行业观点：智慧建筑OT网络安全应纳入楼宇自控设计规格文件

The specifying engineer’s role in secure smart buildings 规格编制工程师在安全智能建筑中的作用

October is Cybersecurity Awareness Month, and I’d like to bring the conversation into the design development meeting in the consulting engineer’s office. 十月是网络安全意识月，我想把讨论引入顾问工程师办公室的设计深化会议。

When we specify a building automation system, we spend a lot of time on sequences of operation, equipment performance, graphics, and interoperability. Those details matter, but we should give the same attention to how people (operators, vendors, etc.) and applications will access that system once it is connected. 在编制楼宇自动化系统规格时，我们会在运行顺序、设备性能、图形和互操作性上投入大量时间。这些细节很重要，但系统联网后，对于人员（操作员、供应商等）和应用程序将如何访问该系统，我们也应给予同等重视。

Things such as… Who can log in? What can they reach? Who approves a contractor’s access? And who removes that access when the work is finished? 例如……谁可以登录？他们可以访问哪些内容？谁批准承包商的访问权限？工作结束后谁移除该权限？

These are questions we can address while the project is still in the design development stage. 这些问题在项目仍处于设计深化阶段时就可以解决。

In my role at Cochrane Supply & Engineering, my focus includes helping the design community understand building IoT, integration, and OT cybersecurity. Through our website SmartBuildingDesign.com, we help connect those conversations to architecture and guide specifications engineers can use. 我在Cochrane Supply & Engineering的工作重点包括帮助设计界了解楼宇物联网、系统集成和OT网络安全。通过我们的网站SmartBuildingDesign.com，我们帮助将这些讨论与架构以及工程师可使用的指南性技术规格联系起来。

My message to specifying engineers is straight forward… Cybersecurity belongs in the design documents!! A clear and concise specification gives the project team something to price, implement, and verify. 我要向规格编制工程师传达的信息简单直接……网络安全应纳入设计文件！！清晰简明的规格让项目团队有可据以报价、实施和验证的依据。

Start with the people who will operate the building 从将运营建筑的人员开始

Before selecting platforms or writing cybersecurity requirements, it’s always best to bring the owner’s Facilities and IT teams into the conversation. Both parties should participate in these meetings jointly as a team, so that technologies can be vetted, and cyber security best practices can be implemented that are in alignment with the Owner’s IT department’s standards. 在选择平台或编写网络安全要求之前，最好先让业主的设施管理团队和IT团队参与讨论。双方应以团队身份共同参加这些会议，以便对技术进行审查，并实施符合业主IT部门标准的网络安全最佳实践。

Facilities need dependable operation and timely service. IT needs visibility into connected systems and control over access. The consulting engineer needs enough information from both to develop a workable design. 设施管理需要可靠的运行和及时的服务。IT部门需要对联网系统具备可见性，并对访问进行控制。顾问工程师需要从双方获得足够信息，以制定可行的设计。

I would start with a few practical questions. Which systems need to exchange data? Which contractors need remote access? Does the owner already have an approved remote access policy? Who will manage accounts, software updates, and backups after turnover? 我会从几个实际问题开始：哪些系统需要交换数据？哪些承包商需要远程访问？业主是否已有经批准的远程访问策略？移交后谁将管理账户、软件更新和备份？

Record those answers in the Owner’s Project Requirements. When responsibilities remain undefined, contractors are left to make assumptions, and the owner inherits the result. 将这些答案记录在业主项目需求中。当责任仍不明确时，承包商只能自行假设，而业主将承担相应后果。

This collaboration is what I call Cyber Harmony. It means the people designing, installing, protecting, and operating the building agree on how it should work. 这种协作就是我所说的“网络和谐”。它意味着设计、安装、保护和运营建筑的人员对建筑应如何运行达成一致。

Make the architecture visible 让架构清晰可见

Most engineers and systems integrators think in pictures! One of the most useful tools that an engineer can provide in clarifying the overall architecture is a systems integration drawing. 大多数工程师和系统集成商都借助图形思考！工程师可用来阐明整体架构的最有用工具之一，就是系统集成图。

The drawing should show the connected systems, integration platform, OT network, enterprise connections, cloud applications, and remote access paths. It should identify where data moves, where access is controlled, and who owns the major pieces. 该图应显示联网系统、集成平台、OT网络、企业连接、云应用程序和远程访问路径，并标明数据在何处流动、访问在何处受控，以及各主要部分的归属方。

For example, if a cloud application needs meter data, show the approved path for that information. If a controls contractor needs to service the Niagara supervisor, show how that connection will be authorized and controlled. 例如，如果云应用程序需要表计数据，就应显示该信息的获批路径。如果控制承包商需要检修Niagara Supervisor，就应显示该连接将如何获得授权和管控。

Document read access and command access separately. An application that displays equipment data has different permissions from one that changes setpoints. 分别以文档说明读取访问和命令访问。显示设备数据的应用程序与更改设定值的应用程序具有不同的权限。

