Securing the Future of Smart Buildings with Cybersecurity Skills
As buildings become increasingly integrated with advanced control technologies, cybersecurity concerns have risen significantly. This is particularly true for networked lighting systems, as cybersecurity has become more important due to their growing integration with IP networks and other building IT and operational technology (OT) systems. Historically, electricians have focused on physical and electrical installations, occasionally handling system commissioning. However, the advent of networked control systems in modern buildings requires electricians to acquire a new skill set. These systems, often deployed with default configurations, can be vulnerable to unauthorized access and cyberattacks, posing significant security risks to the entire building.
In response to these emerging challenges, the UC Davis California Lighting Technology Center (CLTC) developed the Western Electrical Cybersecurity Apprenticeship Training (WECAT) Program with support from a U.S. Department of Labor workforce development grant that aims to expand and create apprenticeships that impart critical skills in emerging fields such as cybersecurity, artificial intelligence and advanced manufacturing—industries that are rapidly transforming the workforce.
The WECAT program is designed to equip apprentice electricians in California and Nevada with the skills necessary to secure networked lighting and other building systems against cyber threats. Electricians are trained to not only install and commission these systems but also understand and mitigate the cybersecurity risks associated with them, ensuring both the physical and digital safety of modern infrastructure. As lighting systems become more integral to smart buildings, securing these systems will be a critical aspect of the electrician’s role.
The WECAT Program was developed in partnership with the U.S. Department of Labor, International Brotherhood of Electrical Workers (IBEW), Labor Management Cooperation Committee and The Bit Bazaar and is part of a larger five-year electrical apprenticeship offered by IBEW through its Joint Apprenticeship Training Committees (JATCs). The overarching electrical apprenticeship program includes 8,000 hours of on-the-job training and 900 hours of theory and hands-on classroom instruction. Within this framework, the WECAT Program offers three courses:
- Cybersecurity for Electricians
- California Advanced Lighting Control Training Program
- Smart Building Energy Management Strategies.
Together, these courses provide 50 hours of classroom learning and 50 hours of hands-on lab training. Each course emphasizes cybersecurity principles as they relate to the systems being installed, ensuring that apprentices are equipped to handle both the electrical and cybersecurity challenges of modern, interconnected building infrastructures.
The WECAT curriculum helps to expand the IBEW electrical apprenticeship program by addressing the increasing cybersecurity demands in the electrical field. By providing targeted training, the WECAT Program prepares electricians to work securely in an environment that is becoming increasingly susceptible to cyber threats.
Networked lighting control systems offer building operators greater flexibility, efficiency and control. With the ability to remotely monitor, adjust and program lighting systems over the Internet, features like real-time adjustments, scheduled programming, energy-saving strategies (such as daylight harvesting) and performance management are now highly desirable and achievable in modern building management.
Today, electricians are often expected to take on system commissioning tasks, which may include ensuring communication between lighting fixtures and a centralized hub, programming schedules, adjusting dimming levels and configuring energy-saving features. As lighting control systems integrate more deeply into larger IP networks—typically via a central control hub—the associated cybersecurity risks increase.
A typical network architecture for lighting controls often involves a star topology, where each lighting device communicates with a central hub through proprietary or open-source non-IP protocols (Figure 1). This hub then connects to the building’s IP network via Ethernet or Wi-Fi, enabling Internet-based control. While this architecture offers significant operational benefits, it also opens potential security vulnerabilities.
One common example is the initial setup process, during which the hub broadcasts an open Wi-Fi network, allowing installers to connect and configure network settings. This phase is a critical point of vulnerability, as the unsecured network can be accessed by anyone within range. Without a proper understanding of these risks, an installer may leave the system exposed, allowing unauthorized users to exploit the connection and potentially compromise the building’s entire IT infrastructure. Other risks can arise from improper configuration, such as connecting the hub directly to a network switch without configuring access controls or security protocols, which could further expose the system to cyber threats.
Given these challenges, electricians need to be trained not only in electrical safety and fire-hazard mitigation but also in recognizing and addressing cybersecurity risks. The ability to secure networked lighting systems during the commissioning process—by recognizing vulnerabilities, properly configuring network settings and ensuring the hub is protected—is just as important as the physical installation itself. Failing to address these cybersecurity concerns can turn a lighting control system into a potential entry point for cyberattacks.
The WECAT Cybersecurity for Electricians course provides apprentice electricians with critical skills in networking and cybersecurity that are directly related to their work as electrical installers, especially in the context of smart buildings. Through a combination of lectures and hands-on labs, the course teaches the fundamentals of cybersecurity and how to apply them to both personal devices and professional building systems. Apprentices learn methods for configuring network devices, using common network testing tools to evaluate configurations and identifying security vulnerabilities in systems with which they work. By the end of the course, they will be able to identify and assess cybersecurity risks across networked OT, IT and physical access control systems and implement essential cybersecurity hardening measures on both endpoint and networking devices. Upon completion, students receive the WECAT-issued Cyber-Electrical Training Certification.
