integrating systems 41%

Lighting 38%

Building automation 37%

IT/computing 35%

Audio-visual systems 34%

Power/energy/electrics 32%

Telecoms/telephony 29%

HVAC control 24%

Analysing data 21%

CO2/environmental monitoring 18%

Water management/efficiency 18%

Plumbing 17%

Kitchen appliances 15%

3 A trend report from IFSEC Global

What exactly is the difference between
‘intelligent’ and ‘smart’?
“While the ‘internet of things’ is a topic of much speculation Intelligent building control, as we have come to understand
in the consumer market, smart building technology has it, has been around since the 80s. Critical assets such as
steadily been increasing its footprint and impact among HVAC, security and lighting have each had varying degrees
commercial buildings. Smart building solutions are valuable of intelligence incorporated into them over the years, all
technologies for deploying energy management strategies under the BMS umbrella.
that generate operational efficiencies, cost containment
So what – exactly – is the difference between an intelligent
and sustainability benefits that appeal to key stakeholders
building and a smart building?
in building management.” Jill Feblowitz, president,
Feblowitz Energy Consulting “It seems that in English there is a semantic difference
between intelligent and smart,” explains Paul Hughes
Would you classify your building as ‘smart’? of Software AG. “The nuance, however, is often lost.
n Yes – to a
An intelligent building means a building has the
significant degree capability of performing actions on a user request,
while the meaning of a smart building is one that has
n Yes – to some 15% the ability to solve problems.”
extent 27%
The University of Sheffield published a paper that attempted
n Not yet – but to get to the bottom of the intelligent versus smart
I expect this to distinction. The authors characterised the difference thus:
change in the next 35%
12-24 months “Smart buildings are buildings which integrate and
23%
account for intelligence, enterprise, control, and materials
n No – and this isn’t and construction as an entire building system, with
likely to change adaptability, not reactivity, at the core, in order to meet
any time soon the drivers for building progression: energy and efficiency,
longevity, and comfort and satisfaction. The increased
In 1620, Dutch inventor Cornelius Drebbel created amount of information available from this wider range of
the first functioning thermostat capable of controlling sources will allow these systems to become adaptable,
building temperature using air flow. It could be argued and enable a smart building to prepare itself for context
that this was the start of what we now call building and change over all timescales.”
management systems (BMS).

4 A trend report from IFSEC Global

Connected things installed base within smart cities (in millions of units)

Smart City Subcategory 2015 2016 2017 2018

Healthcare 3.4 5.3  8.4 13.4
Public Services 78.6 103.6 133.1 167.4
Smart Commercial Buildings 377.3 518.1 733.7 1,064.8
Smart Homes 174.3 339.1 621.8 1,073.7
Transport 276.9 347.5 429.2 517.4
Utilities 260.6 314.0 380.6 463.5
Others 8.6 13.3 20.8 32.3
Total 1,179.7 1,641.0 2,327.7 3,332.5

Source: Gartner (December 2015) 

This rather wordy definition of ‘smart’ can be distilled into

five fundamental components. Smart buildings are:
• P roactive, not reactive
• Integrated
•E  fficient
•G  reen
•A  daptive
The evolution from intelligent to smart buildings has been
driven primarily by growing demand for tighter integration.
The building control industry, like most other high-tech
sectors, was born in a closed source world. Systems
were built on proprietary hardware and software stacks,
leading to a highly fractured, disparate ecosystem of quasi-
intelligent systems.
The demand for greater interoperability prompted the
industry to move away from proprietary systems to a much
more open architecture, with protocols such as BACnet and
LonTalk leading the way. •G
 eneral Electric estimates that the industrial internet market
will add between £8tn-£12tn to global GDP within the next
Global smart buildings market: insights 20 years. For context, China’s total GDP is just over £7tn
• “ Building managers report 30% savings in repair •B
 uildings are the largest consumer of global energy
costs when networked buildings enable proactive production, ahead of industry and transport. Also
maintenance” (Jim Young, CEO, Realcomm) contribute one third of total global greenhouse gas
•G
 lobal spending on smart building technology was emissions, primarily through use of fossil fuels during
forecast to grow from $7bn in 2015 to $17.4bn by 2019 operational phase (International Energy Agency)
(IDC Insights: ‘Business Strategy: Global Smart Building
Technology Spending 2015–2019 Forecast’)
•C
 isco estimates that the number of connected
devices worldwide will rise from 15 billion today to
50 billion by 2020. Intel believes this figure will be
closer to 200 billion devices