The drawing and specification should support each other. The drawing explains the architecture; the specification establishes the requirements for delivering it. Together, they give the engineer, owner, IT team, and integrator a common reference. 图纸与规格书应相互支撑。图纸说明架构；规格书规定交付该架构的要求。二者共同为工程师、业主、IT 团队和集成商提供共同参照。

Turn Zero Trust into practical requirements 将零信任转化为可落地的要求

Zero Trust can sound intimidating until we apply it to a familiar service call. 零信任听起来可能令人生畏，直到我们把它应用到一次熟悉的上门服务中。

A technician needs to troubleshoot an air handler. We should be able to verify the technician’s identity, authorize access to the equipment needed for the job, and record the access activity. That permission should be reviewed or removed when it is no longer needed. 技术人员需要对空气处理机组进行故障排查。我们应能够验证技术人员的身份，授权其访问工作所需的设备，并记录访问活动。当不再需要该权限时，应对其进行审查或删除。

NIST’s Zero Trust guidance explains that trust should not be granted simply because a user or device is inside a network or belongs to the organization. Authentication and authorization must govern access to resources. NIST 的零信任指南说明，不应仅因用户或设备位于网络内部或属于该组织就授予信任。身份验证和授权必须管控对资源的访问。

For the consulting engineer, that translates into requirements such as individual user accounts, multifactor authentication for remote users, permissions based on job responsibilities, and defined procedures for granting and revoking access. 对咨询工程师而言，这转化为若干要求，例如个人用户账户、远程用户多因素身份验证、基于岗位职责的权限，以及明确的访问授予与撤销流程。

It also means specifying controlled communication between systems and making access records available to the owner. 这还意味着规定系统之间的受控通信，并让业主能够获取访问记录。

Existing buildings require practical judgment. Some legacy controllers cannot support modern identity or encryption capabilities directly. The design must account for that limitation through appropriate gateways, segmentation, and access controls. Remote access is a useful place to begin applying Zero Trust, with the broader architecture addressing application and device access as well. The engineer should familiarize themselves with easy to specify platforms for zero trust remote access if the tools are not already in place and it is your responsibility to include remote access in your design documents. 既有建筑需要结合实际进行判断。一些传统控制器无法直接支持现代身份认证或加密能力。设计必须通过适当的网关、网络分段和访问控制来应对这一限制。远程访问是开始应用零信任的良好切入点，更广泛的架构也应处理应用程序和设备访问问题。如果相关工具尚未到位，工程师应熟悉易于规定的零信任远程访问平台，而且你有责任将远程访问纳入设计文件。

Design the Secure by Design OT Stack 设计安全内建的 OT 技术栈

The Secure-by-Design OT Stack is a way to organize these decisions across the building’s technology architecture. Each layer has a job, and the interfaces between layers need the same attention as the products themselves. 安全内建的 OT 技术栈是在整个建筑技术架构中组织这些决策的一种方式。每一层各有职责，层间接口需要与产品本身同等重视。

The secure edge controls connections into and out of the OT environment. NEEVE is an example of a platform that supports Zero Trust remote access, role-based permissions, and auditing. The engineer should establish the required access behavior, deployment responsibilities, and owner acceptance criteria. 安全边缘负责控制进出 OT 环境的连接。NEEVE 是支持零信任远程访问、基于角色的权限和审计的平台示例。工程师应确立所需的访问行为、部署职责和业主验收标准。

The enterprise operating platform brings building information together for operators and portfolio teams. KODE Labs is an example of this layer. Specify the data it will receive, the applications it will support, and whether it is permitted to issue commands. Define ownership of the data and management of application credentials. 企业级运营平台为运营人员和资产组合团队整合建筑信息。KODE Labs 是该层的一个示例。明确其将接收的数据、将支持的应用程序，以及是否允许其下发命令。定义数据所有权和应用程序凭证的管理方式。

The open integration fabric connects systems and organizes their information. Tridium Niagara provides an example of this role. Engineers should define the required protocols, integrations, naming, tagging, and permissions so that openness supports an architecture the owner can understand and maintain. 开放集成架构连接各系统并整理其信息。Tridium Niagara 提供了这一角色的示例。工程师应定义所需的协议、集成、命名、标签和权限，使开放性支撑业主能够理解和维护的架构。

The hybrid OT network connects the field equipment, controllers, gateways, and supervisory systems using the appropriate wired and wireless infrastructure. Its design should establish system boundaries, permitted communication, device hardening, and support responsibilities. 混合OT网络利用适当的有线和无线基础设施连接现场设备、控制器、网关和监控系统。其设计应确立系统边界、允许的通信、设备加固以及支持职责。

