What are the security challenges in smart manufacturing? IP Protection – essential to protect your business and your customers

In this article, we’ll highlight some of the risks that have been identified by ENISA (European Union Agency for Network and Information Security) in its recently published ‘Good Practices for Security of Internet of Things in the context of Smart Manufacturing’.

ENISA defines smart manufacturing as “next-generation industrial manufacturing processes and systems built on emerging information and communication technologies in line with Industry 4.0, such as additive manufacturing, advanced analytics, and IT/OT integration”. The term describes systems that, by using connected devices and sensors, attempt to maximize capabilities such as cost, delivery, flexibility, and quality by using advanced technologies that promote rapid flow and widespread use of digital information.

While smart manufacturing is based on the functionalities of traditional manufacturing models, it introduces capabilities such as advanced decision-making as a result of the feedback loop provided by sensors and some form of intelligence. Combines with collaborative supply chains, organizations can quickly adapt to market changes and disruptions using smart manufacturing techniques.

 

Smart manufacturing, Industry 4.0, and security (Image source: ENISA)

In such a scenario, what are the security challenges?

Here are some of the main ones as identified by ENISA:

Vulnerable components – in the fourth industrial revolution, millions of devices are being connected globally, so these components in smart manufacturing must be developed and connected with a number of security disciplines; it also needs to address the convergence between IT security, OT security and physical safety and the shift from closed to connected cyber-physical systems. Hence smart manufacturing companies need to handle the issue of the typical vulnerabilities in those systems. In industrial environments this may pose a considerable challenge since most systems of this type were not designed with cybersecurity in mind, and thus vulnerabilities in this hardware are becoming more and more common.

Management of processes – in addition to the large attack surface in terms of connected devices, many complex processes involved in smart manufacturing should also be considered. This means management of processes with cybersecurity in mind – which can be a challenge especially since functionality and production efficiency are traditionally seen as having a higher priority than cybersecurity.

Increased connectivity – manufacturing processes need to interact with objects and environments on a global scale and systems used in smart Manufacturing need to enable collaboration across multiple organizations.

IT/OT convergence – industrial control systems are no longer isolated from the IT components in the system. Managing IT/OT integration is a significant challenge. The contributing factors include insecure network connections (internal and external), utilization of technologies with known vulnerabilities that introduce previously unknown risks into the OT environment, and insufficient understanding of requirements for industrial control system environments. Holistic security must cover digital twin and physical implementation.

Supply chain complexity – companies that manufacture products or solutions are very rarely able to produce every part of the product itself and usually need to rely on third parties’ components. With this in mind, this can result in an extremely complex supply chain with a large number of people and organizations involved that need to be managed. Not being able to track every component to its source means not being able to ensure product security, which is only as secure as its weakest link.

Legacy industrial control systems – legacy hardware is a significant barrier to the adoption of the industrial internet of things. Manufacturers build new systems on top of legacy systems, and this may result in outdated protection measures and contain unknown vulnerabilities that have been inactive for years. Adding new IoT devices to outdated hardware raises concerns that it may allow attackers to find a new way to compromise systems.

Insecure protocols – manufacturing components communicate over private industrial networks using specific protocols. In modern network environments, these protocols often fail to ensure the proper protection against cyber threats.

Human factors – adopting new technologies means that factory workers and engineers have to work with new types of data, networks and systems in novel ways. They need to be made aware of the risks associated with gathering, handling, and analysing that data, otherwise, they can become an easy target for attackers.

Unused functionalities – industrial machines are designed to offer a large number of functions and services, many of which may not be necessary for operation. In industrial environments, machines or their selected components often have access to unused functionalities that may considerably expand the potential attack area and become gateways for attackers.

Safety aspects – the presence of actuators that act on the physical world makes safety aspects very relevant in IoT and smart manufacturing. Security for safety emerges as an objective of paramount importance.

Security updates – applying security updates to IoT is extremely challenging since the particularity of the user interfaces available to users does not allow traditional update mechanisms. Securing those mechanisms is in itself a daunting task, especially considering over-the-air (OTA) updates. In OT environments, in particular, applying updates may be challenging since this operation needs to be scheduled and performed during downtime.

Secure product lifecycle – device security should be a subject of consideration through the product’s entire lifecycle, even end-of-life/end-of-support of the machine.

Attack scenarios

In its guidelines, ENISA had subject matter experts assess attack scenarios based on various threats and identify critical attack scenarios for smart manufacturing organizations. For each proposed attack scenario, the experts selected their perceived criticality level (not important, of low, medium, or high importance, or as crucial).

Analysis of the answers is the source is presented in the table below.

 

Various attack scenarios in smart manufacturing and their severity (Source: ENISA)

 

For the full explanations and guidelines in the 118-page report, visit ENISA.