IT vs OT Systems: What’s the Difference?

IT vs OT Systems: What’s the Difference?

Information Technology (IT) and Operations Technology (OT) are two distinct yet interconnected fields that play critical roles in modern organizations. IT deals with the use of technology to support business processes, while OT focuses on the use of technology to control and monitor industrial and commercial processes in facilities. By looking at IT vs OT systems, it’s easy to identify their major differences.

What are IT Systems?

IT systems are primarily used to support business processes, such as data storage, processing, and communication. These systems include things like enterprise resource planning (ERP) systems, customer relationship management (CRM) systems, and enterprise-wide networks. They are responsible for maintaining the flow of data within an organization, and provide important services such as email, file storage, and data analysis. IT systems are also responsible for maintaining the security of an organization’s data, including firewalls, intrusion detection systems, and encryption.

What are OT Systems?

OT systems, on the other hand, are used to control and monitor industrial processes. These systems include things like programmable logic controllers (PLCs), distributed control systems (DCSs), and supervisory control and data acquisition (SCADA) systems. They are responsible for controlling and monitoring the physical processes within an organization, such as manufacturing processes, power generation, and water treatment. OT systems are designed to operate in real-time and are often required to operate 24/7.

When we look at IT vs OT systems, trends show they are increasingly being integrated to improve the overall efficiency of companies and facilities. For example, a building owner might use data from an OT system to optimize their HVAC systems, or an energy company might use data from an IT system to identify and respond to potential power outages.

diagram showing and IT system components vs  OT system components
The difference between IT and OT system components. Note that IT and OT must interface with one another.

Network Security

One of the major differences between IT and OT is in the level of security required. IT systems are typically more connected to the internet; hence they are more exposed to cyber threats. These systems need to comply with industry-specific standards like the Payment Card Industry Data Security Standard (PCI-DSS), HIPAA and SOC2. Organizations need to maintain regular backups, have intrusion detection and prevention systems, as well as have strong and regularly updated access controls in place.

OT systems on the other hand, are typically more isolated from the internet and have fewer connections to external networks. These systems need to comply with standards like IEC 62443 which are specific to industrial environments. Because of the real-time nature of their operations, organizations need to have redundancy in place and maintain backups that can be restored within minutes, have detailed incident response plans, as well as maintain physical security of the systems.

Conclusion

IT and OT systems play critical roles in modern organizations, with IT systems primarily focused on supporting business processes and OT systems focused on controlling and monitoring industrial processes. The two fields are becoming increasingly integrated, with organizations leveraging data from both types of systems to improve overall efficiency. However, they are also vastly different in terms of the level of security required, with IT systems being more exposed to cyber threats, and OT systems being more isolated and needing to comply with industrial specific standards.

BACnet Basics: What are Device Profiles?

BACnet Basics: What are Device Profiles?

In this article in our BACnet Basics Series, we look at Device Profiles, why they’re important and how they’re created. We’ve also included a real world example that illustrates how to use device profiles to accurately specify your own projects.

What are Device Profiles?

As we saw in BACnet Basics: What are BIBBs?, device functions come in five basic categories, each containing specific capabilities. For example, the category Data Sharing (DS) includes capabilities like Read Properties (RP), Write Properties (WP) or Change of Value (COV). If we combined all these services into a minimum collection of capabilities, we would be creating a device profile.

As an analogy, think of the profile “Automobile”. Every machine that claims to be an “automobile” needs the functions of Acceleration (A), Deceleration (D) and Maneuverability (M). Of course, there can be automobiles that do much more, but every “automobile” must, at minimum, perform these three functions (A,D,M).

