Issue link: https://www.e-digitaleditions.com/i/1472963
32 I ICT TODAY 32 I ICT TODAY ISO/IEC 15408 This standard addresses protection of assets from unauthorized disclosure, modification, or loss of use. The categories of protection relating to these three types of failure of security are commonly called confidentiality, integrity, and availability. ISO/IEC 27001 This security standard formally specifies an information security management system (ISMS) that is intended to bring information security under explicit management control. As a formal specification, it covers requirements that define how to implement, monitor, maintain, and continually improve the ISMS. PD ISO/IEC TS 27100 ISO/IEC 27100 provides requirements for an ISMS. The focus of ISO/IEC 27100 is on security of information and associated risks within environments, predominantly under the control of a particular organization. Cyber- security focuses on the risks in cyberspace, an intercon- nected digital environment that can extend across organizational boundaries and in which entities share information, interact digitally, and have responsibility to respond to cybersecurity incidents. CYBERSECURIT Y One challenge with smart/intelligent buildings is the shear amount of data that is being generated from the convergence of all of these networked/connected systems, subsystems, and IoT devices. Cabling is used to transfer data and to power devices through PoE. This increase in the movement of data and PoE exposes the system to various vulnerabilities, including cyberattacks. In a tradi- tional building with silos of systems that were not inter- connected, the potential of losing the entire system to a cyberattack was far less critical than it is today. With the increase of cyberattacks worldwide, it is more important than ever to protect both data and systems. Working within the world of codes and standards, it can be overwhelming to find the best practices for the protection of data and systems when designing a smart/ intelligent building. However, a good place to start is by doing a risk assessment. The NIST developed a document called NISTIR 8286 Integrating Cybersecurity and Enterprise Risk Management (ERM), which provides an overall view of cybersecurity risk management. The abstract from this document reads as follows: "The increasing frequency, creativity, and severity of cybersecurity attacks means that all enterprises should ensure that cybersecurity risk is receiving appropriate attention within their enterprise risk management (ERM) programs. This document is intended to help individual organizations within an enterprise improve their cyber- security risk information, which they provide as inputs to their enterprise's ERM processes through communica- tions and risk information sharing. One challenge with smart/ intelligent buildings is the shear amount of data that is being generated from the convergence of all of these networked/connected systems, subsystems, and IoT devices.