Mushroom
Machines need our protection!
Today's companies are facing new security challenges, as safety can no longer be guaranteed without industrial security. Security must cover both direct physical access to the machine and digital access via networks.
Safety requires that the residual risks posed by a machine or system must not exceed acceptable levels. This includes both the hazards of the system's environment and the hazards within the system. Industrial security concerns the protection of a machine or system against unauthorized access from outside as well as the protection of sensitive data against falsification, loss and unauthorized access internally. This includes both explicit attacks and unintentional security incidents.
Security has long played a central role in traditional IT. This is why there are a number of standards, such as the ISO/IEC 27000 series 'Information technology - Security techniques - Information security management systems - Overview and vocabulary (ISO/IEC 27000:2016); German version EN ISO/IEC 27000:2017'. However, its requirements cannot be easily transferred to automation, where the availability of data is the top priority - as an essential prerequisite for smooth production processes. In IT, on the other hand, the confidentiality of data has top priority.
In order to enable effective security solutions for automation, various organizations are developing corresponding standards. However, these only describe partial aspects such as the distinction between security and safety. Furthermore, they are neither available as a draft nor as an official standard, so they are more technical references.
| For component manufacturers | For system integrators | For operators |
|---|---|---|
| 62443-4-1 Development process | 62443-2-4 Guidelines and procedures | 62443-2-4 Guidelines and procedures |
| 62443-4-2 Security functions for the component | 62443-3-2 Security functions for automation and control systems | 62443-2-1 Operation and service |
The standardization situation
On the other hand, IEC 62443 'Industrial communication networks - IT security for networks and systems' is an international series of standards that comprehensively covers IT security in automation. Its range of topics extends from system integration and the operation of a system to the secure development of products (security by design). As a result, IEC 62443 currently offers the best guidance for system operators and device manufacturers on how to implement security effectively.
Currently, the best guide for system operators and device manufacturers to effectively implement security is the international IEC 62443 series of standards 'Industrial communication networks - IT security for networks and systems'. Its topics range from risk analysis and requirements for secure operation to the secure development of products.
© Fotolia / adiruch na chiangmaiThe 'ICS Security Compendium' from the German Federal Office for Information Security (BSI) is aimed in particular at operators of industrial control systems. It explains general principles as well as special requirements and relevant standards. Suitable measures are also presented and ways in which they can be implemented are shown.
While IEC 62443 and the 'ICS Security Compendium' are more for experts, the VDI guideline VDI/VDE 2182 provides a comparatively simple introduction to the topic. However, due to the complexity of industrial security, it is certainly advisable - at the latest when it comes to implementation - to consult external specialists.
The most efficient solutions are those in which safety and industrial security are considered holistically, yet logically separated. What might such a solution look like?
Access concepts to machines
The times when safety was based on the strictest possible separation of man and machine are over. Processes are becoming ever more dynamic, the need for controlled intervention in the process and the demands on productivity are increasing and therefore also gradually changing safety technology. The access points to the machine or process are of key importance here. These must be secured against unauthorized opening (deliberate or accidental) and must undoubtedly ensure that no persons are present in the hazardous area when the machine is started. These classic safety tasks are based on a wide range of sensor technologies, from light curtains to safe guard door systems.
Today, it must be possible to work in defined safety zones of a system without bringing the entire production process to a standstill. Who is allowed to do what on which machine and when? Anyone who can provide the answers to these questions has laid the foundation for greater productivity.
The system solution
For example, the operating mode selection and access authorization system 'PITmode' from Pilz combines safety and security functions in one system. This means that the devices can be used for functionally safe operating mode selection and access authorization control on plant and machinery. The devices can be used in plant and machinery where it is necessary to switch between different control sequences and operating modes. Coded transponder keys with RFID technology can be used to grant each employee machine approvals and authorizations tailored to their abilities. The safe evaluation unit recognizes the specified operating mode, such as automatic mode, manual intervention under restricted conditions or service mode, evaluates it and switches over in a functionally safe manner. This prevents operating errors and manipulation and protects both man and machine.
Safety and security functions in one: The 'PITmode' operating mode selection and access authorization system enables functionally safe operating mode selection and access authorization control for machines and systems.
© MushroomA system solution comprising configurable small controller 'PNOZmulti 2' and 'PITmode' allows comprehensive access control and functionally safe operating mode selection. The possibilities of this extended system solution range from simple enabling and authentication for certain machine part functions to a complex hierarchical authorization matrix. This allows user-friendly configuration of access authorizations with a high level of manipulation protection, which simplifies manipulation management. Supplemented by secure sensors for access to the machine, a flexible safety concept is created - and not just from a safety point of view: Security aspects are also taken into account with regard to user authentication, qualification and access protection.
Protect networks
When machines and industrial processes are intelligently networked, these networks become vulnerable. In future, machines will need even more protection here: the Application Firewall SecurityBridge from Pilz protects controllers such as the configurable, safe small controllers 'PNOZmulti' and the automation system 'PSS 4000' against network-based attacks and unauthorized access.
Security is a 'moving target', i.e. it changes during the product life cycle. Attackers are developing ever better methods to overcome defenses. Therefore, measures against cyber threats must be continuously improved.
© Fotolia / ipopbaThe 'SecurityBridge' can be connected upstream of the base unit of the control unit. It acts as a VPN server via which a virtual private network (VPN) can be established to one or more client PCs (configuration PC). This secures the connection between the PC and the device. Only users with the appropriate authorization can make configuration changes to a project. This prevents unauthorized access to the protected network. Data transmission between the client PC and SecurityBridge is therefore tap-proof and tamper-proof. Unlike generic firewalls, it does not require complex configuration and can be easily put into operation thanks to application-specific presettings based on the plug-and-play principle. In addition, the 'SecurityBridge' controls the process data traffic and monitors the integrity of the safety system. Changes in the checksum provide information about changes in the application projects. The 'SecurityBridge' was also developed from the point of view of security in a TÜV-certified process in accordance with the above-mentioned IEC 62443-4-1. Aspects such as threat scenarios, strengths and weaknesses of protocols or encryption methods are taken into account from the outset.
In addition to the necessary technology, awareness of the threat is extremely important for security. People themselves always have a key role to play, both on the computer and on the machine. All it takes is one unprotected port or the careless opening of an email for malware to enter a company network.
into a company network. Even the best door security or access control will not help if unauthorized persons gain access to the machine via the IT system. Future-proof automation solutionsmust take security into account from the outset. Security should not just be understood as hardware, but as a function that goes far beyond a purely technical consideration.
Interview on the current topic with Thomas Pilz, Managing Partner of Pilz.
You might also be interested in
SPS Connect 26.11. - 13:40 - 14:00
Successful use of service robot modules in intralogistics
In applications for material transportation with an automated guided vehicle (AGV), many trades have to come together.
read more...SPS Connect 26.11. - 11:00 - 11:20 a.m.
Industrial security - a factor critical to success
The interplay between safety and industrial security protects people and machines. Key topics here are: clear and secure proof of identity for products, processes and machines as well as for all authorized persons - including the secure exchange of...
read more...More software safety and security through coding standards
Software is penetrating products, devices and areas where it seemed impossible. Developers have to deal intensively with the software in these products and the resulting consequences and adopt an engineer's perspective: Engineering is required.
read more...New functions for safety and industrial security
When selecting the operating mode and managing access authorization, the configurable safe small controller PNOZmulti 2 from Pilz now takes on additional industrial security and safety tasks.
read more...Able to act again after cyber attack
The Schmersal Group has restarted production at its global sites following a massive cyber attack. Schmersal had previously been warned that cyber criminals were planning a targeted attack on the company network.
read more...Crisis-tested through the year 2020
2019 was not an easy year for Pilz: the automation specialist had to cope with a drop in sales and a cyber attack. However, the attack opened up new opportunities.
read more...Maximum half-life of two years
The automation world still has some homework to do when it comes to safety and security. Thomas Pilz, Managing Partner of Pilz, which was itself the victim of a cyber attack in October 2019, explains what this is in detail.
read more...VDMA publishes emergency aid paper
Quick action and targeted assistance are of the utmost importance in the event of a ransomware attack. The VDMA has therefore compiled an overview of emergency measures and contact details for authorities and service providers.
read more...Security is integrated
In addition to WLAN data transmission, the HGW 1033-32 hand-held operating device from Sigmatek is equipped with safety elements, a high-resolution 10.1-inch multi-touch display and three rotary encoders.
read more...