◇ OpenCyber Academy
Professional · Chapter 10 · English

Chapter 10 — Advisories and patching for building systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 10 — Advisories and patching for building systems

Lesson map

Lesson 10 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["10.1 Sources"]
  N2["10.2 Matching"]
  N3["10.3 Choosing"]
  N4["10.4 Tracking"]
  N5["10.5 Testing after patching"]
  N6["10.6 Vendor contact"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["10.1 Sources"]
  N2["10.2 Matching"]
  N3["10.3 Choosing"]
  N4["10.4 Tracking"]
  N5["10.5 Testing after patching"]
  N6["10.6 Vendor contact"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX046"]

[Learning outcomes]
    |
    v
[10.1 Sources]
    |
    v
[10.2 Matching]
    |
    v
[10.3 Choosing]
    |
    v
[10.4 Tracking]
    |
    v
[10.5 Testing after patching]
    |
    v
[10.6 Vendor contact]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) match advisories to the building inventory; (2) decide between patching and mitigation; and (3) track decisions over time.

10.1 Sources

CISA's advisories index includes many building automation, access control and lift products, alongside vendor notices. Subscribe to those relevant to Millbrook's vendors.

Use the inventory to choose which vendors and products to follow, including the BMS controllers, the access control server and the lift controller. Check the CISA index and the vendor pages regularly, and record the date of each check. An advisory that arrives after an incident is far less useful than one read the week it was published.

10.2 Matching

For each advisory: is the product in our inventory, at an affected version, reachable in the way the advisory describes? Unsupported devices (Chapter 4) often match old advisories that will never be fixed.

Record the answer to each question in the advisory register, even when the product is not present. For unsupported devices such as CHILLER-1 and LIFT-CTRL, an advisory without a fix leads straight to compensating controls: tighter isolation, no remote access and closer monitoring, as agreed for those devices in the inventory work.

10.3 Choosing

Patching a BMS controller usually needs a contractor visit, a booked slot and checks of every point afterwards. Mitigations — firewall rules, disabling a web interface, restricting the gateway account — can often be applied sooner. Record which you chose and why.

The choice depends on consequence and on how soon a safe slot is available. A mitigation applied today may be better than a patch next month, as long as it is checked to block the path the advisory describes. Write the decision in the register with the date, owner and review date.

10.4 Tracking

A simple register: advisory, products affected here, decision, mitigation, patch date, owner, review date. Report open high-consequence items to the estates manager monthly.

Keep the register in the same place as the inventory, so that a new advisory can be matched quickly. Review it with the estates manager each month and close items only when completion has been shown, such as a version check after patching. Items left open for a long time need a fresh decision rather than silent ageing.

10.5 Testing after patching

Afterwards, the contractor confirms every point reports, alarms work and schedules are correct; estates signs off.

Agree the checks before the patch, with a list of points and alarms to test and the person who will test them. Keep a fall-back ready, such as the previous firmware or manual keys for doors. Record the results and the sign-off in the advisory register, so the item can be closed with evidence. Patch one unit first where possible, and check it before moving to the next.

10.6 Vendor contact

When an advisory is unclear about building configurations, ask the vendor or integrator directly: which models and options are affected, whether the vulnerable feature is enabled by default, and whether a mitigation has been tested on systems like Millbrook's. Record the answer and who gave it. Vendors' product security teams usually respond faster when the question names the exact model and version from the inventory.

Keep the vendor's answers with the advisory in the register, and repeat the question if the answer is unclear. If the vendor confirms that a mitigation works, still check it at Millbrook, because local configuration can differ.

Worked example (synthetic Millbrook)

A synthetic advisory warns that DOOR-SRV's web interface allows authentication bypass in version 4.1; Millbrook runs 4.1. The interface is reachable only from the access control zone after Chapter 8, and the vendor fix 4.2 needs a 30-minute outage of door scheduling. The decision: restrict the interface to the security office's workstation today, patch on Sunday 06:00 with manual keys issued to ward managers during the outage.

Synthetic case — Millbrook. The advisory and versions are invented; real advisories are listed by CISA.

Errors and limits

Advisories may omit details; ask vendors. A mitigation must be checked to actually block the described path.

Exercises

Synthesis

Advisories are matched, mitigated quickly, patched at booked times with fall-backs, and tracked to closure.

Continue studying — chapter 10 of 12

← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →