BMS Security: 3 Tips for OEMs to Better Protect Their Devices

Connected and Cloud-enabled commercial and industrial equipment has become essential to seamless and automated operations. Couple that with the fact that cyber threats are growing in frequency and sophistication, and you have a recipe for a security disaster. OEM devices are not immune to attack. Quite the opposite, in fact.

Just do an online search of “BMS cyberattacks” and you’ll find headline after headline detailing the disastrous tales of cyberattacks that have happened to some of the most well-known organizations around the world; and all because hackers got in through an HVAC or other building management system.

The best time to think about the security stature of everything from boilers to elevators to fire alarm panels is at the start of a new product design or update so security can be baked into the device from the very beginning and to continue it all the way to the end-user application, employing the latest industry standards and best practices. Remember, you cannot adequately protect against hackers if you’re merely adding a one-off security layer on top of a product or solution after it’s been developed and released. It’s simply not enough.

Chances are, if you are a small- to medium-sized OEM, you likely do not have a team of IT professionals to help make your devices smarter, connected, and Cloud-enabled. In fact, with rising costs and pandemic-fueled supply chain shortages, it seems that OEMs of every size are operating with lean budgets and reduced staffing.

But that doesn’t negate the need for security expertise, including keeping up with IIoT cybersecurity standards and best practices. Of course, that doesn’t have to mean hiring an in-house team. On the contrary, that’s where the right security-focused technology solution providers and industry partners can help. The key is to pick a partner that is doing the heavy lifting by building their solutions from the ground up using best-practice security measures, including adhering to standards, and engaging in robust penetration testing.

Like it or not, as the OEM you are responsible for making sure that any provider or partner solution you integrate into your devices (including Cloud and building automation gateways) are designed to be secure. You can’t tell by looking and you certainly shouldn’t believe the sales hype. Instead, do your due diligence. How? By asking for proof of industry certifications and third-party security testing. If your provider or partner is taking security seriously, you can bet they’ve submitted their products and solutions to third-party companies for rigorous security testing.

Can Security Breaches Still Happen?

There is no such thing as a 100% fail-safe product. Regardless of how much security is built into a product or how much it is rigorously tested for vulnerabilities, hacks still happen. That’s because malicious attackers are continually finding new ways to penetrate organizations.

However, by baking security into your products and solutions from start-to-finish; by engaging experienced cybersecurity-informed partners; and by following the latest industry standards, you can ensure a better defense against cybercrime.

Originally this article was published here.