IT and OT security in properties

The property industry is undergoing a rapid digital transformation. More and more systems in our buildings are being connected and integrated to increase comfort, improve energy efficiency and offer new services. This development is blurring the line between traditional IT, which manages information and data, and OT, the operational technology that controls the building’s physical processes. This convergence creates a more complex security environment in which threats can come from unexpected directions and have unforeseen consequences.

OT in properties: The invisible nervous system

In modern properties, OT systems are the backbone that keeps many critical functions running. These include control systems for heating, ventilation and air conditioning (HVAC), lighting systems, access control systems, elevators and fire alarm systems. These systems, which were often isolated in the past, are now connected to networks to enable remote monitoring, data analysis and smarter control. This connectivity brings major benefits in terms of efficiency and ease of use, but it also introduces new vulnerabilities that must be managed

Why is integrated security so critical?

Traditionally, security in properties has focused on physical safeguards such as locks, alarms and surveillance cameras. In the digital era, this is no longer sufficient. A cyberattack could potentially compromise the functionality of the entire building, from turning off the heating in the middle of winter to manipulating access control systems. The consequences can range from financial losses and operational disruptions to, in the worst case, a threat to people’s safety.Protecting these integrated systems requires a holistic approach to security in which IT and OT are not viewed as separate domains but as an interconnected whole. This means understanding how a breach of an IT system could potentially be exploited to affect OT systems, and vice versa.

The multifaceted threats

The threat landscape facing properties’ IT and OT systems is complex and constantly evolving. Some of the most common and concerning threats include:

• Ransomware: Criminals can encrypt critical systems and demand a ransom to restore them. This can cripple essential functions such as energy management or even access control systems.

• Sabotage: State actors or other parties with malicious intent may try to cause harm by manipulating or shutting down critical systems. In a country with a cold climate, this could have serious consequences if, for example, heating systems are taken offline during the winter.

• Data breaches: Unauthorized access to networks can enable the theft of sensitive data, such as energy consumption, tenant information or even blueprints and system configurations. This information can then be used for extortion or other criminal purposes.

• Distributed denial-of-service attacks (DDoS): By overwhelming systems with traffic, attackers can cause disruptions and make essential services unavailable.

The way forward: A proactive security strategy

Building robust IT and OT security in properties requires a strategic and proactive approach. Here are some key components:

• Thorough mapping and risk analysis: The first step is to identify all connected systems and the data they handle. Next, potential threats and vulnerabilities need to be analyzed to understand which risks are most urgent.

• Network segmentation: Separating different systems into logical network segments can limit the spread of a potential attack. If one system is compromised, segmentation prevents the attacker from easily reaching other critical parts of the property's infrastructure.

• Implementation of security measures: This includes firewalls, intrusion detection systems, strong authentication and regular patching of systems and software.

• Monitoring and logging: Continuous monitoring of network traffic and system logs can help detect anomalies and early signs of an attack.

• Training and awareness: People are often the weakest link in the security chain. Training staff and tenants about cybersecurity risks and how to avoid them is essential.

• Incident response plan: Having a clear plan for how to respond to a security incident is important for minimizing damage and quickly restoring normal operations. This includes procedures for identification, isolation, remediation and recovery.

• Collaboration between IT and OT: To manage security effectively in integrated systems, it is important for IT and OT departments to collaborate and share knowledge. These teams often have different areas of expertise and perspectives that complement each other.

From reactive to proactive

Many property companies are still taking a reactive approach to cybersecurity, where action is only taken after an incident has occurred. Moving to a proactive security strategy, in which risks are continuously identified and mitigated before they are exploited, is crucial to protecting the properties of the future.The digital transformation of the property industry offers enormous potential, but it also comes with increased responsibility for security. By taking IT and OT security seriously, property owners can ensure a secure and sustainable future for their buildings and the people who use them.

What are we doing at PiiGAB?

At PiiGAB, we continuously work to strengthen cybersecurity in our products - an essential part of protecting the connected properties of the future. Recently, we have made several important improvements to our gateways: we have upgraded to a new version of the operating system, introduced fully randomly generated and more advanced passwords, and ensured that all passwords added later are encrypted. In the next update, we are also launching support for user management, providing even better control and security.

At PiiGAB, we actively work to ensure that our products and processes comply with current regulations. That is why we closely monitor both Cyber Resilience Act (CRA) and NIS2 Directive, which aims to strengthen cybersecurity within the EU. By adapting to these requirements today, we strengthen our customers' security.

To maintain a high level of security, it is essential to always use the latest software. We therefore recommend that you regularly update your gateways. To make this as smooth as possible, we offer PiiGAB Connect - a powerful tool that lets you easily manage and update your entire gateway fleet directly from your browser. You no longer need to log in to each device separately; instead, you can quickly roll out the latest security updates and drivers to all your devices at once. Simpler, safer and more efficient.To further strengthen security and availability, we offer smart IoT SIM cards with LTE connectivity. These are connected via closed APN network, meaning that only authorized users can access the devices - no unauthorized parties can gain access.

Combined with our service PiiGAB Connect you also get a secure VPN connection to your products, providing a secure and encrypted communication flow - regardless of where your devices are located. A complete solution for secure and reliable remote access.Would you like to upgrade your gateway? Please feel free to contact us at support@piigab.se this is how we can help you.Together, we are building a more secure digital infrastructure - one property at a time.

Read more about our latest update to the software for PiiGAB 900 Gateways