5 A trend report from IFSEC Global

It’s all about data and analytics
When people, or organisations, make their first foray
into the world of smart technologies, it is all too easy for
them to become preoccupied by the inherent benefits
of any given asset. Consider the immediate and tangible
benefits of a lighting system capable of integrating with
access control: only consuming energy when employees
occupy a specific zone.
But this ‘intelligent’ behaviour does not necessarily equate
to ‘smart’ behaviour. Because the internet of things is not
actually really about things; it’s about data, and the insight
extracted from that data.
IP-enabled building infrastructure increasingly allows us
to collect operational data that was simply not imaginable
even just a few years ago. The challenge now is to figure out
what to do with it.
A smart building’s value therefore depends entirely on its
analytics capabilities.

Do you analyse the data your smart systems are

capturing?
n Yes, we have
a structured 5%
6%
approach to this
n Yes, but it’s not 34%
structured 18%

n No, but we’d like

to
n No, we have no
plans to use data in
this way 37%
Offered the chance to elaborate on how they analyse
n Don’t know captured data, respondents to our survey offered these
responses, among others:
IFSEC Global asked respondents if they analysed the
data generated by their smart systems. Only 34% of • “ We send the data to a cloud-based system and analyse
respondents claimed to have a structured approach to the data there”
data analytics. A further 37% said that they queried data on • “ Assessed the need for battery storage and evaluated
more of an ad hoc basis, while 29% admitted to having no need for exact PV generation requirements” using
analytics capabilities in place or were unaware of having captured data
such capabilities.
• “ Review and analysis of security incidents for corrective/
“It’s about taking existing data and combining it with new preventative action”
data to gain insight,” says Stuart Higgins, head of digital
impact for Cisco UK and Ireland, in explaining the process • “ Piecemeal analysis of energy usage data, efficiencies
of analysing the data generated by smart systems. analysis and improvement opportunities”

The benefits are profound, he believes. “Traditional systems • “ If everything is pre-planned then we just need a smart
were very reactive, but ‘smart’ is about being able to move software programmer and an engineer to have full
away from reactive towards proactive. control on system”

“Take that data a step further and you are able to be

predictive. Based on what happened in the last three
months of last year, we can predict what’s going to happen
in the last three months of this year.”

6 A trend report from IFSEC Global

Installed base and perceived benefits
“There has been a mismatch between what users expect Even more than half of fire alarms (53%) were deemed
from an intelligent building and what the suppliers are able smart, which is noteworthy for an industry where stringent
to deliver. One of the main reasons for the disparity is that requirements for regulatory compliance mean that
the intelligent building has generally been defined in terms technological change often lags that of other industries.
of its technologies, rather than in terms of the goals of the
Nevertheless, a UK-based fire-safety professional laments
organisations which occupy it.”
that the “the benefits of ‘smart’ technologies are not being
Professor Derek Clements-Croome, school of
fully realised in terms of building safety, at least in part due
construction management and engineering,
to the fact that technical regulatory requirements for fire
University of Reading
protection and life safety systems exceed those for other
Our survey also quizzed respondents on which systems – eg BMS and data network cables and other
specific components of their buildings they defined as components are not required to be as resilient, for example
‘smart’. It is worth noting that the top four of the most in terms of resistance to fire.”
common smart technologies were all security and
The smart building concept is fast becoming a widespread
safety-related, suggesting these fields are well ahead
reality on other BMS areas too, with at least one in five
of the curve in terms of collecting data and turning that
having smart lighting (47%), energy management (47%),
data into something meaningful.
HVAC (37%), A/V (35%), building performance (34%),
Security and safety systems remain two of the most telecoms (31%), CO2/environmental monitoring (23%) and
fundamental resources in building design and the water management/efficiency systems (21%).
technologies supporting them are well-established
and mature. They were the first assets to gain
intelligent functionality, so it makes sense that they are “Immense benefits could be realised
already widely deployed. in terms of building safety, in particular
Garnering 73% and 67% of responses respectively fire protection, but these are not being
access control and CCTV systems were smart in more
than two thirds of buildings and well out in front. realised due to a disproportionate focus
Nearly one in two intruder alarms (48%) were also on security and energy management.”
considered smart, suggesting that the epochal shift to
not just IP but data-driven systems has now affected a Fire-safety professional
clear majority of businesses.

Which of your building functions would you describe as having ‘smart’ functionality?
Answer Options %
CCTV 67%

Fire safety systems 53%

Intruder alarm 48%
Lighting 47%
Energy management 47%
HVAC control 37%
Audio/visual systems 35%
Building performance 34%
Telecoms/telephony 31%
Intercom 27%
CO2/environmental monitoring 23%
Water management/efficiency 21%
Energy storage 15%
Plumbing/taps in kitchens and bathrooms 11%
Kitchen appliances 9%

7 A trend report from IFSEC Global

Survey respondents offered more specific examples of
building components that were smart, including automatic “So many systems have capability on
shutter control, car parking and backup generators. paper but generally require significant
What has been/do you expect to be the biggest tailoring and development, which
benefit of installing smart technologies in your never then meets original expectation –
building?
which is set too high.”
n Improving security
n Cutting energy Project manager
5%
usage/costs
11%
n Creating a more 23%

comfortable • “ Improve fire and smoke safety for all building users”
environment for staff
and/or customers 18% • “ Quicker reaction to failures”
n Cutting costs • “ Overall efficiency […] measuring building performance,
generally 23%
operation and degradation over time, [better] ROI, cost of
n Helping staff do their 21% operation and depreciation […] The opportunity to evolve
jobs more efficiently
with improvements in technology is a very important
n Reducing cost of consideration”
changing occupancy and
configuration (churn) • “ Saving lives of building occupants due to ill-health or
self-harm.” CTO for medical device company
Asked what they considered to be the single most
important benefit of installing smart technologies – • “ We would really like to help our customers – students,
whether from experience or expectation – ‘improving staff, visitors – to self-serve to a certain degree [through]
security’ and ‘cutting energy usage/costs’ were tied at access to services through an app. They could choose to
the top of the rankings with 23% apiece. ‘Creating a more use it or not.” IT professional in education sector
comfortable environment for staff and/or customers’ and • “ In large, complex buildings it is useful to have various
‘cutting costs generally’ also polled well, garnering 21% intelligent systems to assist with monitoring fire alarm
and 18% respectively. cause and effects – ie where electrically locked doors,
‘Helping staff do their jobs more efficiently’ and ‘reducing ventilation shuts down, floors are signalled to go to
cost of changing occupancy and configuration (churn)’ ground for certain fire alarm zone activations”
were comparatively seen as much less significant benefits. Not everyone was convinced about smart-building tech,
however: “We are yet to be convinced of payback,” said
The ‘Honeywell smart building score’ one company director.
Honeywell recently designed a universal framework for the
How pleased are you with how your smart
purposes of evaluating the ‘smartness’ of buildings. The
technologies have performed?
‘Honeywell smart building score’ allows for a quick, easy
and comprehensive assessment of any building.
n Very pleased 1%

