The Move Beyond Building Automation Systems to a More Secure Energy Infrastructure


Frost and Sullivan’s findings show that developing a better and more energy efficient infrastructure runs parallel with the challenge of getting the most out of your existing aging energy infrastructure. Maximizing the value of both the new and the old is the name of the game. Companies need to balance cost effectiveness and risk, which is why BAS and SCADA applications are on the losing side of the coin, but still considered because they have been around for more than a decade and integrate with legacy assets. However, as cyber threats and their associated risks grow, the heads of engineering, operations and facilities management are weighing in. The cost of a security breach or service disruption is ruling out the use of BAS or SCADA for automating energy infrastructures, which is putting vendors of such systems in a frenzy to find a plausible solution. The ISA Security Compliance Institute (ISCI) is emerging to formalize SCADA security testing, but it will inevitably take time before any protocol standards will be accepted as safe and secure.

“A great majority of SCADA vendors have started to address the risks of cyber threats by developing lines of specialized industrial firewall and VPN solutions for TCP/IP-based SCADA networks,” said Frost & Sullivan research analyst Katarzyna Owczarczyk in a recent statement. Across the spectrum of automation and control systems, statistics show that both BAS and SCADA systems have been found to be more vulnerable to cyber-attacks. This is re-affirmed by a number of high-profile attacks recently.

Most of the protocols communicating with both BAS and SCADA have their origins in serial communications and provide absolutely no security, and contrary to some of the “sales” jargon out there, are simply not foolproof and put end-users in a vulnerable, risky position. Whether the communications are Modbus, TCP/IP or OPC, the unfortunate truth is that these protocols actually increase the potential vulnerabilities within their facilities. Energy asset management systems, unlike BAS systems, have been developed to manage the growing complexity of distributed energy resources (DER).