VITI Field Report Part 2: Converged Security and the BIGF Break-Glass Protocol

In traditional cybersecurity, companies and facility managers operate in isolated silos. Security vendors focus on network protection against malware, while facility managers concentrate on hardware maintenance to keep lights on. However, the recent supermarket freezer heat bomb attacks across Europe showcased the failure of these silos.

Erkki Laine, an Enterprise Automations Architect, proposes a solution called Converged Security through his Business Impact Governance Framework (BIGF), which bridges the gap between digital and physical worlds.

BIGF utilizes three architectural locks to ensure infrastructure is immune to physical destruction caused by digital means:

1. The Impact Matrix - This matrix links every digital command to its physical consequence. For example, if a hacker gains admin rights and executes a command, BIGF will evaluate if the command will melt 50 freezers, causing €100,000 in damages. If yes, the framework classifies it as a high-impact anomaly and demands cryptographic multi-factor authorization, overriding the compromised admin rights.

2. Zero-Meeting Isolation - During the freezer attacks, no one reacted promptly due to human operators being asleep and manipulated alarms being silent. BIGF monitors the system at the code level in milliseconds. If an anomaly is detected (e.g., unnatural temperature rise while alarms are suppressed), BIGF immediately severs the controller's network connection and locks physical hardware into a Safe State.

This forces cooling compressors to operate on maximum defaults, preserving inventory without relying on human intervention or crisis meetings.

3. The Physical Break-Glass Protocol - This protocol allows a human physically present at the site to "break the glass" if a hacker completely hijacks the digital control panel. By injecting a cryptographic key into the hardware, this action instantly drops all remote access and internet integrations, reverting the hardware to local, manually verified control. This ensures business continuity and maintains the cold chain even if the digital world outside is compromised.

The VITI Science Verdict emphasizes that traditional cybersecurity aims to prevent breaches, which is ultimately ineffective. BIGF ensures that even when a breach occurs, the attacker cannot cause physical or financial destruction due to the hard-coded laws of physics protecting the business. To explore Converged Security and the BIGF framework, visit Erkki Laine's Zenodo and GitHub profiles by searching for "big framework erkki laine."