The Backdoor You Forgot You Had: Your Building Systems

What we talked about.

In this episode of the Sunny Ray Show, host Sunny Ray talks with Min Kyriannis of Amyna Systems about a cybersecurity blind spot that rarely gets attention: the systems that run buildings. Thermostats, elevators, surveillance cameras, and audio visual equipment are now connected to the network, and many were never built with security in mind. Kyriannis explains that much of this equipment is decades old, and that few owners can afford to rip it out and replace it. She describes how Amyna Systems builds a bridge between legacy protocols and modern networks, using hardware for existing devices and software for newer equipment. The conversation covers her background running a security operations center, the founding of the company with her husband, and her work co-founding the Global Cyber Consortium to get siloed industries talking. She also discusses why building owners tend to react only after an incident, the cost of complacency, the challenge of hiring the right people, and what it will take for adoption to grow. The episode closes with her thoughts on protecting families in a digital world.

Your elevators, thermostats, and cameras may be open doors into your network, and most of that gear is decades old.

The questions, and the answers.

What are you building at Amyna Systems, and what larger problem are you tackling?

Billions of connected devices sit on our networks, from building controls and thermostats to water treatment plants and manufacturing lines, and most were built without security. They were designed to make life more efficient, not safer. At Amyna Systems, we mitigate the risk those devices create, because the gap is huge and the threat landscape is enormous.

What specific gap did you keep running into?

Legacy building and SCADA protocols often can't talk to modern networks. Connect them carelessly and you can crash or saturate the network. We've been there. So we built technology that integrates both old and new, letting these devices keep communicating while we secure and protect them at the same time.

How do you bridge the gap between IT people and facilities people day to day?

It used to be much harder, since facilities folks carried the screwdrivers and wrenches. Now everything is on the network, so more IT people are moving into facilities. Many real estate developers I work with have teams that blend both worlds, with people cross-trained in IT and facilities. It's becoming more blended all the time.

Can you name a building system most people never think of as a security risk?

Elevators are my go-to example. There are safety controls in them, but if someone hacks in, they can lock the elevator up and hold it for ransom. They won't drop it, but you can't use it. Building management systems, video management, and audio visual systems carry similar risks. As an owner, what would you do then?

What did co-founding the Global Cyber Consortium teach you about getting an industry to move together?

Industries are very siloed. Public doesn't talk to private, and departments stay walled off. We brought together friends from real estate development and manufacturing to talk openly about challenges. The point isn't to fingerpoint. With critical building systems there is life safety at stake, so we need shared standards and need to come together.

Why not just replace the old equipment?

Manufacturers and owners all share this challenge: there isn't enough money in anyone's pocket to rip out and replace everything. Critical infrastructure is often 20 to 30 years old, and some of it is 40 to 50. So the real question is how to phase equipment and technology in so it stays protected along the way.

What is hardest to explain to a building owner about why this matters to their bottom line?

Reputational and financial risk. Owners aren't technologically savvy, and people don't know what they don't know. They tend to act only after something happens. One New York real estate developer had cyber insurance but lost $19 million from their bottom line because of negligence and lack of due diligence. Numbers like that get attention.

Where is the biggest blind spot in how the industry protects buildings today?

Complacency. Everyone asks why they should fix what isn't broken, even seasoned network and security people. Then it breaks, and they wonder why they didn't act sooner. People often do nothing until the last minute, and that is the challenge we face in every industry.