{"id":47311,"date":"2020-04-24T12:52:52","date_gmt":"2020-04-24T11:52:52","guid":{"rendered":"https:\/\/www.intelligentcio.com\/me\/?p=47311"},"modified":"2020-05-05T08:27:02","modified_gmt":"2020-05-05T07:27:02","slug":"rabobank-deploys-building-automation-system-security","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2020\/04\/24\/rabobank-deploys-building-automation-system-security\/","title":{"rendered":"Rabobank Deploys Building Automation System Security"},"content":{"rendered":"\n

Rabobank is deploying SilentDefense to improve building automation system (BAS) security<\/em><\/strong>.<\/p>\n\n\n\n

Customer Profile<\/strong><\/p>\n\n\n\n

Rabobank is a Dutch multinational banking and financial services company headquartered in Utrecht. Serving approximately 8.3 million clients around the world [1], it is the second-largest bank in The Netherlands in terms of total assets, and among the world\u2019s 25 largest financial institutions in terms of Tier 1 capital. With more than 400 offices only in The Netherlands, they offer the most finely-meshed banking network in the country.<\/p>\n\n\n\n

The Challenge<\/strong><\/p>\n\n\n\n

Nowadays, a building is increasingly a cyber-physical system (CPS) whose physical components, such as HVAC, access control and elevators, escalators and moving walkways, are integrated and controlled through digital infrastructures. Building automation systems (BAS) integrate, connect and control the building\u2019s different sub-systems to facilitate management operations. In addition, asset inventory is becoming crucial for efficient preventive  maintenance and for compliance with the stringent requirements many countries are imposing on smart buildings.<\/p>\n\n\n\n

BAS vulnerabilities have risen 500% YoY [2] in the last three years, and it is becoming increasingly important for owners and managers of critical buildings to address the key issues of asset inventory and cybersecurity.<\/p>\n\n\n\n

BAS Threat Landscape<\/strong><\/p>\n\n\n\n

\u2022 500% more BAS cyber vulnerabilities discovered in the last three years [2] \u2022 75% of organizations don\u2019t have a formalized cyber security strategy [3] \u2022 1,500 access attempts every day on a single smart house exposed on the Internet [4] \u2022 68,000 open BAS interfaces easily found on the Internet [4] \u2022 50 billion IoT devices on the network in 2022 [5]<\/p>\n\n\n\n

The Project<\/strong><\/p>\n\n\n\n

Rabobank has launched  an initial BAS cybersecurity project to cope with the following challenges: \u25aa Protecting networked BAS\/IoT devices \u25aa Inapplicability of IT security solutions to BAS devices \u25aa Limited or no visibility into how devices are operating and whether they are communicating with the outside world<\/p>\n\n\n\n

The scope of the OT network to be managed includes several different building automation systems for HVAC,  surveillance, access control and lighting. The initial scope covers more than 500 devices. After a defined learning  period, a thorough penetration testing will be performed to validate the bank\u2019s improved security posture. SilentDefense has been deployed to automatically identify and protect each building automation system on the network, deliver an accurate asset inventory and capture all the relevant cyber and operational threats without the cost and complexity of software agents on endpoints.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Main Results<\/strong><\/p>\n\n\n\n

A complete inventory and network map has been extracted with a detailed view of hundreds of  devices, including their current model, firmware and  vulnerabilities.<\/p>\n\n\n\n

Among the relevant findings, SilentDefense detected: \u2022 Unwanted communication links between the IT and OT network caused by firewall misconfiguration \u2022 Unwanted\/unnecessary services and protocols enabled (e.g. file transfer and device discovery services) \u2022 Maintenance operations not adhering to policies (e.g. supplier connecting own laptop to the network) \u2022 Misconfigured devices (e.g. IP cameras with high bandwidth consumption) \u2022 Weak passwords to access IP-cameras, multiple vulnerable hosts and controllers with outdated firmware<\/p>\n\n\n\n

Customer Value<\/strong><\/p>\n\n\n\n

\u2022 Full visibility into BAS network \u2022 Enforcement of compliance with internal network  and maintenance policies \u2022 Detection of anomalies and cyber threats to operational continuity \u2022 Improvement of the overall security posture<\/p>\n","protected":false},"excerpt":{"rendered":"

Rabobank is deploying SilentDefense to improve building automation system (BAS) security. Customer Profile Rabobank is a Dutch multinational banking and financial services company headquartered in Utrecht. Serving approximately 8.3 million clients around the world [1], it is the second-largest bank in The Netherlands in terms of total assets, and among the world\u2019s 25 largest financial […]<\/p>\n","protected":false},"author":18,"featured_media":47313,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[809],"tags":[11632,11634,6050,11631,11633],"class_list":["post-47311","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-more-news","tag-bas","tag-building-automation","tag-forescout","tag-rabobank","tag-silentdefense"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/47311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=47311"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/47311\/revisions"}],"predecessor-version":[{"id":47964,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/47311\/revisions\/47964"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/47313"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=47311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=47311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=47311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}