Selecting these layers is the beginning. Their configuration, integration, and ongoing management determine how effectively the architecture protects the building. Engineers can use the stack to identify gaps and assign responsibility for closing them. 选择这些层级只是开始。它们的配置、集成和持续管理决定了该架构保护建筑的有效程度。工程师可以使用该堆栈识别缺口，并分配弥补缺口的职责。

Write requirements that can be delivered 编写可交付的需求

A sentence such as “provide a secure BAS” leaves the project team with too many unanswered questions. Give bidders requirements they can understand and include in their scope. 像“提供安全的BAS”这样的表述会给项目团队留下太多未解答的问题。应向投标人提供他们能够理解并可纳入其范围的需求。

At a minimum, I would want the specifications to address: 至少，我会要求规格说明涵盖：

An asset inventory and documented network architecture. 资产清单和已文档化的网络架构。
Approved remote access methods and account management. 经批准的远程访问方法和账户管理。
Removal of default credentials and unnecessary services. 移除默认凭据和不必要的服务。
Segmentation and permitted communication paths. 网络分段和允许的通信路径。
Responsibilities for updates, vulnerability response, and product support. 更新、漏洞响应和产品支持的职责。
Backup, restoration, logging, and turnover requirements. 备份、恢复、日志记录和移交要求。

Coordinate those requirements across the relevant sections of Divisions 23, 25, 27, and 28, with project-wide responsibilities established in Division 01 where appropriate. 在第23、25、27和28篇的相关章节中协调这些要求，并在适当情况下在第01篇中确立项目层面的责任。

Be clear about the controls contractor’s scope and the master systems integrator’s scope. For example, the controls contractor may install and program the BAS, while the integrator delivers specified integrations, tagging, and owner applications. The documents should identify who configures and verifies the security controls at their interfaces. 明确控制承包商与主系统集成商的工作范围。例如，控制承包商可安装和编程BAS，而集成商交付规定的集成、标签及业主应用程序。文件应确定由谁在接口处配置和验证安全控制措施。

Updates and testing also need to fit building operations. NIST’s OT security guidance recognizes the importance of performance, reliability, and safety. Define how changes will be evaluated, approved, and scheduled with the owner. 更新和测试也需要适应建筑运营。NIST的OT安全指南认可性能、可靠性和安全性的重要性。应规定如何与业主共同评估、批准和安排变更。

Commission what you specify 对你所规定的内容进行调试

As a commissioning authority, I want a requirement to lead to a demonstration. 作为调试负责人，我希望每项要求都能落实为一次演示。

If the specification requires limited contractor access, demonstrate that the contractor can reach the approved system and is blocked from reaching unauthorized systems. If access must expire, verify that it expires. Confirm that the owner can retrieve the required access records. 如果规范要求限制承包商访问，则需演示承包商能够访问已批准的系统，同时被阻止访问未授权系统。如果访问权限必须到期，则验证其确实到期。确认业主能够检索所需的访问记录。

Review the installed communication paths against the approved systems integration drawing. Demonstrate the agreed backup and restoration procedure in a way that protects operations. 根据已批准的系统集成图审查已安装的通信路径。以保护运营的方式演示商定的备份和恢复程序。

Then verify turnover. The owner should receive the asset inventory, current drawings, configuration records, account administration procedures, and a clear explanation of ongoing responsibilities. Credentials should be transferred through an approved secure process. 然后验证移交工作。业主应收到资产清单、最新图纸、配置记录、账户管理程序以及关于持续责任的明确说明。凭据应通过已批准的安全流程进行传输。

Cyber commissioning gives the owner evidence that the specified protections have been implemented. Ongoing operation must keep those protections current as users, software, and equipment change. 网络调试为业主提供规定保护措施已实施的证据。随着用户、软件和设备的变化，持续运营必须使这些保护措施保持最新。

Bring cybersecurity into your next design meeting 将网络安全纳入你的下一次设计会议

For engineers looking for a starting point, SmartBuildingDesign.com provides architecture resources and guide specifications to support these conversations. Use them as a foundation, then adapt the requirements to the owner and the project. 对于寻找起点的工程师，SmartBuildingDesign.com 提供架构资源和指南规范，以支持这些讨论。将其作为基础，然后根据业主和项目调整要求。

On your next project, ask the owner how remote access is managed. Bring Facilities and IT together before the architecture is finalized. Develop the systems integration drawing, put clear requirements in the specifications, and establish how the completed system will be verified. 在你的下一个项目中，询问业主远程访问是如何管理的。在架构最终确定之前，让设施部门与IT部门协同合作。绘制系统集成图，在规格说明中提出明确要求，并确定如何对完工系统进行验证。

Cybersecurity Awareness Month gives us a reason to raise the subject. Specifying engineers have an opportunity to carry it into the decisions that shape the building for years to come. 网络安全意识月让我们有理由提出这一议题。规格工程师有机会将其纳入那些将影响建筑未来多年的决策之中。

Your next set of drawings and specifications is a good place to start!! 你的下一套图纸和规格说明就是很好的起点！！