◇ OpenCyber Academy
Professional · Chapter 4 · English

Chapter 4 — An inventory of building devices

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — An inventory of building devices

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 What to record"]
  N2["4.2 Grouping"]
  N3["4.3 Reading the output"]
  N4["4.4 Using the inventory"]
  N5["4.5 Where the data comes from"]
  N6["4.6 Consequence column"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 What to record"]
  N2["4.2 Grouping"]
  N3["4.3 Reading the output"]
  N4["4.4 Using the inventory"]
  N5["4.5 Where the data comes from"]
  N6["4.6 Consequence column"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 What to record]
    |
    v
[4.2 Grouping]
    |
    v
[4.3 Reading the output]
    |
    v
[4.4 Using the inventory]
    |
    v
[4.5 Where the data comes from]
    |
    v
[4.6 Consequence column]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) build a building-device inventory grouped by system; (2) flag devices without vendor support; and (3) explain how support status changes risk decisions.

4.1 What to record

System, device name, location, owner, controller model, firmware, installation year, network address, vendor support status and clinical consequence. Building plant lasts twenty years or more, so support status matters more here than in office IT.

Each field answers a question someone will ask. Owner tells you whom to call; firmware and support status tell you whether fixes exist; network address tells you which firewall rules apply; clinical consequence tells you how urgent a finding is. A missing field is itself a finding to fill in, not a blank to ignore.

4.2 Grouping

Grouping by system shows who to talk to: HVAC devices go to the estates mechanical lead, the gas panel to the medical gas authorised person, the lift to its maintenance contractor.

"""Lab 4: group a synthetic Millbrook building-device list by system and flag unsupported firmware."""
devices = [("AHU-OT1", "HVAC", "2019", True), ("AHU-OT2", "HVAC", "2019", True),
           ("CHILLER-1", "HVAC", "2015", False), ("MGAS-PANEL", "medical gas alarm", "2021", True),
           ("LIFT-CTRL", "elevator", "2012", False), ("DOOR-SRV", "access control", "2020", True)]
by = {}
for name, system, year, supported in devices:
    by.setdefault(system, []).append(name)
    if not supported:
        print(f"UNSUPPORTED {name:10} system={system} installed={year}")
for system, names in sorted(by.items()):
    print(f"{system:18} {len(names)} device(s): {', '.join(names)}")

Run with python3 lab_bms.py. Verified output:

UNSUPPORTED CHILLER-1  system=HVAC installed=2015
UNSUPPORTED LIFT-CTRL  system=elevator installed=2012
HVAC               3 device(s): AHU-OT1, AHU-OT2, CHILLER-1
access control     1 device(s): DOOR-SRV
elevator           1 device(s): LIFT-CTRL
medical gas alarm  1 device(s): MGAS-PANEL

Grouping also shows where one weakness affects several devices. The three HVAC devices may share a contractor and a password policy, so a problem found on one should be checked on all. Lab 4 groups Millbrook's six devices by system and flags those without vendor support.

4.3 Reading the output

Two devices are unsupported: CHILLER-1, installed in 2015, and LIFT-CTRL from 2012. "Unsupported" means the vendor will publish no fixes for new weaknesses. They cannot simply be replaced — a chiller costs a large sum and replacement takes planning — so they need compensating controls: tighter network isolation, no remote access, closer monitoring.

Write the compensating controls next to each unsupported device in the inventory, with an owner and a date, so they are not forgotten. Also note when the device is due to be replaced, because compensating controls are a bridge, not a permanent answer. Confirm the support status with the vendor before treating the lab's flag as final.

4.4 Using the inventory

The inventory feeds advisory matching (Chapter 10), segmentation (Chapter 8) and the capstone risk report (Chapter 12). Keep it under access control.

Because the inventory names devices, versions and addresses, it is also a useful map for an attacker. Share it with the people who need it, such as estates, the network team and the contractors for their own systems, and keep older copies out of email. Record who changed it and when, so a reader can trust its contents. Review access to it each quarter.

4.5 Where the data comes from

The BMS contractor's handover file, estates maintenance records, purchase orders, the network team's switch tables and walk-downs in plant rooms all contribute. Each source misses something: handover files predate later additions, purchase records miss items bought by contractors, and plant rooms hold devices nobody listed. Comparing them, and recording which source supplied each field, makes the inventory trustworthy.

At Millbrook the handover file from the BMS contractor is the starting point, but the network team's switch tables show devices on VLAN 300 that the file omits. Walk-downs in plant rooms are booked through estates. When sources disagree, record both values and resolve them with the owner rather than choosing one silently.

4.6 Consequence column

Write the clinical consequence in plain words for each device, agreed with estates and clinical leads, so priorities are clear to non-specialists; as 4.1 notes, it is the field that tells you how urgent a finding is.

For example: AHU-OT1, theatre 1 loses pressure control; MGAS-PANEL, staff not warned of an oxygen supply fault; LIFT-CTRL, delayed patient transfers between floors. The column later drives the order of work in the risk report, so its wording should be clear to managers who have never seen the plant. Review the wording yearly.

Worked example (synthetic Millbrook)

Aisha takes the two unsupported devices to the estates manager. They agree: CHILLER-1 is moved behind a dedicated firewall rule allowing only BMS-WS, and LIFT-CTRL's cellular link is reviewed with the lift contractor. Both are added to the capital replacement plan with target years.

Synthetic case — Millbrook. Devices and years are invented.

Errors and limits

Support status must be confirmed with the vendor; installation year alone is a hint. Inventories age; review quarterly.

Exercises

Synthesis

A system-grouped inventory with support status shows owners and where compensating controls must carry the risk.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →