As the technologies to bridge the divide between the worlds of information technology (IT) and operational technology (OT) within a plant have become more established, the digitalization of businesses has accelerated. The goal of this digital transformation is to provide a foundation to boost productivity, optimize asset availability and maximize plant utilization. However, with greater levels of integration comes an increased need to consider and improve cybersecurity.
Figures from the Centre for Economics and Business Research (CEBR) and gov.uk estimate the cost to UK businesses of cyber breaches in excess of £18 billion. From a general manufacturing perspective cyber-attack brings the risk of lost production, theft of intellectual property and the negative impact on brand confidence as well as potential environmental damage if safety systems are affected. It is therefore not surprising to find that, according to a Make UK report, the threat of cyber-attacks is stopping some 35% of manufacturers from investing in digitalisation.
Further, from the perspective of safety critical infrastructure, asset owners also have to consider the potential cost of being found to be non-compliant with the Network and Information Systems (NIS) Directive. In the UK, the maximum penalty for a breach of the NIS Directive is £17m, enough to give even the biggest businesses pause to think.
Implementing cybersecurity standards
Despite this, the risk of not investing in digital transformation is enormous. From an OT systems perspective, there are now established standards that provide all of the stakeholders in a deployed industrial automation system – the asset owners, the system designers and integrators and the individual product vendors – with the tools and guidelines that they need to secure an installation against cyber-attack.
Chief among these is IEC 62443, which provides a systematic and practical approach to cybersecurity for plant OT systems, covering every aspect from initial risk assessment right through to operations. It defines the differing security roles of the key stakeholders, specifying the unique requirements for each security level within the control ecosystem.
IEC 62443 reinforces the accepted ‘defense in depth’ strategy, defining methodologies for implementing OT cybersecurity measures and outlining procedures as well as policies that can form the methods, for firstly hindering an attack and secondly recovering from an attack.
It is notable that IEC 62443 places the onus on the automation equipment supplier to embed protective features within their products to contribute to system design considerations and lifecycle management, as well as respond to any vulnerabilities that may be discovered.
Defense in depth
This is something Mitsubishi Electric takes very seriously. Its products have long offered a number of security features that support the development of a robust cybersecurity strategy. The ‘defense in depth’ approach that it adopts when advising systems integrators and asset owners on the methodologies that should be used to implement secure networks and control systems are closely aligned with IEC 62443.
In addition, Mitsubishi Electric has established a Product Security Incident Response Team (PSIRT) as defined in IEC 62443. A risk audit service is also available to helps asset owners understand the risks in terms of criticality and consequence of a potential cyber breach. This includes a written report on the status of the networked industrial control systems and offers recommendations for any remediation that is required to meet the standards set out in IEC 62443.
Most recently, Mitsubishi Electric has built a collaboration with Radiflow, whose intrusion detection and analytical tools for generating risk reports and remediation measures meet the requirements of IEC 62443.
Evolving cyber threat
Implementing robust cybersecurity solutions is a vital element of a successful digital transformation strategy and ensures that companies can boost productivity and enhance their competitiveness.
This article originally appeared on Control Engineering Europe’s website. Edited by Chris Vavra, web content manager, Control Engineering, CFE Media and Technology, cvavra@cfemedia.com.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
