Building Automation System Cyber Networks: An Unmitigated Risk to Federal Facilities

Abstract

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington ABSTRACT (maximum 200 words)The General Services Administration accesses building-automation system technology that runs federal facility processes such as HVAC, lighting, elevators, and access control via active Internet connections. Currently, these networks are not secure, despite legislation requiring them to be.This thesis investigated whether the Department of Homeland Security (DHS) could leverage existing federal laws, presidential directives, executive orders, government frameworks, and its current cyber and investigative capabilities to establish a strategy to secure federal facility building-automation system cyber networks, or if additional resources are needed The research uncovered significant vulnerabilities and threats to federal facility building-automation system networks, which, if exploited, could cause a significant impact on the American people, who are dependent on services offered by federal agencies such as the Department of Veterans Affairs and the Social Security Administration.A qualitative research method was used to interpret and analyze government and nongovernment institutional studies and reports, existing cybersecurity frameworks, and scholarly journals to determine which of the policy options offered would provide the best strategy for the DHS moving forward. The thesis concluded that utilizing a combination of private contractors and existing DHS assets would provide the best option. Submitted in partial fulfillment of the requirements for the degree of SUBJECT TERMS MASTER OF ARTS IN SECURITY STUDIES (HOMELAND SECURITY AND DEFENSE)from the NAVAL POSTGRADUATE SCHOOL December 2015Approved