Securing Industrial IoT and Building Automation Systems

Cybersecurity Principles, Threats, Architectures, Strategies and Practical Implementation

Introduction

1. What This Book Covers
2. Who Should Read This Book
3. How to Use This Book
4. The Core Thesis

Chapter 1: The Industrial and Building Security Imperative

1. From IT Breaches to Physical Consequences
2. The Convergence of IT, OT and Building Systems
3. Safety, Availability and the CIA Triad Reordered
4. A Taxonomy of Industrial and Building Environments
5. The Cost of Inaction: Economic and Human Impact

Chapter 2: Fundamentals of Industrial and Building Automation

1. Control Theory Essentials for Security Engineers
2. The ICS Ecosystem: PLCs, RTUs, SCADA, DCS and PACs
3. Building Automation Architectures: BAS and BMS
4. Sensors, Actuators and Field Devices
5. Human-Machine Interfaces and Operator Workstations

Chapter 3: Industrial and Building Network Architectures

1. ISA-95 and the Purdue Reference Model
2. Fieldbus, Industrial Ethernet and Converged Networks
3. Building Communication Networks and BACnet Architecture
4. Protocol Stacks: From Modbus to OPC UA
5. Wireless Sensor Networks and LPWAN in Industrial Environments

Chapter 4: Legacy Industrial Protocols and Their Inherent Risks

1. Modbus: Simplicity Without Security
2. DNP3: Telecontrol and Its Trust Model
3. PROFIBUS, PROFINET and Ethernet/IP
4. Insecure by Design: What Legacy Means in Practice
5. Compensating Controls for Insecure Protocols

Chapter 5: Modern Industrial Communication Standards

1. OPC UA: Architecture, Security Profiles and Real-World Deployment
2. OPC UA for Building Automation (OPC UA over TSN)
3. MQTT and CoAP in Industrial and Smart Building Contexts
4. Certificate Management in Large-Scale Deployments
5. Interoperability Challenges in Multi-Vendor Environments

Chapter 6: Building Automation Protocols in Depth

1. BACnet: Design, Security Extensions and Common Misconfigurations
2. KNX and Europe’s Building Bus Standard
3. LONWorks, Siemens PCL and Legacy Building Protocols
4. IP-Based Building Communication and VESA Standards
5. Protocol Translation and Gateway Risks

Chapter 7: Threat Actors, Objectives and Attack Patterns

1. Nation-States, Criminal Groups, Insiders and Hacktivists
2. Objectives: Disruption, Espionage, Ransom and Sabotage
3. Kill Chains for Industrial and Building Environments
4. MITRE ATT&CK for ICS and ICS-Specific Tactics
5. Target Selection and Attack Surface Mapping

Chapter 8: Attack Vectors and Initial Access

1. Remote Access Abuse and VPN Compromise
2. Exposed Services and Internet-Facing Gateways
3. Third-Party and Vendor Maintenance Access
4. USB and Removable Media Attacks
5. Physical Access and Local Interface Exploitation

Chapter 9: Vulnerabilities and Exploitation Mechanisms

1. Weak and Default Authentication
2. Insecure Firmware and Unpatched Components
3. Buffer Overflows and Memory Corruption in Controllers
4. Insecure APIs and REST Interfaces
5. Supply-Chain Compromise and Software Bill of Materials

Chapter 10: Lateral Movement, Persistence and Impact

1. Network Pivoting Across Purdue Levels
2. Credential Harvesting and Pass-the-Hash in OT
3. Protocol-Level Manipulation and Logic Attacks
4. Data Manipulation and Stealth Techniques
5. Ransomware, Denial-of-Service and Operational Disruption

Chapter 11: Building-Specific Threat Scenarios

1. HVAC as an Attack Vector: Comfort, Safety and Efficiency
2. Access Control Systems and Physical Security Breaches
3. Video Surveillance Compromise and Privacy Violations
4. Elevator, Fire Detection and Life-Safety System Risks
5. Smart Metering and Energy Management Vulnerabilities

Chapter 12: Ransomware and Real-World Incidents

1. Colonial Pipeline: The Modern Ransomware Playbook
2. NotPetya and the Global Ripple Effect
3. Triton/Trisis: Targeting Safety Instrumented Systems
4. Building Automation Incidents and Smart-City Attacks
5. Common Patterns Across High-Impact Incidents

Chapter 13: Security Governance and Risk Management

1. Establishing Security Governance Structures
2. Asset Inventory and Classification for OT and BAS
3. Dependency Mapping and Criticality Assessment
4. Risk Assessment Methodologies for Industrial Environments
5. Threat Modeling for Control Systems and Building Automation

Chapter 14: Defensive Security Assessment Methodologies

1. Passive Network Monitoring and Traffic Analysis
2. Asset Discovery in Mixed IT/OT Environments
3. Configuration Audits and Compliance Checks
4. Controlled and Authorised Penetration Testing
5. The Risks of Active Scanning in Safety-Critical Systems

