BACRank: Ranking Building Automation and Control System Components by Business Continuity Impact

Organizations increasingly depend on Building Automation and Control Systems (BACSs) to support their daily tasks and to comply with laws and regulations. However, BACSs are prone to disruptions caused by failures or active attacks. Given the role BACSs play in critical locations such as airports and hospitals, a comprehensive impact assessment methodology is required that estimates the effect of unavailable components in the system. In this paper, we present the foundations of the first impact assessment methodology for BACSs focused on business continuity. At the core of our methodology, we introduce a novel graph centrality measure called BACRank. We quantify the contribution of BACS components to different business activities. Moreover, we take functional dependencies among components into account to estimate indirect consequences throughout the infrastructure. We show the practical applicability of our approach on a real BACS deployed at a 5-story building hosting 375 employees on an international university campus. The experimental evaluation confirms that the proposed methodology successfully prioritizes the most relevant components of the system with respect to the business continuity perspective.