Safety and Security
Strategic Industrial Security
Electrical systems are computerized and automated, and their safety/security must be guaranteed at all times.
This includes functional safety/safety, but also explosion protection, as these functions mostly use information technology components.
Although the importance of security as the basis of digital transformation is recognized, the majority of companies have not yet developed a risk analysis to at least define protection goals. This recklessness with a danger that is difficult to calculate, even existential, due to high consequential costs leads to the well-known, spectacular damage caused by cyber attacks and to related failures in almost 30 percent of all companies (source: Phönix Contakt). Suitable protection solutions are available for the immediate elimination of such dangerous situations.
Significance
With Stuxnet 2010, security changed from a network issue to an industrial automation issue. Adapted internal structures combined with secure products and an integrated approach led to the necessary security concept. Since then, cybersecurity has not been an end in itself, but an important prerequisite for maintaining competitiveness in times of digital transformation. Comprehensive action and coordinated security initiatives are becoming imperative in order to minimize the time between a hacker attack and its detection in the interests of low-disruption production. The "security of proprietary solutions", which is being replaced by flexible, open networks such as IoT due to other advantages, will be comprehensively replaced in a new era. Gates of entry must be closed systematically and reliably, even though real-time data streams and connections are growing.
Fundamentals
The aim of security is the efficient and effective protection of all company assets - including in offices and critical infrastructures, while maintaining decentralization, availability, confidentiality, integrity, productivity and user-friendliness. The opportunities offered by IoT networking, where "everyone talks to everyone", can still be exploited compared to the conventional automation pyramid. Remote data centers (clouds) are included in order to globally network self-contained locations with edge servers. Unauthorized access from outside must be prevented. Security and safety grow together without interference.
Targeted or untargeted, widespread virus attacks and collateral damage must be prevented economically, politically and personally. Upstream (development, suppliers, etc.) and/or downstream processes are just as much a part of this as the final operation. A risk analysis is the only way to quantify the threat situation. Security does not represent a defined, risk-free end state (see obligations according to the BSI ICS Security Compendium).
There are major differences between office and industrial technology in terms of service life (longer), patch only after approval by the system manufacturer, availability (high), time delays (barely acceptable).
The table contains elementary protection mechanisms for holistic and strategically planned defense measures.
Risk analysis
By identifying existing and/or conceivable error states, it provides the correlation between the extent of damage and the probability of occurrence in matrix form, the basis for maintaining and improving safety. This difficult, methodical and continuous assessment usually results in a low probability of occurrence for risks with a high extent of damage. Based on an inventory, the main areas of focus are
- Endpoints, databases and servers (edge, cloud),
- Remote access for analysis and maintenance (including the service provider's laptop, etc.),
- Communication, internet connections (IoT, 5G, edge devices - also as gateways, cloud computers, overload attacks on distributed networks with computers, tablets, smartphones - botnets),
- portable media such as CDs and sticks,
- Production and other networks,
- Monitoring of vulnerabilities (legacy systems, etc.),
- Complexity of the software (influence on service life, error-proneness, testability, maintainability, quality).
The not insignificant but manageable costs of such investigations are quickly amortized by minimizing the risk of system failure. NIST - USA offers a reliable guide to action with its Cybersecurity Framework.
Relevant regulations
In line with the importance of cyber security, there are numerous guidelines, laws and standards for users. In addition to well-known directives such as the Product Liability Act, BGB, etc., these include
- EU Directive of 6.7.2016 on cyber security
- IT Security Act of 25.7.2015 (obligation to specify industry-specific security standards)
- VDI/VDE 2182 Risk assessment
- IEC 62443 Industrial communication network - Network and system security
- DIN ISO/IEC 27019 2018-08 Draft Information technology - Security procedures - Information security measures for energy supply (ISO/IEC 27019:2017)
- ISO/IEC 27001 Information technology - Security techniques - Information security management systems - Requirements for information security management systems
- ISO/IEC Guide 51: 1990 Functional safety.
Outlook
Cyber security is of great existential importance. This was confirmed by the 2017 hacker attack on the government network. In order to help SMEs in particular to overcome their security problems (costs, effort, experience), the VDE founded the platform "Praxisnetz Digitale Technologien" - vde.com/pdt. For some time now, insurance companies such as Allianz Deutschland have been offering cyber policies so that companies of different sizes can protect themselves financially against online fraud and hacker attacks. Joachim Krause
Safety (operational) safety in the sense of reliability (guaranteeing function under all permissible conditions, avoiding critical states) as well as occupational health and safety. Systems designed for this purpose prevent human accidents and damage to property.
Security (access) protection against the deliberate misuse of/in computer and automation systems. Despite open networking, it guarantees functional security, protection against external attacks and against the theft of algorithms and data, defense against malware (viruses, Trojans, ransomware, etc.).
Explosion protection Indicator of safe operation of electrical equipment in potentially explosive atmospheres.
You might also be interested in
5G in the industrial IoT
The Chair of Production Systems at Ruhr-Universität Bochum LPS is researching industrial applications with a local 5G network in the context of Industry 4.0.
read more...Implement milling tasks economically
Milling covers a wide range of applications - from the machining of large free-form surfaces in the aviation industry and in the manufacture of wind turbines to the milling of cavities and highly automated mass production.
read more...Mitsubishi Electric invests in the future
Further production building in Owariasahi City
Due to the growing importance of the Japanese region of Owarisahi in Aichi, Mitsubishi Electric Corporation is increasing its planned investments and announcing the construction of a second production building.
read more...Industrial Connectivity Lab opens
Siemens customers test wireless technologies
Siemens has opened a new test lab for industrial connectivity technologies at its Erlangen site. Embedded in the Siemens Technology Center on the Erlangen campus, the Industrial Connectivity Lab offers 300 square meters of space for testing...
read more...A sustainable foundation for the industry
The networks are growing together - this refers to the ongoing merging of IT and OT. Christian Korff, Managing Director Global Accounts and Member of the Management Board, Cisco Germany, explains the challenges and levers involved.
read more...It started with a timer for X-ray machines
In 2023, the automation expert Omron can look back on 90 years of innovative company history, in which many technological boundaries have been crossed and milestones set.
read more...Flexible component transport in production
Stein Automation presents the Stein 400 workpiece carrier system for parts weighing up to 80 kilograms and the C5G logistics control system.
read more...Extended image processing options
High-performance multispectral line scan camera with 5GigE
The new Linea2 4k Multispectral 5GigE camera takes machine vision systems to the next level with its performance and value, offering a 5GigE interface with five times the bandwidth of the Linea GigE camera.
read more...Digital transformation and edge computing
Kyndryl, the spin-off company of IBM IT Infrastructure Services, was represented at the Hannover Messe with several partners, such as Nokia, Google and VMware.
read more...