Personal computers finally made their breakthrough on the market in 1986: the 'Intel 8036 chip' was something of a door opener as the first 32-bit processor, which, together with a customized version of Windows, heralded a new computer era. However, 1986 was a turning point in computer history for another reason: 'Brain' was the first PC computer virus to appear. It only attacked floppy disk drives and slowed them down. It was actually a harmless joke - but it marked the beginning of a new, ominous era: since then, end users have also had to deal with the issue of 'computer security'.

32 years later, the topic of 'cyber security' is more topical than ever and the figures are frightening. Last year, the AV-Test Institute recorded a total of 920 million malware programs in circulation worldwide. Between eight and ten million new programs are added every month. The number of targeted cyber attacks is also increasing exponentially. In April 2019, Deutsche Telekom registered around 46 million daily attacks on its 3,000 'honeypots'. These are a type of 'digital trap' on the internet that lure potential cyber criminals with seemingly interesting or valuable content. Each honeypot was therefore attacked around 15,000 times in one month, i.e. 500 times a day.

Given these figures, is it even realistic to think about a halfway functioning 'Internet of Things'? Can companies protect themselves effectively - especially when you consider that people are still the biggest source of insecurity?

Secure paperless recorders

When it comes to data acquisition, Jumo has been concerned with the issue of tamper protection since its first paperless recorders, as the measured values they record are stored as data on a hard disk or other storage medium - and data is known to be manipulable. Therefore, this issue also plays a central role in the latest model, the 'Logoscreen 700' - especially as this paperless recorder enables FDA-compliant data acquisition.

The Food and Drug Administration (FDA), the food and drug regulatory authority in the United States, places particularly high demands on the materials and technical processes used. With '21 CFR part 11', the FDA formulates requirements for electronic records and signatures. 21 CFR part 11 applies whenever information is created, modified, stored, transmitted or accessed electronically. This can involve various types of information such as text, images, videos or audio files. The requirements must be met if the documents generated, stored, transmitted or modified with the information are used to demonstrate compliance with regulatory requirements - for example, release and test records, process and work instructions or production records such as those captured by paperless recorders.

In short, '21 CFR part 11' is generally applicable whenever electronic records replace paper. In this case, special requirements such as document encryption and digital signature standards apply to ensure the authenticity, integrity and confidentiality of records.

Digital signature and FDA

A look at the topic of 'signatures', for example, shows how meticulously the FDA deals with these issues: A digital signature must contain the name of the signatory, the date and time of signing and the meaning of the signature (for example, review or approval). It must not be possible to forge this signature, it must be linked to the document in such a way that it cannot be applied to other documents, it must be possible to assign it to a single individual and it must consist of two components such as an identification code and a password.

Example of a digital device certificate. Such a digital device certificate serves as proof during audits that no manipulation has been carried out during data collection or further processing.

© Jumo

The paperless recorder from Jumo meets these requirements: With a special type add-on, the device has a TÜV-approved function to ensure data security and also meets all FDA requirements for paperless digital process data recording in the pharmaceutical and food industries.

A digital device certificate can be used to prove that the recording data has not been manipulated either in the device, during transmission or during evaluation. This provides the user with reliable proof during critical audits that the recorded process data has not been tampered with.

The 'PC Security Manager' software enables the administration of a maximum of 50 users per device. An electronic signature can be assigned for a batch record, a time range or for logging off. The assignment of authenticated comment texts on the device makes the logging of verifiable processes more flexible. Here too, the use of the digital certificate ensures secure tamper detection. As it is becoming increasingly difficult to prevent data manipulation, it must be ensured that every intervention is immediately noticeable and can be traced.

The conclusion of the TÜV report confirms this concept: "The double check of the integrity of the data using a checksum and cryptographic signature offers robust protection against manipulation attempts. The procedure for exchanging device certificates is also adequately protected against manipulation attempts. TÜV Süd's Industrial IT Security Laboratory was unable to identify any weaknesses in the tests carried out."

Author:
Michael Brosig is press spokesman at Jumo in Fulda.