◇ OpenCyber Academy
Professional · Chapter 5 · English

Chapter 5 — Accounts, defaults and device baselines

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Accounts, defaults and device baselines

Lesson map

Lesson 05 published. Map, example, EX021.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Defaults in buildings"]
  N2["5.2 Shared estates accounts"]
  N3["5.3 A procurement baseline"]
  N4["5.4 Rules that estates staff can follow"]
  N5["5.5 Checking the change worked"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX021"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Defaults in buildings"]
  N2["5.2 Shared estates accounts"]
  N3["5.3 A procurement baseline"]
  N4["5.4 Rules that estates staff can follow"]
  N5["5.5 Checking the change worked"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX021"]

[Learning outcomes]
    |
    v
[5.1 Defaults in buildings]
    |
    v
[5.2 Shared estates accounts]
    |
    v
[5.3 A procurement baseline]
    |
    v
[5.4 Rules that estates staff can follow]
    |
    v
[5.5 Checking the change worked]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX021]

Learning outcomes

You will (1) find default and shared accounts on building systems; (2) apply ETSI EN 303 645 and NIST IR 8259 ideas to procurement; and (3) set practical password rules for estates staff.

5.1 Defaults in buildings

Controllers and web interfaces often leave the factory with documented usernames and passwords. Integrators sometimes keep one password across every site they maintain. Both mean that anyone who has read a manual or worked for that integrator can log in.

At Millbrook, DOOR-SRV's web interface still accepted the factory password from its public manual. A check for defaults should cover every controller and web interface in the inventory, done by or with the contractor during a booked slot, without trying passwords against live systems on your own. Record each result and the date it was checked.

5.2 Shared estates accounts

The BMS workstation may have one login used by every shift engineer. That makes changes untraceable. Individual accounts, even if only on the BMS server, let the trend log name the person who changed a setpoint.

Named accounts also help when something goes wrong. If a theatre setpoint changes at night, a shared login cannot say who made the change, while a named one can, as Chapter 9's trend review shows. Where a controller allows only one account, keep the password in the vault and log each use with the engineer's name.

5.3 A procurement baseline

ETSI EN 303 645 requires no universal default passwords, a vulnerability disclosure policy, software updates and secure communication, among other provisions; NIST IR 8259 lists foundational activities manufacturers should perform. Hospital purchasing can turn these into contract questions for new building devices, so the problem shrinks over time.

For each new building device, ask the supplier in writing: does each unit have a unique password, is there a published way to report vulnerabilities, for how long will updates be provided, and is communication protected? Keep the answers with the purchase record. A supplier who cannot answer is itself useful information for the buyer.

5.4 Rules that estates staff can follow

Unique passwords per device stored in a managed password vault; named accounts on the BMS; admin rights only for planned work; passwords changed when a contractor's staff leave.

Write the rules on one page, agreed with the estates manager, and check that the vault is available on the shifts that need it. When a rule is hard to follow, such as changing passwords whenever a contractor's staff leave, agree how the hospital will learn about the departure. Review the rules after any incident that involved an account.

5.5 Checking the change worked

After a password is changed, try the old one from the BMS workstation in the same booked slot to confirm it fails, and confirm operators can still log in with the new arrangement.

Record both results in the change ticket. If the old password still works, the change has not taken effect, perhaps because the device has more than one account or interface. If operators cannot log in with the new arrangement, they may revert to a shared password, which undoes the work; fix the access problem in the same slot.

Worked example (synthetic Millbrook)

Aisha and the BMS contractor review DOOR-SRV, the access control server. Its web interface still accepts the factory password listed in the public manual. The contractor changes it during a booked slot, records it in the hospital's vault, and creates named accounts for the three security officers who manage door schedules.

Synthetic case — Millbrook. Device and accounts are invented.

Errors and limits

ETSI EN 303 645 targets consumer IoT; for industrial-grade building controllers, IEC 62443-4-2 component requirements are a better match. Some old controllers allow only one account.

Exercises

Synthesis

Changed defaults, named accounts, vaulted passwords and baseline contract questions close the easiest doors.

Continue studying — chapter 05 of 12

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →