◇ OpenCyber Academy
Professional · Chapter 6 · English

Chapter 6 — Internet exposure of building systems

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Internet exposure of building systems

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 How it happens"]
  N2["6.2 Checking exposure"]
  N3["6.3 Reading the result"]
  N4["6.4 Responding"]
  N5["6.5 Preventing recurrence"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 How it happens"]
  N2["6.2 Checking exposure"]
  N3["6.3 Reading the result"]
  N4["6.4 Responding"]
  N5["6.5 Preventing recurrence"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 How it happens]
    |
    v
[6.2 Checking exposure]
    |
    v
[6.3 Reading the result]
    |
    v
[6.4 Responding]
    |
    v
[6.5 Preventing recurrence]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) explain why building interfaces end up on the internet; (2) compare an exposure export with an approved list; and (3) respond to an unapproved exposure.

6.1 How it happens

A contractor opens a port so they can reach the BMS web page from home; a lift company adds a router; a firewall rule from a project is never removed. MITRE ATT&CK for ICS lists T0883 Internet Accessible Device for exactly this situation, and CISA advisories repeatedly urge removing control system interfaces from direct internet access.

At Millbrook a rule added in 2023 for chiller commissioning exposed BACnet and the BMS web login directly to the internet, and nobody removed it after the project. Every opening of this kind starts with a reasonable request for convenience. The task is to give contractors a supported route so they do not need to ask for ports.

6.2 Checking exposure

The hospital's network team, or an authorised service, produces a list of the hospital's public addresses and open services. The analyst compares it with the approved list — normally only the remote access gateway.

"""Lab 6: compare a synthetic external-exposure export with approved internet-facing services."""
approved = {("203.0.113.10", 443)}
found = [("203.0.113.10", 443, "VPN gateway"), ("203.0.113.24", 47808, "BACnet/IP"),
         ("203.0.113.24", 80, "BMS web login")]
for ip, port, svc in found:
    print(f"{ip}:{port:<6} {svc:14} {'approved' if (ip, port) in approved else 'NOT APPROVED - report'}")
print("unapproved:", sum((ip, port) not in approved for ip, port, _ in found))

Run with python3 lab_exposure.py. Verified output:

203.0.113.10:443    VPN gateway    approved
203.0.113.24:47808  BACnet/IP      NOT APPROVED - report
203.0.113.24:80     BMS web login  NOT APPROVED - report
unapproved: 2

Get the export from the people who own the addresses, and do not probe hospital addresses yourself unless the network team has authorised it. The approved list should be short and should name an owner for each entry. Lab 6 compares Millbrook's export with an approved list containing only the VPN gateway.

6.3 Reading the result

The VPN gateway on 203.0.113.10 port 443 is approved. Address 203.0.113.24 exposes BACnet/IP on 47808 and a BMS web login on 80. Both are unapproved: anyone on the internet could attempt to read or command controllers, or guess the web password.

The exposure matters more because of what sits behind it. BACnet accepts commands from anyone who can reach it, so this is not only a data leak but a route to theatre air and chiller settings. That combination places it at the top of the analyst's report to the network team and estates.

6.4 Responding

Report at once to the network team and estates; ask the network owner to close the exposure through emergency change; check logs for connections from outside; find who opened it and why, and give them a supported route instead.

Keep the export, the times and the log extracts with the report, because they show how long the exposure lasted and whether anyone used it. At Millbrook the firewall logs showed many outside attempts to reach port 47808 over recent months. That finding is passed to estates to check controller settings and trend logs for changes in the same period.

6.5 Preventing recurrence

Add a monthly exposure check to the network team's calendar, require an end date on every firewall rule opened for a project, and make contractors request remote access through the gateway process rather than asking for ports.

Each measure closes one cause. The monthly check catches what slips through; end dates make project rules expire; the gateway process gives contractors a route that does not need open ports. Track the monthly check in the register with the date and result, so a missed month is visible.

Worked example (synthetic Millbrook)

The network team traces 203.0.113.24 to a firewall rule added in 2023 for a chiller commissioning project. They remove it within the hour; firewall logs show many external connection attempts to port 47808 over recent months. The contractor is given gateway accounts instead.

Synthetic case — Millbrook. The addresses are from the documentation range 203.0.113.0/24 and the events are invented.

Errors and limits

Exposure lists are snapshots; repeat monthly. Only test addresses your organisation owns, through authorised means.

Exercises

Synthesis

Only the gateway faces the internet; anything else found is reported, closed and replaced with a supported route.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →