Objective

This project demonstrates how Managed Building Automation and Control Network (BACnet) can provide modern, interoperable and zero-trust security to new and existing Facility-Related Control Systems (FRCS). The Department of Defense (DoD) has ambitious goals to make its facilities more energy resilient. Resilience depends on secure control systems, yet DoD’s outdated infrastructure lacks basic security features, putting networks and assets at risk. Managing these risks is expensive, time consuming, and at times, counterproductive. Addressing the risks is preferred, yet until now, there have been few options for doing so.

To show the viability of Managed BACnet, this project will upgrade multiple representative DoD FRCS architectures in a hardware-based controls laboratory. This demonstration will validate its interoperability across common protocols, vendors, and vintages. It will show clear and cost-effective upgrade paths for securing existing controls hardware. And it will show how the management tools can automate routine cybersecurity tasks and facilitate cumbersome Authorization to Operate (ATO) efforts. Using penetration testing, this project will assess the security features and compare vulnerabilities against conventional FRCS approaches. Ultimately, these efforts will prepare Managed BACnet for field testing and adoption in operational settings.

Technology Description

Compared with modern Information Technology (IT) standards, the security capabilities of FRCS are archaic. In a major leap forward, Managed BACnet adds defense-in-depth cybersecurity to new and existing FRCS. It borrows proven layers of modern IT security, including zero-trust, device-level certificates, encrypted data transfer, firewall routing, backup and restore, audit logging, and high-level management and monitoring capabilities. Managed BACnet provides the tools to improve and manage cybersecurity in cooperation with IT management systems. These are breakthroughs relative to the status quo of isolating traditional FRCS networks and ignoring the security weaknesses ingrained within.

Hardware components include a Local Security Manager appliance that controls device access and authentication, an optional Management Platform for monitoring and managing the system remotely Routing Firewalls for isolating and securing conventional BACnet/Internet Protocol devices, Gateway Appliances for securing non-BACnet devices, and Managed BACnet Controllers that support the higher level security features. The combination of products and services provides the practical tools needed to efficiently maintain and manage a secure FRCS environment.

Benefits

In support of DoD’s energy resilience goals, the expected benefits are threefold: (1) vastly improving FRCS security, (2) lowering cost and effort to attaining and maintaining a FRCS ATO, and (3) avoiding bad investments in less secure or less capable control systems. Putting a dollar value on resilience or cybersecurity is not straightforward, but it is expected nonetheless. As control systems age, they will eventually get upgraded or be completely replaced. A full control system overhaul can easily cost millions of dollars. These investment decisions have security and cost impacts lasting decades. This effort provides crucial and early experience with the most secure and interoperable control systems currently available. This experience with Managed BACnet will enable the DoD make better and more informed FRCS investment decisions. A secondary benefit is that Managed BACnet capabilities will be added to Construction Engineering Research Laboratory’s controls laboratory. This would serve as a platform for future testing and development efforts, streamlining subsequent ATO efforts in preparation for field testing. (Anticipated Project Completion - 2027)