Advisory Note - Is Your Building Protected from Cyber Threats

A Service to A.G. Coombs Group Clients

Is your Building Protected from Cyber Threats?

Cyber security incidents reported against both government and private organisations continue to increase in both frequency and severity.

What are the Key Threats to Building Owners?

The entry point into a building ecosystem is frequently not the end target of a cyber-attack.

• Building Services Technologies and networks are often

State-sponsored actors and criminals are attempting to exploit businesses by accessing sensitive information through increasingly sophisticated techniques.

“Intelligent” Buildings are frequently connected to the Internet to enable operators to take advantage of key benefits such as remote monitoring, management and analytics.

Building Services Technology platforms often provide entry points to other critical inter-connected business systems for these malicious actors.

• •

less scrutinized from a security perspective than other business technologies.

Building Services Technologies and networks are considered “soft touch” entry points into Building ecosystems.

With the uptake of converged networks combining multiple building services onto a single network, the implications are increased with the potential of multiple systems becoming compromised in the event of a cyber-attack.

The serious risks associated with insufficient cyber defences in commercial buildings are well understood.

YEAR IN REVIEW

Figure 1: Cyber security incidents by severity category for FY23-24 (total 1,129) Sustained disruption of essential systems and associated services

C6

C5

C6

C5

Extensive compromise

Isolated compromise C6

Coordinated low-level malicious attack

C6

Low-level malicious attack C6

Unsuccessful low-level malicious attack

Source: Australian Signals Directorate Annual Cyber Threat Report 2023-2024

1

C5

C6

1

C6

C4

6 57 1 81 13

C4

C5

C3

20 93 6

C5

C5

C6

53 20

C3

C3

C4

C4

C6

C1

15 75 6 60 70

C2

C3

C3

C4

1 46 7 95 360

C6

C6

Member(s) of the public

Small organisation(s)

Medium-sized organisation(s)

State government

Federal government

Sole traders

Schools

Academia/R&D

Local government

Large organisation(s)

Government shared services

Supply chain

C6

C1

C1

C2

C3

C3

C6

3 11 28

National security Systems of National Significance

Regulated critical infrastructure

ASD categorises each cyber security incident it responds to on a scale of Category 1 (C1), the most severe, to Category 6 (C6), the least severe. Cyber security incidents are categorised on severity of impact and significance of the organisation’s impact to Australia.

In FY2023–24, there was a slight decrease in the number of extensive compromises, while the number of unsuccessful low-level malicious attacks increased by 10% compared with FY2022–23. There was also a 39% increase in isolated compromises this financial year.

Advisory Note: Is your Building Protected from Cyber Threats?

Risks Associated with Insufficient Cyber Defences in Commercial Buildings

• Incorrectly configured or poorly managed converged Networks.

• Cloud hosted applications connecting into Intelligent

• Failure or shutdown of building services limiting or restricting

•

• • • • • • • • •

their operation.

Degraded or compromised building security, access control and CCTV. Corruption of databases and loss of historical performance data.

Loss of data used for building performance ratings, such as NABERS. Potential losses through disruptions to business operations.

Potential loss of valuable intellectual property (IP).

Productivity losses.

Extortion attempts using ransomware.

Breaches of privacy and loss of personally identifiable information (PII).

Reputational damage.

Typical Pitfalls In the past, Building Services Technologies used protocols that were proprietary in nature. This provided an entry barrier for malicious actors. Emerging technologies have resulted in an increased risk due to:

• Building Services Technologies commonly specified to use open • • • • • • •

hardware, software, and communication protocols.

Open protocol solutions frequently contain known vulnerabilities that malicious actors will attempt to exploit.

Cyber Security of specified systems is not commonly a key consideration during a building’s design phase.

Many building networks are not designed and/or managed

by IT specialists.

Most cyber security incidents involve elements of human error.

Human error can reduce the effectiveness of otherwise sound security protocols and lowers the technical abilities required to access Intelligent Buildings.

Insufficient password protection is frequently seen in intelligent buildings.

Cyber-security is frequently sacrificed for operational and administrative convenience.

building services.

BYOD policies can allow users to bypass in-place security protocols.

How can Building Owners Minimise the Risks of Cyber-Attack?

The consequences of these attacks are ever increasing as information systems become more central to business and society. The incidence and severity of cyber-attacks can be reduced by:

• Centralising management of IT software and hardware required for Building Services Technologies.

• Centralising ownership and management of networking hardware to encourage the use of converged networks.

• Conducting periodic security reviews across all Building Services • • • • • • •

Technologies platforms.

Improving baseline security protocols implemented across all Building Services Technologies.

Enforcing the installation of secure products and services.

Ensuring that proven disaster recovery procedures are in place and regularly tested for all key systems.

Making informed purchasing decisions.

Taking steps to grow the cyber awareness skills of the operational staff.

Engaging specialist external help and support when needed.

Reporting all cyber-crime to the correct authority.

Ensuring your Intelligent Building is secure online is a shared responsibility.

For more information on Building Cyber Threats, please contact: Bart Taylor General Manager A.G. Coombs Advisory +61 3 9248 2700 btaylor@agcoombs.com.au

Entry Points Many Building owners and Facility Management staff are unaware of the risks from Building Services Technologies’ interconnectivity and remote accessibility of Building Services Technologies.

• Outdated Operating systems, application software and firmware dramatically increase the likelihood of malicious entry.

• Poorly configured Remote Access policies are common, where management of these policies is not performed centrally.

Intelligent buildings will have multiple points of entry for malicious actors to attempt to exploit.

• Remotely accessible HVAC, BMS and Power monitoring systems.

• Access Control and CCTV system.

• Energy analytics platforms.

• Third-party applications installed on Servers and Client workstations.

Published Sep 2025. While every effort has been made to ensure the accuracy of information in this publication, the A.G. Coombs Group assumes no responsibility for errors or omissions for any consequence of reliance on this publication. © 2025 A.G. Coombs Group and all related entities. All Rights Reserved.