Smart lighting security

Smart lighting systems create great opportunity for improved efficiency, cost savings and easy management. The long lifespan and low power requirement of LED luminaires and lamps means that it’s worth investing in replacing older fluorescent and incandescent lighting.

RJ45 connections delivering Power over Ethernet are becoming prevalent in light fittings, a result of the lower power demands from LED fittings. This creates potential for uninformed installers to inadvertently bridge network security controls through connecting the light fittings to existing networking equipment. We have seen this happen in office environment during lighting upgrades. In one case, the lighting installer had unintentionally bridged the segregation between guest Wi-Fi and the core business network!

Good security training for installers is critical, as is strong cyber security oversight during the design and installation phase. Smart lighting manufacturers often address cyber security in their products, but fail to educate their installer networks in good, secure installation and configuration of the system.

Cyber security has often been considered a ‘nice to have’ in the smart product market, rather than a ‘must have’. Too often, security is only considered at the very last stage of product development, or not considered at all until a researcher discovers vulnerabilities in products. It is critical that manufacturers ‘bake in’ security early on in the development lifecycle, to avoid expensive last-minute product re-engineering or even recalls.

Not doing security can be costly

Security need not be complex or expensive, but not doing security can be very costly; markets are increasingly regulating to prevent vulnerable smart products reaching end users. Indeed, the US federal government has already legislated to ban vulnerable smart products from being adopted by federal government and agencies. Standards such as ETSI 303 645 are a good start to doing security well.

Historically there has been a lack of security in lighting control protocols. Early version of KNX, Dali, Hue and many others did not feature any communication protocol security at all. This meant that a compromise of the network led to complete control of the lighting system. Conversely, if the lighting network was not adequately segregated from the business network, a new vulnerability was created that may allow a hacker remote access to your network via the lighting system.

If the ability to remotely update lighting has not been built in from the start, the security of the system will quickly ‘age’ as new vulnerabilities are found and updates are not applied. Over The Air (OTA) updates are critical to future security of any lighting system, but having to update firmware on each luminaire locally could be very costly if not possible remotely.

Radio protocols can also lead to compromise if not done securely; Bluetooth Classic, BLE, Z-Wave and many other protocols can be exploited if not configured correctly.

Remote control and updating of many lighting systems will involve use of a cloud platform. These often have very variable security; over recent years we have found numerous critical security flaws  in IoT cloud platforms, often allowing complete compromise of all the systems and data that they control. In some cases, we have found cloud platforms that allow further, remote compromise of the organisation the smart lighting systems were installed in.

Recommendations

Office tenants and building management firms

If you already have smart lighting installed, have you verified its security and isolation from your core networks?

Have you checked if the installer or maintenance organisation has remote access to the lighting system?

If you’re planning to install smart lighting, carry out good security due diligence over any proposed supplier. What evidence can they provide that they actually understand security and are able to prove that the installation is secure.

Installers, specifiers and architects

Make sure your engineers know not to connect the lighting system (luminaires or controllers) to any other devices on the customer network without express permission.

Enable all device security options, ensure your customer knows how to update the system and teach good password hygiene to your engineers.

If you do need to create high privilege accounts for remote support, be clear and open with your customer about this and ensure that strong passwords are used per site.

Manufacturers

Ensure that your smart lighting system is secure, complying with for example ETSI 303 645.

Include basic security controls as part of your installer accreditation process. Give installers a simple ‘cheat sheet’ of minimum required standards that they can follow as part of a commissioning process.

Prepare supporting materials that demonstrate the security of your offering, so that installers and customers can make informed choices.