Definition: BACnet device profiles define the minimum set of BACnet Interoperability Building Blocks (BIBBs) supported by a device claiming that profile. When a device claims a specific profile, you know that it contains a preset of specified functions and services. Profiles are handy because they provide a short-hand method for describing a device and its interoperability capabilities. Device profiles are organized into Groups and Families

Device Groups

Device Groups are general categories of device functions. There are four Group types:

  1. Operator Interface—Covers the minimum capabilities for workstations and other user interface devices. Devices normally support A-side (Client) functionality.
  2. Controller Device—Covers anything from programmable building controllers to smart sensors. Devices normally support B-side (Server) functionality, but more advanced supervisory controllers also include A-side (Client) functionality.
  3. Control Station—Covers lighting control stations that are smaller client devices that support specific user controls such as manual light switches.
  4. Basic Device—Covers all “miscellaneous” family functionality. Usually included alongside other device profiles.
Table showing bacnet profile groups

Device Families

Each Profile Group contains various Families within it. Families cover profiles for various, supported building systems like Lighting, Life Safety, and General Purpose. For example, the Controller Device Group contains profiles for the following Family types:

(Example) Controller Family

  • General Purpose—General purpose controllers usually for HVAC and lighting.
  • Access Control—Access control controllers such as an access control panel
  • Lighting—Lighting controllers such as supervisory lighting controller
  • Life Safety—Life safety controllers such as a fire detection panel.
  • Elevator—Elevator controllers

Let’s zoom into the General Purpose profile family within the Controller Device Group and see what BIBBs it contains.

  • Building Controller (B-BC) —Field programmable and configurable supervisory controllers in HVAC and general purpose application.
  • Advanced Application Controller (B-AAC)—Controllers that run advanced HVAC or general purpose control applications.
  • Application Specific Controller (B-ASC)—Controllers that run specific HVAC or general purpose control applications.
  • Smart Actuator (B-SA)—Small, commendable actuator devices.
  • Smart Sensor (B-SS)—Small sensors that provide sensor values to other devices.

BACnet device profile Families are organized in a container hierarchy. As you move up in complexity, you increase the minimum amount of BIBBS required. Like nesting dolls, each profile contains all the minimum profiles from the previous ones. 

For example, the above General Purpose BACnet profiles increase in complexity as you move up from Smart Sensor to Building Controller. All BIBBS included in a Smart Sensor profile are always included in a Smart Actuator profile, and all the BIBBs included in those two profiles are always included in an Application Specific Controller, and so on.

List of general purpose controller bacnet profiles

Although higher level BACnet profiles contain more BIBBs, it’s not the number of profiles that matters. Each profile requires a minimum number and type of profiles. So, even if a device contains or exceeds the minimum number of BIBBs, it doesn’t guarantee it will meet the standard. It must contain the minimum number of the correct BIBBs to meet the profile standard.

Specifying Device Profiles: Boardroom Example

Let’s use the Device Profile Quick Reference Guide to see an example of how to choose the device profiles for a real-world project. Read the following scenario:

  • You want to outfit a medium-sized boardroom equipped with a control panel with a built-in controller. The panel will control the room’s temperature and lighting. You also need manual lighting controls near the door. 

To determine the device profiles needed for the project, we can start by listing the functionality we need. We will need HVAC controls for temperature. For lighting, we will need controls for both the panel and a manual user control switch on the wall. Therefore, we will need functionality from the Controller Group and Control Station Group.

Next, we can determine what Families we need within each group.

For the Controller Group, we need:

  • General Purpose Family for HVAC
  • Lighting Family for panel control lighting
  • Access Control Family for access

For the Control Station Group, we need:

  • Lighting Family for manual switch lighting control

Finally, we can choose specific profiles to fulfill our HVAC and lighting functionality.

bacnet touch screen device for a boardroom.

HVAC Profiles

In the Reference Guide, we see the following profiles for the General Purpose Controller Family:

  • B-BC: The building controller is intended for field programmable and configurable supervisory controllers in HVAC and general purpose applications.
  • B-AAC: The advanced application controller is intended for controllers that run advanced HVAC or general purpose control applications. It does not require being configurable through BACnet.
  • B-ASC: The application specific controller is intended for controllers that run specific HVAC or general purpose control applications. It does not require being configurable through BACnet.
  • B-SA: The smart actuator is intended for small actuator devices that allow being commanded.
  • B-SS: The smart sensor is intended for small sensor devices that provide sensor values to other devices.

