Manufacturers whose portfolios include security services offer significant advantages for machine and plant manufacturers. In this interview, Arno den Elzen, Business Development Manager Network Security Service at Rockwell Automation, looks at the economic, personnel and technological aspects.

Are German companies adequately prepared for potential cyber attacks and are their protective measures sufficient?

den Elzen: At the moment, it is not possible to answer this question for the entire industry and all German companies. However, what we can actually observe is that the topic of cybersecurity has obviously become more of a focus for companies. More and more companies have invested more heavily in comprehensive cybersecurity solutions in recent years. We are also noticing from the demand that digital security is now beginning to take on the importance it deserves.

We are seeing this even more than the industry average, particularly among companies in the energy and utilities sector, for example. As such companies are part of the critical infrastructure, it is particularly important here that the operation of the systems is guaranteed and that there are no downtimes due to cyberattacks. These companies in particular are obliged by law alone to think about how their systems can function without any problems.

When we talk about cyberattacks, however, we are not only talking about production and operational downtimes, but also about data theft and potentially life-threatening manipulation. This is why the legal provisions mentioned above also apply to companies in the pharmaceutical and food industries. Cybersecurity must be a fundamental component of the digital architecture here.

Investments in cybersecurity should essentially be based on the guidelines set out in the international IEC 62443 series of standards. At Rockwell Automation, we naturally also observe these in every project that we plan and implement together with operators and responsible parties.

Regardless of the budget, which three security measures should companies implement to protect themselves against cyber attacks?

den Elzen: In our experience, risk management, precise evaluation and knowledge of the installed base as well as orderly change management with a view to the company's own employees and overarching strategies are the most important points that companies need to consider.

Critical components that are particularly exposed within a system or are essential for operation must be clearly identified. All necessary and required protective measures must then be precisely defined for these components.

In addition, companies should obtain a clear overview of all components within the plant and know which devices are used in the production environment. Particular attention must be paid to patch management and systems that are not Windows-based must also be taken into account.

"IIoT teams for solid change management"

den Elzen: Many companies also underestimate the influence of their employees on their own cybersecurity. Around 60 percent of all relevant incidents in this area are caused by carelessness or simply a lack of knowledge about the necessary cyber hygiene. Part of solid change management at this point can also be to form dedicated IIoT teams that come from both IT and production. This merging of OT and IT can result in guidelines for the entire company that strengthen cybersecurity without impeding production processes.

Keyword security as a service: should the manufacturing and process industry consider managed security services?

© Rockwell Automation

den Elzen: I would even go so far as to say that this step and the use of Security-as-a-Service is the only correct approach to ensure long-term and comprehensive protection of assets.

Cyber criminals never sleep and are constantly expanding their capacities. Conversely, this means that it is becoming increasingly difficult for companies and manufacturers to adequately address the issue, protect themselves comprehensively and remain cost-effective at the same time. Accordingly, external providers and manufacturers of automation components that have security services in their portfolio must be used. In the course of digitalization, systems are also becoming increasingly complex and it is becoming more difficult for employees on site to consider all relevant aspects with every step towards a necessary digital infrastructure.

However, digitalization is also an essential part of the future strategy of comprehensive cybersecurity. In this way, specialists from manufacturers can monitor production facilities remotely and alert operators to errors and anomalies. They can then work together to take the appropriate defensive measures. At Rockwell Automation, we already offer comprehensive services relating to the life cycle of systems and in this way equip our customers with the necessary tools for the future.