Applied to close to 500 buildings for validation purposes 8%

the framework revealed a fascinating finding: building n Quite pleased 22%

managers in all verticals tended to give their buildings

n Quite
higher scores than the assessments revealed. Honeywell
disappointed
said the findings suggested a need for greater education
about the full capabilities and applications of smart n Very
buildings. disappointed
Maybe this helps explain why an overwhelming proportion 69%
of those polled – 91% – were pleased with how their smart
technologies have performed. Unaware perhaps of how
much smarter they could actually be, more than one in five
declared themselves to be ‘very pleased’ indeed. Respondents were given the chance to explain why they
were, overall, pleased or disappointed with the impact of
Our survey respondents were offered the chance to suggest smart tech on their building and its occupants.
other benefits they have realised – or expect to realise – and
these were among the more interesting answers:

8 A trend report from IFSEC Global

Comments from those who were pleased – albeit some had
caveats – included:
“In the future we expect to have nearly
• “ It enables easy identification of any part of the building
all devices connected and accessible
infrastructure” via smartphones.”
• “ It takes a long to implement this technology properly in a Health and safety/fire safety professional
single building, but once this is done it can have fantastic
benefits to energy performance”
• “ I’ve had a few problems with one of my apps but overall • “ Network failure always a potential challenge”
I’m happy” • “ Solution suppliers are slow to open up but instead try to
• “ Our Axis IP camera could be monitored clearly, remotely, cling on to black-box solutions”
alongside our IP intercom” • “ In some ways, we are very pleased with the immediate
Gripes about smart tech on the other hand: results; it’s just that the cost of installation, longevity of
units and length of time changeover took beyond the
• “ Difficulty of integration” expected schedule all but doubled, affecting ROI”

9 A trend report from IFSEC Global

Challenges/barriers to adoption
Case study after case study has shown the positive impact While building control is rooted in the world of proprietary
of smart technologies. From energy efficiency and comfort hardware and software, the industry began shifting towards
levels to safety and maintenance costs, the benefits far an open environment in the mid-90s. A consortium of
outweigh the challenges – as long as the systems are building management players and manufacturers joined
procured, integrated and deployed wisely. forces, ultimately creating the building automation and
control networks (BACnet) protocol.
And yet there remains a great deal of resistance, among
many building owners and managers as well as staff of all Along with LonWorks (local operating network) BACnet
pay grades. Indeed, asked what they viewed as the biggest currently dominates the intelligent building market. But
challenge of all, 10% opted for ‘cultural resistance to new tech these open automation communications protocols are
among staff’. now being threatened by the most open protocol of
“As a security manager I am all for integration and use of them all: the internet.
‘smart’ technologies,” said one respondent, “but there is The gravitational pull of this colossal network of networks is
still some resistance to it from the old school, both from having a profound impact on the building control landscape
the client and some of my own staff, who may feel a little and the internet of things has proved a great disrupter. A
intimidated by it or see it as their replacement rather than a deluge of IP-based solutions is breaking down proprietary
tool to assist them.” barriers. The shift towards IP-centric infrastructure neutralises
However, several other issues were flagged in greater many of the integration challenges faced by traditional
numbers. building control systems.
However, interoperability and integration between new
Interoperability and existing building infrastructures remains a challenge.
“In some sense, the goals for perfect interoperability,
cybersecurity and privacy may always be just out of reach
as new applications, features and threats emerge. However,
“There does appear to be a level of
aligning a shared vision to a collective set of directions may cultural resistance/reluctance to invest
allow buildings automation ecosystems to form and flourish.”
US Department of Energy
in new ‘smart’ technology.”
It is perhaps of little surprise that interoperability was named
Service provider and end user of smart
the number one challenge. Nearly 30% of respondents said technology
this was their top concern.

What has been the biggest challenge/problem of running a smart building so far?

