IT and OT security in properties

The property industry is undergoing a rapid digital transformation. More and more systems in our buildings are being connected and integrated to improve comfort, increase energy efficiency and offer new services. This development blurs the line between traditional IT, which manages information and data, and OT, the operational technology that controls the physical processes in the building. This convergence creates a more complex security environment where threats can come from unexpected sources and have unexpected consequences.

OT in properties: The invisible nervous system

In modern properties, OT systems are the backbone that keeps many critical functions running. These include control systems for heating, ventilation and air conditioning (HVAC), lighting systems, access control systems, elevators and fire alarm systems. These systems, which were often isolated in the past, are now connected to networks to enable remote monitoring, data analysis and smarter control. This connectivity brings significant benefits in terms of efficiency and user-friendliness, but it also introduces new vulnerabilities that must be addressed

Why is integrated security so critical?

Traditionally, security in properties has focused on physical safeguards such as locks, alarms and surveillance cameras. In the digital era, this is no longer sufficient. A cyberattack could potentially compromise an entire building’s functionality, from shutting off the heating in the middle of winter to manipulating access control systems. The consequences can range from financial losses and operational disruptions to, in the worst case, endangering people’s safety.Protecting these integrated systems requires a holistic approach to security, in which IT and OT are not viewed as separate domains but as an interconnected whole. It involves understanding how a breach of an IT system could potentially be exploited to affect OT systems, and vice versa.

The multifaceted threats

The threat landscape facing properties’ IT and OT systems is complex and constantly evolving. Some of the most common and concerning threats include:

• Ransomware: Criminals can encrypt critical systems and demand a ransom to restore them. This can paralyze essential functions such as energy management or even access control systems.

• Sabotage: State actors or others with malicious intent may attempt to cause harm by manipulating or shutting down critical systems. In a country with a cold climate, this could have serious consequences if, for example, heating systems are disabled during the winter.

• Data breaches: Unauthorized access to networks can enable the theft of sensitive data, such as energy consumption, tenant information, or even blueprints and system configurations. This information can then be used for extortion or other criminal purposes.

• Distributed denial-of-service attacks (DDoS): By overwhelming systems with traffic, attackers can cause disruptions and make essential services unavailable.

The way forward: A proactive security strategy

Building robust IT and OT security in properties requires a strategic and proactive approach. Here are some key components:

• Thorough mapping and risk analysis: The first step is to identify all connected systems and the data they handle. The next step is to analyze potential threats and vulnerabilities to understand which risks are most urgent.

• Network segmentation: Separating different systems into logical network segments can limit the spread of a potential attack. If one system is compromised, segmentation prevents the attacker from easily reaching other critical parts of the property's infrastructure.

• Implementation of security measures: This includes firewalls, intrusion detection systems, strong authentication, and regular patching of systems and software.

• Monitoring and logging: Continuous monitoring of network traffic and system logs can help detect anomalies and early signs of an attack.

• Training and awareness: People are often the weakest link in the security chain. Educating employees and tenants about cybersecurity risks and how to avoid them is essential.

• Incident response plan: Having a clear plan for how to respond to a security incident is important for minimizing damage and quickly restoring normal operations. This includes procedures for identification, isolation, remediation, and recovery.

• Collaboration between IT and OT: To manage security effectively in integrated systems, it is important for IT and OT departments to collaborate and share knowledge. These teams often have different areas of expertise and perspectives that complement each other.

From reactive to proactive

Many property companies are still taking a reactive approach to cybersecurity, where action is only taken after an incident has occurred. Moving to a proactive security strategy, in which risks are continuously identified and mitigated before they are exploited, is essential to protecting the properties of the future.The digital transformation of the property industry offers enormous potential, but it also brings increased responsibility for security. By taking IT and OT security seriously, property owners can ensure a safe and sustainable future for their buildings and the people who use them.

What are we doing at PiiGAB?

At PiiGAB, we continuously work to strengthen cybersecurity in our products – a natural part of protecting the connected properties of the future. Recently, we have implemented several important improvements to our gateways: we have upgraded to a new version of the operating system, introduced fully randomly generated and more advanced passwords, and ensured that all passwords added later are encrypted. In the next update, we will also launch support for user management, providing even better control and security.

At PiiGAB, we actively work to ensure that our products and processes comply with current regulations. That is why we closely follow both Cyber Resilience Act (CRA) and the the NIS2 Directive, which aims to strengthen cybersecurity in the EU. By adapting to these requirements already today, we strengthen our customers’ security.

To maintain a high level of security, it is essential to always use the latest software. That is why we recommend that you regularly update your gateways. To make this as easy as possible, we offer PiiGAB Connect – a powerful tool that lets you easily manage and update your entire gateway fleet directly from your browser. You no longer need to log in to each device separately; instead, you can quickly roll out the latest security updates and drivers to all your devices simultaneously. Simpler, safer and more efficient.To further strengthen security and accessibility, we offer smart IoT SIM cards with LTE connectivity. These are connected via closed APN network, meaning that only authorized users can access the devices – no outsiders can gain access.

Combined with our service PiiGAB Connect you also get a secure VPN connection to your products, providing secure and encrypted communication – regardless of where your devices are located. A complete solution for secure and reliable remote access.Would you like to upgrade your gateway? Please feel free to contact us at support@piigab.se that’s how we can help you.Together, we are building a safer digital infrastructure – one property at a time.

Read more about our latest updates to the PiiGAB 900 Gateways software