PLCs, HMIs and other systems have become easy targets for motivated cybercriminals. Here are some tips on how to prepare for them and a look at some PLCs with built-in cyber security.
Historically, manufacturing systems have been protected by either being isolated from the outside world or by connection to IT-managed networks already protected by firewalls and antivirus software. However, as the manufacturing sector undergoes a digital evolution, the production floor has become more susceptible to attack. Luckily, over the past decade or so, PLC manufacturers have made strides in efforts to protect PLCs, HMIs and other systems from hackers and malicious software. Given the forecast by Cybercrime research firm Cybersecurity Ventures that cybercrime damages will reach of $10.5 trillion per year by 2025, the need to protect industry has become an absolute necessity.
Understanding the Cyber Threat Landscape in Manufacturing
Modern manufacturing systems are sophisticated blends of PLC control systems, information technology (IT) and operational technology (OT). Each component plays a critical role in maintaining efficiency and productivity, and attacks on any one of these can be devastating. The trend of interconnecting legacy systems with modern technologies opens up an array of new potential points of entry for cybercriminals. Since these components often have inadequate security measures which can be exploited by cyber attackers, other layers of security must be employed.
In the face of these threats, cyber resilience has emerged as a central theme in cybersecurity strategy. Cyber resilience is the ability of an organization to withstand, recover from and adapt to cyber attacks. This resilience is a combination of many strategies that prevent or minimize the impact of a cyber breach, maintain critical operations and ensure swift recovery.
The Human Element in Cybersecurity
While technical measures form the backbone of any cybersecurity strategy, the human element is equally crucial. Social engineering attacks—where attackers trick people into providing confidential information—are a common form of cyberattack and are often remarkably successful. Providing suitable cybersecurity training helps employees understand the threats they face and how their actions can impact the company’s cybersecurity.
This involves making cybersecurity a key part of the company culture, with clear and consistent communication from leadership about its importance.
Strategies for Mitigating Cyber Attacks:
1. Risk Assessment and Management: Regardless of the systems used, one of the first steps towards creating a cyber-resilient manufacturing environment is conducting a comprehensive risk assessment. Identify and assess potential risks that can be exploited, ranging from weak passwords and outdated software to unsecured network connections and physical access controls. These risks can be reduced by using a set of good networking practices such as implementing encryption, two-factor authentication, regular software updates and continuous monitoring.
2. Employee Training: Regular, effective and up-to-date cybersecurity training for all employees is essential. Such training could cover topics from identifying and avoiding phishing attempts, practicing good password hygiene, to understanding the importance and processes of software updates.
3. Layered Defense: Manufacturers should adopt a layered defense approach, also known as defense in depth. This approach involves the deployment of a series of defensive mechanisms such as firewalls, intrusion detection and prevention systems, encryption protocols, and regular system audits. Having multiple layers of security measures significantly decreases the likelihood of a successful breach. Dividing the PLC and computer networks into subnetworks, or segments, improves network security and performance. If an attacker compromises one group of equipment, the breach won’t spread through the entire network.
4. Legacy systems: Older equipment may need extra layers of security that could include limiting physical access to connection ports. Alternative methods of collecting the required information could also be explored such as using an intermediate data collection PLC as an information gateway. In a manufacturing environment, physical security and cybersecurity should not be seen as separate entities but should be seamlessly integrated. Surveillance systems could be used both as a deterrent and provide valuable information in the event of a breach.
5. Incident Response Planning: Having a well-structured and rehearsed incident response plan can dramatically reduce the damage and recovery time in the event of a breach. Such a plan should include defined roles and responsibilities, communication protocols, steps for isolating affected systems and processes for system recovery and post-incident analysis. Part of this includes maintaining effective backups that can be reloaded in the event of a breach.
6. Monitoring and Improvement:Cyber threats evolve continuously, which means static security measures are inadequate. A system for constant monitoring and updating of security measures should be in place. This should involve keeping up to date with the latest cybersecurity news, threat intelligence and technological advancements. PLC programs can be automatically audited for unauthorized modifications by comparing to secure backups. Any anomaly can generate an alert facilitating an immediately response.
7. Supply Chain Security: To mitigate supply chain attacks, manufacturers need to extend their cybersecurity efforts to their suppliers. This includes conducting cybersecurity audits, collaborating on security best practices and drafting contractual requirements regarding cybersecurity measures.
Remember, the best security strategy usually involves a combination tools and techniques, customized to the needs and risks of the specific manufacturing environment.
PLC Security
While the concept of built-in cybersecurity in PLCs is recent and is still evolving, some companies have started to integrate basic security features into their PLCs to address this issue. Here are a few examples:
1. Siemens S7-1500: Cybersecurity features in the S7-1500 PLCs include access protection—programming devices and HMI panels require user-specific authorizations to connect; communication integrity, where data is protected from manipulation during transmission using encryption and message authentication codes. Even PLC to PLC and PLC to HMI communication requires devices log into each other closing an otherwise wide-open access path.
2. Rockwell Automation ControlLogix 5580: These controllers include a suite of security features, such as role-based access control, digitally-signed and encrypted firmware, change detection, logs, and auditing security features, as well as IP and MAC address protection.
3. Schneider Electric Modicon M580: features such as integrated cybersecurity, ethernet encryption, and Achilles Level 2 certification, an industry recognized cybersecurity certification that indicates a high level of protection against known cyber threats.
4. Honeywell ControlEdge PLC: Secure boot prevents unauthorized firmware uploads, a secure default state to enhance security right out of the box and robust user controls to manage access.
5. ABB AC500-S: Cybersecurity features that include user management, role-based access control, and a firewall. It’s designed to be compliant with the IEC 62443 standard, an international cybersecurity standard for industrial automation and control systems.
Please note that while these PLCs have built-in cybersecurity features, they are not immune to all cyber threats. Comprehensive network-level security measures, following best practices, and regular updates and patches are essential to maintaining a secure environment. It’s also important to work closely with PLC vendors and cybersecurity experts to fully understand the features, limitations, and best use cases of each PLC.