Integration/interoperability 30%
of different systems

Cost of installation and 22%

maintenance

Learning how to operate

11%
new systems or training staff

Cultural resistance to new

10%
tech among staff

Recurrent maintenance issues /

systems often breaking down 9%

Technology has not realised the

benefits promised by the vendor 6%

Friction between teams over who

should have responsibility for new tech 6%

Other 6%

10 A trend report from IFSEC Global

“Interoperability remains a big concern, because like any
new technology area, it’s a lot like the Wild West at the “Unfortunately, consultants very often
moment,” says Stuart Higgins, head of digital impact for never get to install or commission
Cisco UK and Ireland. “There are no recognised standards.
It’s a bit like the VHS-Betamax war; it’s not necessarily the systems. So their knowledge gets more
best standards that are going to win – it will be the ones that theoretical and often prevents much
are easiest to implement and that most people understand.”
better solutions being implemented at
To bridge these gaps, middleware is playing an
increasingly important role, shifting data from traditional a lower cost.”
sources to a common platform. IT consultant

Cost of installation and maintenance

“New smart building collaboration processes require functionality installed. Reported energy savings were as
consultants, architects and construction companies to step high as 35%, with average savings of 17% for individual
outside of their comfort zone. In the future, this will become buildings. While the lifecycle costs of these subsystems are
common practice as both clients and tenants demand relatively easy to quantity, the ROI on smart technologies
greater energy conservation and increased amenities extends well beyond the obvious benefits.
within their building.” Ron Gordon, Cisco Canada As previously mentioned, integration sits at the heart
Nearly 22% of respondents cited installation and of the smart revolution. The deep integration between
maintenance costs as the biggest barrier to successful building assets can lead to synergies whose benefits are not
deployment of smart building technology. immediately apparent – for example how data from motion
sensors or access control can regulate HVAC. Such synergy
It can be difficult to evaluate the lifecycle costs and ROI savings can only be quantified post-installation and over a
on smart technologies given the breadth of purpose period of time.
and capability. For a typical commercial building, HVAC
accounts for roughly 40% of energy costs and lighting Even harder to quantify are the plethora of soft benefits,
another 20-30%. Bringing just these two assets into the such as higher occupancy rates, improved health and
smart fold, capital investment should almost always see increased productivity.
a return on investment, albeit over an extended period It’s also worth considering the plummeting cost of ‘things’.
of time. Studies have demonstrated that smart building The average selling price of sensors is forecast to fall by 5%
technology investments typically pay for themselves every year for the next five years, according to the latest IC
within 1-2 years, primarily through energy and other Insights report.
operational efficiencies.
“The trend is driven by intense competition as well as basic
The Lawrence Berkeley National Laboratory recently commodification of different sensor types,” explains Adam
conducted a study of energy management (or energy Lesser of tech research brand Gigaom. “IP appears difficult
information) systems, examining 28 buildings with smart to lock up in the market. Throw in the reality that many IoT
applications require rock-bottom pricing and that puts
pressure on sensor manufacturers not just to lower prices,
but also to undercut competitors in the hope of locking up
the market for themselves.”
The ubiquity of IP also means that proprietors can afford to
update a building system by system based on assets most
likely to show a return on investment.
Capital spend is certainly significant. However, it should
no longer be viewed as a barrier to entry. Cisco claims
that it has played a key role in creating smart buildings
that cost less than their traditional counterparts. The
vendor has been working with property owners,
developers, construction companies and architects to
develop smart building practices without incremental
cost at the construction phase, generating significant
cost savings early on.
“This is analogous to providing the benefits of six-
lane super highway for the same cost as a gravel road,”
says Ron Gordon, Cisco Canada’s senior advisor for

11 A trend report from IFSEC Global

smart+connected real estate. “The key to achieving
these cost savings is being able to influence the design at “We have yet to see any [smart]
the early architecture stage and the collaboration among technology worth the hassle.”
the providers of the HVAC, lighting, security and access
solutions working together in a win-win situation.” UK-based company director

Learning how to operate new systems tasked with managing complex systems comprising
and training staff mechanical, pneumatic and electromechanical systems,
More than a fifth of survey respondents said that either often controlled from bespoke workstations.
learning how to operate new systems (11%) or cultural
resistance to new tech (10%) posed the greatest challenges Similarly, IT professionals are not necessarily well
to smart installations. versed in the world of building control systems,
with serial communication over application-specific
Cultural resistance will always be a factor when introducing protocols and hardware.
sweeping changes. The key, of course, is good change
management. The silver lining to smart technology is that it Rather than transferring ownership of building control
is – or at least should be – autonomous in nature and so, in to one specific area of the business, the key is tighter
most cases, will not prove to be a hard sell. amalgamation between departments.