We can ignore the last two profiles, because we need neither actuators (B-SA) or sensors (B-SS) for the project. We can also eliminate the Building Controller (B-BC) profile because it does not require supervisory control. Depending on our HVAC needs, we could choose either the Advanced Application (B-AAC) or the Application Specific (B-ASC) profile.

Lighting Profiles

In the Reference Guide, we see the following profiles for the Lighting Controller Family:

  • B-LS: The lighting supervisory controller is intended for controllers in lighting applications that can command and operate subordinate lighting controllers, in particular through group write commanding.
  • B-LD: The lighting device is intended for lighting controllers that control individual lights or groups of lights. Normally used as leaf nodes in lighting group setups.

We would choose the B-LD profile if the panel only controls one group of lights. However, if the lighting is more complex, we might opt for the B-LS with supervisory controls.

Control Station Profiles

Because the room also requires manual user lighting controls, we need a profile from the Control Station Family. In the Reference Guide, we see the following profiles:

  • B-ALCS: The advanced lighting control station is intended for sophisticated control stations that support user view, control and limited configuration of lighting functionality. Provides full commanding support of lighting objects and group operations for them.
  • B-LCS: The lighting control station is intended for control stations that support simple control of lighting functionality and limited status indication. Provides limited support of commanding lighting objects.

The simpler B-LCS would work for this project. But, again, depending on the complexity of the room’s lighting, we might choose the more complex profile.

Conclusion

Through the Boardroom Example above, we can see how BACnet profiles make project specifications easier and more accurate. Standards and profiles support an accurate procurement process, requiring less change orders and adjustments. Defining capabilities also creates an outcomes-based workflow so that buildings function the way owners and tenants need them to.

BACnet Basics: What are BIBBs? 

BACnet Basics: What are BIBBs? 

Every complex topic or field needs a helpful naming system. Scientists name flora and fauna by genus and species. Even astronomers have their own planetary nomenclature. Standard naming conventions do just that—they standardize how we talk about things. They’re also a convenient way to condense large amounts of information into a short form. Hence, they function like acronyms. We needn’t sound out “self-contained underwater breathing apparatus” when we can simply utter S.C.U.B.A. right?  

In building automation, the same need for standards and compression applies, and BACnet gives us a convenient way to describe the functionality of devices using something called BIBBs.  

What are BIBBs? 

Definition: BIBBs stands for “BACnet Interoperability Building Blocks” and is a standard naming convention for representing specific device capabilities using simple acronyms. That is, it creates simple categories to describe how one device works with another.    

Without short-form descriptions, listing all the capabilities and services that a device offers would turn functional descriptions into a messy scrawl of technical jargon. By condensing these functions into acronyms, BIBBs makes it easier for FMs, system integrators, and building engineers to talk about the same things. BIBBs help buyers get the minimum number of services for the job without over-engineering and spending for extraneous functionality. 

man holding smartphone with words automation

BIBB Categories  

The BIBB naming system starts with five broad categories that list interoperability functions. These are high level functions that host specific capabilities within them. Categories include: 

Data Sharing (DS) 

The data sharing function describes how devices exchange data. Data sharing is essential for reading and writing data from one device to another. For example. If you wanted to regularly check the water temp of your boiler to monitor its performance, you would need the DS functionality.   

Alarm & Event Management (AE) 

The alarm and event management functionality is for detecting and notifying alarms and events. For example, if your boiler temps exceeded a specified setpoint, the AE function would allow you to receive an alert.  

Scheduling (SCHED) 

The scheduling functionality is for scheduling values based on date, time, and calendar. For example, if you wanted to schedule your boiler to provide after-hours heating for tenants.  

Trending (T) 

The trending functionality is for trend logging and historical data support. For example, if you wanted to store your boiler’s temp data to create a history for your engineer.  

Device Management/Network Management (DM/NM) 

The DM/NM is for setting up device and network management. It allows devices to discover each other, to synchronize clocks, and to reset a device to factory settings (reinitialize). For example, if you wanted to discover a newly installed boiler temp sensor.  

Specific Capabilities 

Specific capabilities, or sometimes called services, are distinct functions that exist within a BIBBs category. Capabilities also have acronyms. For example, the Read Property (RP) service is under the data sharing (DS) category. The service must exist for data sharing to occur. That is, a device (e.g., controller) must be able to read data, while another device (e.g., thermostat) must be able to send it. Many devices have both capabilities. Here are some examples of services for different BIBBs categories: 

Data Sharing (DS) 

  • Read Property Multiple (RPM) 
  • Write Property (WP) 
  • Change of Value (COV) 

Alarm & Event Management (AE) 

  • Notification (N) 
  • Alarm Summary (ASUM) 
  • View Notifications (VN) 

Device and Network Management 

  • Dynamic Device Binding (DDB) 
  • Text Message (TM) 
  • Reinitialize Device (RD) 

Find a more extensive list of device capabilities here

Clients and Servers 

BIBBs also distinguishes between clients and servers, assigning and A and B category to each respectively. Client devices (A) can initiate or call for data or service from a device that can respond to that request (B). An example of this would be a controller (A) requesting temp data from a thermostat (B), which responds with the requested data. You can remember this order by recalling that the letter “A” comes before “B” in the alphabet, just as a request must precede a response.  

Putting It All Together 

Now that we have all three parts of BIBBs, let’s look at a full interoperability description. The BIBBs naming syntax places the category first, specific capability second, and server/client designation third. Each acronym is separated by a dash. Consider a BACnet controller that has data sharing (DS), a read property service (RP), and client capability (A). It would be designated as DS-RP-A. Can you guess what functionality a thermostat would require to send temp data back to the controller? If you answered DS-RP-B, you’re correct!   

Conclusion 

As we’ve seen, BIBBs are the “building blocks” of the standardized system of naming devices and their interoperability functions. Devices can have many different functions, so there’s also a need to group them. For example, controllers, sensors, and actuators must all have a minimum number of specific functions to work. These groups of functions are called BACnet device profiles. Like BIBBs acronyms, profiles give us a shorthand way of quickly designating and describing a device. Read BACnet Basics: What are Device Profiles? to learn more or visit The BACnet Institute for free training.  

Effective Cybersecurity Habits for Your BAS 

Effective Cybersecurity Habits for Your BAS 

Properties need effective cybersecurity measures. Cybercriminals don’t just attack high profile companies and governments; they target small to medium businesses too. Computer viruses range from annoying adware infiltrating your browser to costly ransomware attacks. In 2021 the world saw a 105% jump in ransomware attacks. Healthcare alone saw a 755% increase! Businesses are paying out billions each year to save their proprietary and/or customer data—and paying only makes things worse. 

The sharp rise in ransomware has forced building owners to take a serious look at their IT infrastructure. This is alongside adapting to the challenges of the pandemic and managing a remote workforce. Interestingly, some security experts point to remote work as one cause for the increase in ransomware. Since employees are no longer behind corporate firewalls, their home-based laptops and mobile devices become “attack vectors” for gaining entry to company networks.  

Remote entry points are also an issue for building control systems. As buildings become more connected and “smart”, the threat of data breaches increases. That’s because system integration, IoT devices, and building automation systems (BAS) increase connectivity and wireless operation. It’s a problem the U.S. government has known about since 2015 after the GAO warned of a 74% jump in cyber incidents involving government-owned industrial control systems.  

Building control systems like BAS/BMS connect hundreds of devices and sensors that make up systems like fire, access, HVAC, electrical, and lift. Connectivity makes it easier for cybercriminals to make their way to more sensitive data because there are more paths to follow. Wireless and IoT devices make networks vulnerable to remote Wi-Fi exploits and password hacks. These potential data breaches and financial losses from malware are why property teams need to practice effective cybersecurity habits.   

hands grabbing different pieces of a pie

Setup Multiple User Accounts 

One good security habit to adopt is proper account creation and assignment to your team. To save time and hassle, some building managers create and share one master admin account amount their team members.  It’s tempting when someone needs to make a few quick changes to simply email your login and password. However, this puts your BAS at risk of cyberattack if those credentials are misplaced or abused. To be cyber safe, create both admin and user level accounts and assign them to each employee. 

Almost all BAS software lets you create multiple accounts and at various levels of access. Individual account creation does three key things:  

  1. It ensures inexperienced members aren’t given access to critical controls.
  2. It makes sure user actions are recorded by the system.
  3. It helps users work more effectively.

Modern BAS systems track what users do, which is helpful when things in the system are improperly changed. If everyone signs into the system with the same account, then you can’t tell who did what and when. This can slow down repairs and troubleshooting because you must rely on faulty human memory instead of an accurate digital record. Also, when inexperienced or new users sign into an admin account, they may spend an inordinate about of time searching for the tool or feature they need. User-level account interfaces are simplified for this reason. Too many options can tank productivity by forcing workers to waste time navigating a complex interface looking for a single item.  

hand pressing username and password fields

Password Creation 

Creating strong passwords is one of the most impactful cybersecurity habits you can adopt. Too often folks continue to use highly predictable pass codes (e.g., “123455” or “Qwerty”) to secure their most sensitive data. What’s worse, most of us also use these same flimsy passwords for all our accounts. It’s behavior that’s too predictable, and predictability is the Achille’s Hill of security.  

Make sure your team knows password best practices. When it comes to password creation, length and complexity matter. Passwords should be at least 8 characters long, include special characters (e.g., @!&), and numbers. The longer the password the better; however, there’s a limit to how many characters a person can hold in long term memory. To combat the memorization problem, use passcodes instead.  

Passcodes are acronyms made from random words or long sentences. To create a passcode, use the first letter of each word to form your password. For example: “My cat whiskers is 3 years old and likes to have her belly rubbed.” This sentence (which is personal and easy to remember) becomes the password: “mcwi3yoalthhbr”. Then, swap out a few special characters, and you’re good to go.  

If passcodes seem too complex, make your life 100% easier by simply using a password manager. These cloud-based apps create and store complex passwords in the cloud for you. They will even fill in the form fields for you, saving you valuable time. Most apps have free or inexpensive annual plans, so investment is minimized, while time savings and security are maximized.  

cyberthief using a phishing email attack

Suspicious Link Detection 

A building’s devices aren’t its only weak spots. In fact, occupants are often the major sources of malware. Cybercriminals can use social engineering to trick employees into opening phishing emails and navigating to fake websites. The tactic is called a “pharming attack” and is a common way for hackers to steal an employee’s username and password. The fake website looks and feels like the authentic one, but it’s a duplicate. Employees unwittingly enter their username and password, which is recorded and used to gain entry to the account.  

Hackers design phishing emails and fake websites to look like official corporate digital assets, often using the same branding, logos, language, etc. Most are convincing enough to fool an employee who’s under a bit of stress and/or not paying attention. However, there are a few tell-tale signs to look for:   

  • Salesy Language. Cybercriminals often employ high-pressure sales language or scare tactics. Phishing emails may claim “suspicious activity” or fake “charges” to user accounts to entice holders to hastily move to fix “issues” without first confirming the source of the emails.   
  • Grammar mistakes. Often cybercriminals don’t speak your native language, so look for any grammar mistakes or misspellings. These are extremely rare in authentic corporate emails and are a sure sign of a fake.  
  • Pixelated logos. Hackers use official logos to trick email recipients, but often these logos are hastily copied and pasted from websites and may be incorrectly sized resulting in pixelated or strange looking images. 
  • Strange URLs. URLs have two parts: the hypertext (e.g., “Contact Us”) and the address (e.g., https://7nox.com/). Never trust the hypertext to tell you where the link goes. Always check the URL address. To do this, hover your cursor over the text without clicking and read the URL displayed in the bottom left corner of your browser. The URL should contain the company’s address. If it’s simply a long string or strange characters, it may be a pharming attack.    

BAS Backups 

Make sure your BMS provider backs up your BAS/BMS system on a regular basis. Backups keep your system secure against ransomware attacks, which rely on businesses not having copies of their data. Plus, system backups ensure redundancies when your system goes down or when you shut your building down for changes. If controller settings aren’t “persistent” they may not be saved during a reboot of your BMS. It’s critical that you have backups to ensure these changes are saved.     

