# Extending Ifc for IT Security

**URL:** <https://forums.buildingsmart.org/t/extending-ifc-for-it-security/2183>\
**Category:** Developers\
**Tags:** ifc4, ifc5\
**Created:** [December 20, 2019, 5:10pm UTC](https://forums.buildingsmart.org/t/extending-ifc-for-it-security/2183 "2019-12-20T17:10:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![WonderIf](https://avatars.discourse-cdn.com/v4/letter/w/e0b2c6/32.png) [@WonderIf](https://forums.buildingsmart.org/u/WonderIf)\
**Post date:** [December 20, 2019, 5:10pm UTC](https://forums.buildingsmart.org/t/extending-ifc-for-it-security/2183/1 "2019-12-20T17:10:24Z")

</div>

Hi,  
I would like to express some IT security facts about building  
automation devices.

My conclusion so far is that there is little work done in relation with It security.

Thus I have to extend some IFC schemas ( IFCs 4 ? / BAMie subset ?) and/or define  
new Psets in order to be able to model these facts.

The facts could be device related, helping to answer questions  
such as

- “Does this device possess some identifiable firmware” ?
- “Is the firmware associated to a device upgradable ?”,
- “Is the device intended to contains some GDPR regulated data”,

Facts may also be more general, helping for example to answer to  
“Does the device maker and/or the contractor owns a dedicated  
communication channel for vulnerability disclosures related to the device” ?

My question is : would it be sufficient to express these properties  
as Psets or will it be required to extend the step schema ?

Regards,

J.-M.

---

<div class="post-metadata">

**Author:** ![ReD\_CoDE](https://sea2.discourse-cdn.com/flex016/user_avatar/forums.buildingsmart.org/red_code/32/226_2.png) [@ReD\_CoDE](https://forums.buildingsmart.org/u/ReD_CoDE)\
**Post date:** [December 21, 2019, 8:15am UTC](https://forums.buildingsmart.org/t/extending-ifc-for-it-security/2183/2 "2019-12-21T08:15:03Z")

</div>

I think first of all you should find which “standards” and “protocols” are good enough?

If there is not standard and/or protocol then you have to have some home-made ones

And I think it would be good you develop them based on IDM/MVD approach and in the near future bSI accepts them and adds them to schema

---

<div class="post-metadata">

**Author:** ![WonderIf](https://avatars.discourse-cdn.com/v4/letter/w/e0b2c6/32.png) [@WonderIf](https://forums.buildingsmart.org/u/WonderIf)\
**Post date:** [December 23, 2019, 2:18pm UTC](https://forums.buildingsmart.org/t/extending-ifc-for-it-security/2183/3 "2019-12-23T14:18:43Z")

</div>

Thanks for your answer.

Maybe used a bad section for my question as I do not want to extend the ifc standard itself.  
What’s I’m looking for is a way to express the security properties while staying in the ifc4 frame.

I’ll have a look to the IDM/MVD approach …