At first glance, it’s unsurprising that staff should be culturally Several respondents reported difficulties in convincing
resistant and have misgivings over training demands when budget holders and senior decision-makers to sanction
it comes to smart tech. Yet case studies actually suggest that investment in smart technology, with one noting: “As always
smart technologies often ease friction rather than create it. it is difficult to find money to spend on ‘virtual’ stuff!” Said
As integration becomes tighter between multiple systems, another: “Management is a little slow on the uptake, but we
the learning curve becomes decidedly less steep, as users are working on it.”
only need to operate a single platform. This has a knock-on Although one respondent said they “see IoT happening
effect, promoting efficiency and cutting training costs. faster in healthcare and transportation,” budgetary
The smart revolution is also having an interesting impact constraints will apparently limit investment in the former, at
on the roles of both facility managers and IT professionals. least in the UK public sector. “I am trying to convert a 1970s
As building management systems and their subsystems building to be a bit more FM user friendly but with NHS and
continue to drift towards the IP realm, the responsibilities departmental budget restrictions I am struggling,” wrote a
of facility managers are converging with those of the IT facilities manager in the healthcare sector.
department. Traditionally, facility managers have been

12 A trend report from IFSEC Global

Other challenges mentioned included:
• “ The cost of cabling” “I see IoT happening faster in
• “ Delays by traditional building vendors” healthcare and transportation.”
• [ Getting] “the client/owner/operator to understand the Senior executive at IoT service provider
advantages to their organisation”
• “ Providing sufficient justification for investment and
instigating change” It’s interesting to note that the IT department is only ranked
• “ The client pays the utility bills; no incentive to read and fourth out of seven in terms of influence over technologies
analyse data” that connect to computer networks.
• “ There is a will in pockets of the area – however, it takes a
Here are the aggregated rankings (most influential at the
long time to get things moving!”
top; least influential at the bottom):
• “ Instability in internet access”
•S  ecurity
• F acilities management
Procurement and deployment
•H  ealth & safety/Fire safety
Asked to rank various departments by influence when
it comes to are buying, integrating and deploying • IT
smart technologies, respondents ranked the security • F inance
team as having most influence and outside consultants •S  enior executives
as having the least. •C  onsultants