Conclusion 

While building automation and connectivity brings many wonderful things to the built environment, they do require owners and managers to make their IT and OT more resilient. However, without proper training of staff, these technical efforts may prove fruitless. In cybersecurity, humans are often the weakest link. That’s why cybersecurity shouldn’t be simply a training box to tick at the end of the year. It should be an ongoing attitude and effort by all employees. Focus your training on seasoned staff, who may be laxer in their habits, and on newcomers who may have few habits at all. 

Hands-Free Building Tech You Probably Didn’t Know Existed

Hands-Free Building Tech You Probably Didn’t Know Existed

In a post-COVID workplace, “hands-free” is the new buzz world. It’s also the new hygiene standard. At times, it may seem the pandemic has turned everyone into Adrian Monk. But you needn’t be an OCD-suffering detective to solve the mystery of the old hygiene standard; it’s dead—murdered by Delta and Omicron. However, its demise makes way for a new standard, one built with hands-free building tech. 

Touchless interfaces, voice command, facial recognition systems are uber-popular among both employees and managers. Some hands-free devices are smart home gadgets carried to the office by new hybrid workers looking to introduce a little domestic convenience. But other employees simply want safer, more hygienic work and communal spaces. 

Tech companies are speeding up their response to the touchless standard by leveraging existing tech: smartphones. Every worker already carries a small, powerful computer connected to the internet in their pocket, so why not start there. The shortcut is producing a variety of apps that give workers and managers hands-free control of lighting, elevator access and after-hours air con bookings. The touchless workplace is a safe bet for property owners looking to invest in tech that boosts their property values and occupancy retention.  

Access Via Facial Recognition

Facial recognition is a growing tech in facilities access because it provides better safety and a keyless, touchless entry point. Cameras with specialised facial recognition software scan a person’s face to identify them before granting entry. Users simply look at the scanner, are identified, and the system unlocks the doors. While hardly a viable solution for high traffic areas, facial recognition systems do ensure touchless entry points for visitors and better safety for building occupants.  

Smart Elevator Apps

Today, “calling” the elevator is no longer a metaphor. Some major lift manufacturers like Otis and Schindler now have apps that let you summon an elevator with your smartphone. Users can use the apps themselves to ask for life service or they can scan a QR code to let the elevator know what floor they’re on. Smart elevator apps are time sizers too. Riders can request the lift as they approach, select their destination, then arrive just as the elevator does. No buttons to press or physical contact to make means a more sanitary ride.  

Touchless Audio/Visual Setups

The conference room is full of commonly touched surfaces swimming with bacteria. However, voice activated AV equipment and video launching apps are keeping the presentation room touchless. Companies like Crestron are making touchless AV wireless, letting you manage all your AV equipment and room scheduling one a single app on your smartphone. Imagine having an app to control your presentation equipment. Being able to set custom specifications, including your lighting preferences, blind levels, and audio volume all with one touch of your own smartphone.  

man using smartphone to scan access to building

Touchless Reception

Hands-free entry tech like automatic sliding and swinging doors are hardly new, but new “touchless” tech for reception are evolving to limit the time visitors are spending in reception. Reducing the number of people in reception reduces the risk of virus transmission.   

Rather than performing traditional check-ins, visitors can send instant text messages, voice calls and emails to authenticate their credentials and notify hosts. Once inside, other touchless access points can be granted by reading smartphone data via Wi-Fi. Elevators may be sent, doors opened automatically, areas of the building opened all without the visitors needing to touch handles or screens. Such automated access systems can also perform other duties like contact tracing or administering health questionnaires. 

Voice-Activated Lighting

Today’s modern commercial lighting solutions offer hands-free tech features like voice command and app operation to expand control over workspace illumination. Some lighting tech has replaced the traditional light switch with a motion sensor that activates with the wave of a user’s hand. Others control lighting with voice commands powered by popular voice assistants like Alexa, Siri or Google. 

Other hands-free light switches have Wi-Fi so workers can turn off lights left on or turn them on before entering the building. Smartphone control also means the ability to schedule lighting at regular intervals or for specific events. Voice activation, motion sensor and smart app lighting controls give workers more choices while eliminating the need for physical contact.