The course is structured into four 2-hour lecture modules and four 2-hour hands-on labs, for a total of 16 hours of in-class time. The lecture modules introduce the key concepts of networking and cybersecurity, contextualized within the work that electricians perform daily. These lectures include an introduction to smart cities, networking fundamentals, cybersecurity basics and a final module that ties these concepts directly to the role of electricians. Through this format, apprentices gain both theoretical and practical knowledge in securing networked building systems.
In the hands-on lab sessions, apprentices work through real-world scenarios to apply their cybersecurity knowledge (Figure 2). The first lab focuses on auditing and configuring the security settings of computers used for commissioning building control systems, including setting up firewall protections and utilizing network tools like Command Prompt and Nmap. The second lab takes the electricians through the process of identifying and verifying networked devices, ensuring their authenticity and security before installation. This includes verifying devices using serial numbers, MAC addresses, FCC IDs and other identifiers.
In the third lab, participants dive into endpoint hardening, a crucial step in securing individual devices before they are introduced to a network. Apprentices are tasked with applying security measures to devices such as building controllers, smart energy meters and lighting hubs. These measures include changing default login credentials, disabling unnecessary services and ports and configuring network parameters to minimize exposure to potential threats. The goal is to establish a baseline level of security for each endpoint before it connects to the broader network. The process of endpoint hardening is foundational to prevent external threats from compromising building control systems.
The fourth lab focuses on network hardening, where apprentices take the skills learned in earlier labs and apply them to the building’s entire network infrastructure. Here, participants learn how to integrate and secure multiple devices within a single, cohesive network. This includes implementing network segmentation, which limits the spread of potential threats by dividing the network into smaller, isolated sections (subnets). Additionally, electricians set up access control lists and configure firewall policies to safeguard the building’s systems from unauthorized access.
Throughout labs three and four in the Securing Building Networks course, the students securely establish a comprehensive network of building controls to illustrate how the lighting system is part of a larger, interconnected building network (Figure 3). This course emphasizes that electricians must understand the critical role the lighting system plays within the overall IP infrastructure of the building. In modern buildings, IT and OT systems are converging more and more, making it crucial to understand how all building systems interconnect. Various building control systems—such as HVAC, automated windows and skylights, water heating and plug loads—are part of this integrated infrastructure, and securing just the lighting system is only part of the job. Understanding how these systems interact is key to ensuring the security of the entire building network. This broader understanding of how the lighting system is integrated into the greater building network is crucial for safeguarding all the building’s critical systems against cyber threats.
By the end of the course, electricians have enhanced technical capabilities and are equipped to handle the various challenges in connected buildings. They are trained to secure both the devices and the network infrastructure, ensuring the systems they install are resilient against cyber threats.
The WECAT Cybersecurity for Electricians course is currently being taught by 14 participating JATCs throughout California and Nevada. With the development and deployment of over 90 custom training boards (Figure 2) distributed among these centers, the program is capable of training up to 270 students at a time. Since the launch of the WECAT Program in March 2023, 633 electrical apprentices have taken WECAT training courses with another 150 expected to receive certificates by the end of 2024.
As smart buildings and integrated networks continue to evolve, electricians equipped with both electrical and cybersecurity skills will play a vital role in protecting these systems and maintaining the resilience of critical infrastructure. The WECAT program is paving the way for a new generation of electricians who can meet these demands head-on and contribute to a safer, more secure future.
Learn more about the WECAT Program at https://wecatprogram.org/ (opens in a new tab).
This workforce product was funded by a grant awarded by the U.S. Department of Labor’s Employment and Training Administration. The product was created by the grantee and does not necessarily reflect the official position of the U.S. Department of Labor. The U.S. Department of Labor makes no guarantees, warranties or assurances of any kind, express or implied, with respect to such information, including any information on linked sites and including, but not limited to, accuracy of the information or its completeness, timeliness, usefulness, adequacy, continued availability or ownership. This product is copyrighted by the institution that created it.
THE AUTHOR |
Andrew Harper, PE, is an R&D IV engineer at CLTC. His work focuses on commercial daylighting technologies, integrated building control systems and cybersecurity training development.
Jae Yong Suk, Ph.D., is the faculty co-director of the CLTC and associate professor in the Department of Design at UC Davis. He supervises and enhances the ongoing research, education and demonstration activities at CLTC.