13 A trend report from IFSEC Global

Cyber security
“Facilities managers should work with IT personnel to
manage the high-tech aspects of BAS and the cyber security “The theft of millions of customers’
concerns that threaten them and, by extension, the rest
credit card data from US retailer Target
of the organisation. The correct approach is to use a
combination of both professions to safeguard the BAS.” was traced back to the heating and
Continental Automation Buildings Association
ventilation system.”
How concerned are you about cyber security
vulnerabilities created by smart, network- IBM’s penetration test illustrates the enormous potential for
connected tech? disaster in this new world of smart things. However, X-Force
was only able to access the BAS due to a series of security
n Very concerned lapses. It is a mistake to assume that the buck always stops
with the vendor.
13%
n Fairly concerned “The vendors have a responsibility to ensure that their
solutions meet the expectations of the customer,” says
n Not concerned 43% Stuart Higgins, head of digital impact for Cisco UK and
at all Ireland. “That they are up to date in terms of the vulnerability
44%
landscape and that they are patching both their hardware
and software on a regular basis. But, equally, the customer
can’t wash their hands of responsibility. It’s no one individual
or organisation’s responsibility; it’s a collective duty.”
In 2014, security consultant Jesus Molina told US
cybersecurity conference Black Hat he had commandeered
As building control increasingly moves into the IT sphere, control of the lighting, HVAC and entertainment systems of
the importance of cyber security is growing in tandem. 200 rooms at a hotel in Chinese city Shenzhen. A year before
Gartner recently predicted that, by 2020, more than 25% that, the US Department of Homeland Security revealed
of all identified attacks in enterprises will come from the hackers had broken into a “state government facility” and
internet of things. made it “unusually warm”. Google’s Sydney office was
Worldwide spending on smart security will reach $348m in hacked through its building management system in the same
2016, a 23.7% increase from 2015 spending of $281.5m. By year. Two cyber security experts discovered the vulnerabilities
2018, this figure will be closer to $547m. via IoT search engine Shodan.
Speaking to the BBC, one of these ‘benign’ hackers,
The security implications of putting buildings ‘online’ should
Billy Rios, claimed there are 50,000 buildings currently
not be shied away from. Physical infrastructure is inherently
connected to the internet, 2,000 of which lack any kind of
more vulnerable once connected to the digital world.
password protection.
Understandable then that most of our survey respondents
Conducted by more malevolent actors the consequences of
– 87% – were at least somewhat concerned about the
such breaches could be significant, with disruption to office
cyber-security vulnerabilities posed by smart tech, with
buildings that costs thousands of pounds in lost productivity
43% professing to being ‘very concerned’. Nevertheless,
sitting at the less serious end of the scale. If the heating
that even 13% insist they are ‘not concerned at all’ might
system in a hospital or care home was disabled, for example,
alarm some observers given widespread reports about the
the upshot could even be loss of life.
vulnerabilities of internet-connected ‘things’.
Hacks of building systems have already caused profound
disruption. In 2013, the theft of millions of customers’
Vulnerabilities laid bare credit card data from US retailer Target was traced back
IBM’s ethical hacking team, X-Force, recently conducted to the heating and ventilation system. More alarming
a penetration test of a remote building automation still, a Ukrainian power station was disabled immediately
system that controlled sensors and thermostats in several before Christmas in 2015 by a spear-phishing attack –
commercial offices. X-Force found a way into one of the where an employee is duped into downloading malware,
building’s networks via a vulnerable router. Poor password usually via email – leaving around 80,000 Ukrainian
management meant the team easily accessed the local BAS citizens without power.
controller and eventually wrested complete control of the
central BAS server. Martyn Thomas, a professor of IT at Gresham College told the
BBC “that attempts to attack building management systems

14 A trend report from IFSEC Global

are happening all the time […] These BMS systems have be integrated” into smart networks “anytime soon, outside
hundreds of thousands of lines of code, and yet the average influences potentially being able to make changes via
programmer makes 20 mistakes in every 1,000 lines of code, networked tech, even if it only means switching the lights
so there are lot of bugs there.” off, can be a costly nuisance.”
Respondents who commented further were polarised
over the magnitude of the hacking threat to building X-Force tips for a secure, smart building:
management systems. Those who were more relaxed •E nsure that all your device software is up to date as
about the risk seemed to have one of two main reasons. new security issues are found every day
The first, expressed by an office-based facilities manager, •E
 mploy IP address restrictions or firewall rules to
was that their system “had no physical connection to the prevent connections to vulnerable ports
outside world.” Similarly, a senior executive in the industrial/
warehouse sector said “no life-critical applications will go •E
 mploy a whitelisting approach when designing a
on publicly connected networks.” BAS network infrastructure, but be aware that firewall
rules on their own are not always enough to prevent
But even if hackers could access a BMS network, it attacks. Additional controls should be used when
doesn’t follow that they would have a compelling motive needed
for doing so, suggested one integrator: “I work solely in
the residential market. My view is that if anyone has the • If there is no business justification for remote access,
capability to hack my home then they would be more disable remote administration features on building
inclined to hack a company for political reasons, or a bank automation system devices. If remote access is
for money. Security is important, but if I worry about this I’d required for business reasons, strengthen controls
never install any smart equipment. I rely on the hardware around logins
purchased for this purpose.” •N
 ever reuse or share passwords between devices,
But can you rely on the hardware? Not so, said one security and avoid making these passwords predictable. Also,
consultant who believes that ‘security by design’ has only never store passwords in clear text
“been addressed in a limited way as only a few leaders •E
 mploy secure engineering and coding practices for
recognise the issue and manufacturers do not ensure the authentication control, execution of shell commands
products are secure, despite the PR.” and password encryption
A company director cited cyber risk as “one of our main •S
 ecurity incident and event management systems
reasons for inaction” when it comes to installing smart (SIEMs) can be used to scan network activity between
technologies. the router, the BAS system and embedded devices to
A health and safety professional offered a balanced view of identify suspicious activity on the network
the risk, saying that “while no critical systems are likely to

