How to achieve cyber-security in a Smart Factory

Could security issues stop the fourth industrial revolution? A quick internet search will identify plenty of commentators with frightening stories. They describe a world populated by malevolent actors: shadowy state-sponsored groups and organised criminal gangs willing to break into industrial control systems to steal secrets, disrupt production or even commit acts of terrorism.

Industrial cyber-crime is not a myth. There are a few well-documented cases of successful cyber-attacks against industrial infrastructure, and rumours of many more. Industrial companies have also fallen victim to broadly-targeted attacks using viruses or ransomware.

But hysteria about cyber-crime only really benefits companies with security products and services to sell. What machine builders and OEMs require is a way to make good decisions about the technologies and processes they use in their industrial systems.

That calls for a level-headed approach, one based on the probability of a security incident and the likely impact of such an event. A number of standard approaches, such as the IEC 62443 series of standards, exist to provide a robust, structured methodology for the analysis and control of security risks in automation and control equipment.

Risk-based approach

For any given manufacturing environment, companies should begin by evaluating the possible direct and indirect implications of a successful cyber-attack:

• What could happen? Theft of intellectual property; corruption of data; loss of production; damage to machines; injury or loss of life; reputational impact?
• How often could it happen?
• How much time would it take to restore operations?
• How would customers be affected?
• What would it cost?

The responses to these questions will be different for every machine and every company, but answering them will help the organisation to establish a sensible budget for cyber-security related activities, and to allocate that budget to the most sensitive parts of their networks and operations.

Protection strategies

In terms of protection strategies, any security policy should adopt a combination of technologies and approaches. Here are a few of the most common options.

Isolation

Installing a device with no connection to any network appears to go against the fundamental spirit of Industry 4.0, but this approach may still be appropriate in certain circumstances. The computers used to generate the master keys for security certificates, for example, may sometimes be physically separated from the network and accessible only under strict security protocols - for example, requiring the presence of more than one member of staff when keys are created.

Encryption

Industry-standard encryption technologies can be used to protect dynamic data streams - for example, with virtual private networks (VPN) or Secure Shell (SSH) connections. Static data in databases and hard drives can also be encrypted. The encryption and protection of executable programs helps to guard against reverse engineering, which can be used for the theft of intellectual property and the identification of possible exploits.

Structural segregation

A firewall at the boundary of an organisation's own networks is no longer considered sufficient. Most companies, especially those operating connected equipment or dealing with sensitive data, will also want to partition and protect different parts of their internal networks with firewalls and access controls. Those measures help guard against unauthorised access by insiders, and can limit the damage caused if an outsider does gain access to part of the network.

Physical protection

Many common forms of cyber-attack depend on direct physical access to a machine or computer system. Old-fashioned physical security, from appropriate building access to controls and locks on control cabinets, are as important as ever.

Training and operating procedures

Humans will always be a critical weak link in cyber-security. 'Phishing' attacks rely on naive users to release passwords or install malevolent software. Preventing such issues requires users to be trained in good security practices, and that training should be regularly updated and tested with simulated attacks.

Anomaly detection

Analytical and artificial intelligence techniques are an increasingly important part of the cyber-defence armoury. Deep Package Inspection (DPI) engines and other monitoring systems can continuously monitor network traffic looking for suspicious activity, like system administrator logins or large data transfer outside normal office ours. Because some of these systems 'learn' what normal data traffic looks like, they can also spot 'Zero Day Exploits' - previously unknown security vulnerabilities.

Best-practice sharing

Cyber-security is a dynamic and continually changing activity. Companies need to engage with customers, suppliers and technology providers to understand how threats are evolving and protection approaches are improving. Connected systems need to be updated and patched regularly, as new vulnerabilities are identified and resolved. Training and operating procedures may need to change. In industrial environments, where companies can be reluctant to meddle with sensitive production-critical systems, that may require significant cultural change.

Test, test and test again

The frequent and ongoing testing of attack scenarios enables system vulnerabilities to be identified and repaired, and trains users and developers in good security practices. Testing can involve multiple mechanisms, including penetration testing by specialist companies and the use of automated test platforms that include vulnerability testing functionality.

Conclusion

As a growing proportion of the value owned by manufacturing companies moves to connected, digital systems, cyber-security is becoming a critical part of their overall quality assurance and risk management requirements. Security is a complex and continually changing challenge but, by adopting modern devices, platforms and tools, and by taking a systematic approach, machine builders and equipment owners can balance the costs and risks.