How secure are IT systems in manufacturing companies?

Industrial automation and control systems are vital in the modern manufacturing industry, whether they are physical automated assets or enterprise management systems. Regardless of their role in manufacturing plants, one thing remains the same: plant managers don't want them, or their data, compromised.

There are primarily two areas of concern with system cybersecurity. The first area is protection of intellectual property surrounding processes and recipes. Here, a more considered approach to the system design, such as separating the formulation data and control functions, will make systems more flexible and - at the same time - make it more difficult to extract key information in a simple format.

The second area of concern is the flow of outsiders, whether that be contractors or temporary staff, that can accidentally cause production losses. Security methods need to be put in place to reduce the risk of accidental interference with production systems.

When considering security for these two areas, and indeed other areas of manufacturing, the common theme is that sensitive data is being handled. A mix of technical tools and human processes offer good protection and often changes can be made to existing security systems to aid this.

Technical tools are understandably most effective in safeguarding against cyber-attacks, as industrial software will often be the access point for malicious attacks on industrial systems. In this regard, it's important that plant managers ensure their industrial automation software has embedded security features, such as encryption and digital file signatures, to help prevent unauthorised access.

It is far more common for security breaches to occur internally and by accident as opposed to a malicious attack from an outsider but, even in that scenario, systems should provide an audit trail where activity can be tracked back to the source. Usually, a security breach is the result of a poor use of existing security or poor people management.

The human element

This is where the human element comes in. Engineers should be adequately trained in security processes and procedures to ensure they can accurately identify and address security problems as they arise. For example, a plant might have systems in place to log all activity on the network, but this is only effective if it is regularly reviewed and acted on. Likewise, industrial software must be patched and updated to keep it effective.

Fortunately, systems are coming to market to make these requirements more streamlined and convenient for plant managers. GE Digital's OpShield, for example, is designed with in-built features to alert engineers and managers of unusual network activity. It is able to do this by establishing a baseline profile of the ordinary traffic on a network, allowing it to rapidly identify and highlight erroneous traffic.

Novotek UK and Ireland is the official UK distributor of OpShield, which is a useful tool for customers who want to combine insight into system interaction on a network with the ability to filter data and commands between segments. It understands many industrial protocols and can inspect network traffic on a message by message basis to help enforce policies about what data can go where.

A purpose-built system to protect SCADA and industrial operation, the system monitors and blocks malicious activity and threats to secure productivity. The benefits to this system include the ability to protect unpatched systems with strong perimeter and field defence, easy-to-use graphical interfaces and the facility to deliver security alerts to the management console.

You might not be dealing in Swedish police records but it's important to keep business information and systems secure. Oversights like this are easily prevented with the right products and practices in place. To find out how Novotek can support your cybersecurity, head to www.novotek.com/uk.