An atrium in Google’s Dublin office; the search giant’s Sydney office was hacked in 2013

15 A trend report from IFSEC Global

Conclusion
“Solving issues related to data privacy, security and returns purely from a business perspective. The absence of
interoperability of devices with wireless protocols is the key industry-wide standards, meanwhile, is unlikely to change
to surpassing the smart building industry’s IoT expectations.” any time soon.
Frost & Sullivan
On top of all this, there remains a clear need to educate
A few short years ago, the internet of things was little more end users about the benefits and limitations of smart
than a talking point – something halfway between a thought technologies. Expectation levels among facilities
experiment and a prophecy. managers are often higher than what can be practically
But IoT is now very real and its potential impact profound. achieved with available technologies. This often
Globally, smart building technology could reduce emissions undermines trust in vendors and supresses demand for
by 1.68 GtCO2e [gigatonnes of equivalent carbon dioxide], building automation systems.
create £201bn of energy savings and slash carbon costs by
However, with the right equipment, infrastructure and
£31.1bn by 2020.
solutions, building owners and facility managers can
The convergence of open communications protocols for enjoy future-proofed building control systems that yield
building control assets and IT infrastructure is providing discernible benefits in the short, medium and long term.
building owners, facility managers and building occupants
with countless options at startlingly low prices. The Smart Zone at IFSEC International 2017
However, there are still many hurdles to overcome. The IFSEC International will feature leading providers
buildings sector is slow to adopt new technology: a 15-year of smart building technologies and presentations
cycle for commercial buildings is not uncommon. There on buying, integrating and operating smart
is a clear lack of incentives for developers and owners technologies between 20-22 June 2017 at ExCeL
to invest in smart-building technology. With significant London.
capital expenditure, it can be difficult to justify the long
You can learn about the latest trends and innovations
in smart buildings and home automation in the Smart
The convergence of open Theatre or check out cutting-edge products and
communications protocols for building solutions from exhibitors including: Honeywell ACS,
ASSA Abloy, Paxton Access, TDSi, Sony Europe and
control assets with IT infrastructure Axis Communications.
is providing countless options at
Click here to find out more and you can get your
startlingly low prices free badge to attend IFSEC 2017 here.

16 A trend report from IFSEC Global

 ifsec.co.uk

Join the critical global

security conversation.
IFSEC International is the only place that brings together stakeholders from
every role within security, giving them the platform to witness and showcase
innovation and ignite collaboration to tackle the world’s most significant
challenge.

IFSEC will be returning to ExCel London from the 19-21 June 2018, welcoming
over 27,000 visitors and 570 exhibitors. This year, IFSEC’s 40-year heritage as a
physical security show will mature to a high-level, integrated security summit to
foster the necessary strategies to achieve global safety.

Get hands on with the integrated security solutions of the future, with more than
10,000 solutions on show from suppliers spanning security’s global technology
leaders to pioneering tech innovators.

Avoid missing out!

REGISTER TODAY