Chapter 15: Vulnerability Management in Operational Environments

1. OT-Specific Vulnerability Databases and Intelligence
2. Prioritization Frameworks for Constrained Environments
3. Compensating Controls When Patching Is Not an Option
4. Firmware Management and Lifecycle Constraints
5. Measuring Vulnerability Reduction Over Time

Chapter 16: Network Segmentation and Zoning Strategies

1. ISA-95 Zones and Conduits: Design Principles
2. Industrial DMZ Architecture and Cross-Domain Solutions
3. Microsegmentation in Modern OT Networks
4. Firewalling for Protocol-Aware Industrial Traffic
5. Reference Architectures for Manufacturing and Buildings

Chapter 17: Identity, Access and Authentication

1. IAM for OT: Beyond Active Directory
2. Multifactor Authentication in Industrial Settings
3. Privileged Access Management and Just-In-Time Access
4. Device Identity and Mutual Authentication
5. Secure Remote Maintenance and Vendor Access

Chapter 18: Endpoint and Device Security

1. Industrial Endpoint Protection: IDS, Antivirus and EPP
2. Application Allowlisting and Execution Control
3. Secure Boot, TPMs and Hardware Root of Trust
4. PLC and Controller Code Integrity
5. Constrained Devices and Edge Security

Chapter 19: Data Protection and Cryptographic Controls

1. TLS and IPsec in Industrial Networks
2. Encryption in Building Automation and Field-Level Traffic
3. Certificate Lifecycle Management at Scale
4. Key Management and Hardware Security Modules
5. Post-Quantum Cryptography and Future-Proofing

Chapter 20: Monitoring, Detection and Threat Intelligence

1. OT-Aware SIEM and Centralized Logging
2. Industrial Intrusion Detection and Prevention Systems
3. Anomaly Detection and Behavioral Baselines
4. OT Threat Intelligence Feeds and Integration
5. AI and Machine Learning: Real Capabilities vs. Marketing

Chapter 21: Incident Response, Forensics and Resilience

1. OT-Specific Incident Response Planning
2. Forensic Readiness in Constrained Environments
3. Backup, Immutable Copies and Recovery Procedures
4. Disaster Recovery and Business Continuity for Critical Operations
5. Resilience Engineering and Graceful Degradation

Chapter 22: The IEC 62443 Series and Industrial Security Standards

1. IEC 62443-1: Overview and Terminology
2. IEC 62443-2: Organizational Security Requirements
3. IEC 62443-3: System-Level Requirements and SLRs
4. IEC 62443-4: Component and Product Security
5. IEC 62443 Assessment, Certification and Practical Implementation

Chapter 23: NIST Frameworks and Government Guidance

1. NIST Cybersecurity Framework for Industrial Contexts
2. NIST SP 800-53, SP 800-160 and Supporting Publications
3. Mapping IEC 62443 and NIST Frameworks
4. US Government Mandates and Sector-Specific Requirements

Chapter 24: European, German and International Regulatory Requirements

1. NIS2 Directive and EU Critical Infrastructure Requirements
2. Germany’s KRITIS Regulations and BSI Standards
3. IEC 62443 and Regional Adaptations
4. Sector-Specific Regulations for Energy, Water and Transport
5. ISO/IEC 27001 in Industrial and Building Contexts

Chapter 25: Secure System Lifecycle Management

1. Security Requirements in Procurement and RFPs
2. Secure Design and Architecture Review Processes
3. Commissioning, Integration and Acceptance Testing
4. Ongoing Operations, Patch Management and Monitoring
5. Modernization, Decommissioning and Secure Disposal

Chapter 26: Smart Building and Campus Reference Architectures

1. The Secure Smart Campus: End-to-End Architecture
2. Network Segmentation for Multi-Function Buildings
3. Integrating Building Systems with Corporate IT Security
4. Edge Computing and Local Control Architectures
5. Worked Examples: Segmentation Plans and Data Flows

Chapter 27: Organizational Dimensions and Security Maturity

1. Governance Models: Who Owns OT and Building Security?
2. Staffing, Skills and the IT-OT-Buildings Talent Gap
3. Vendor and Integrator Relationships
4. Budgeting, Cost-Benefit Analysis and Insurance
5. Security Maturity Assessment and Continuous Improvement

Chapter 28: Emerging Technologies and Future Threats

1. Digital Twins for Security and Operational Resilience
2. Software-Defined Networking and Programmable Industrial Networks
3. Edge-to-Cloud Security and 5G in Industrial Environments
4. AI-Powered Operations and AI-Powered Attacks
5. Evolving Regulatory Landscapes and Future Compliance

Conclusion

References

Glossary