What is the industrial cybersecurity?
The computer threat is a reality in all sectors, including industry. The obsolescence of systems, to which is added the digital transformation with the connection of smart objects, exposes systems that have been isolated until now. Defining and applying a cybersecurity strategy therefore becomes essential for this area.
Definition of industrial cybersecurity
Cybersecurity is available in all sectors, adapting to the security needs of each environment. For industry, it is a question of securing all production systems or systems that allow the operation of industrial installations (air conditioning, access control, video surveillance, etc.). Cyberattacks on these environments can have disastrous consequences on our environment: an explosion that can lead to pollution or even loss of human life... Securing these critical environments therefore makes it possible to maintain continuity of service for essential installations and to avoid environmental damage.
The causes of industrial cybersecurity
The obsolescence of industrial systems equipped with OS - often unsupported (therefore without security updates) - combined with the convergence of IT/OT environments via digital transformation exposes this vulnerable environment to external threats. The significant impact of cyberattacks on these environments draws particular attention to hackers who see it as a new financial opportunity.
The challenge of industrial cybersecurity
The main challenge of the cybersecurity of industrial installations is to succeed in securing heterogeneous environments (technologies and generations) with current security solutions. Another important issue is having competent resources to set up the appropriate organizational/operational model. Indeed, the “IT” methods do not all work on the “OT” perimeter...
Cybersecurity in three points
There are a lot of things to do to improve our level of maturity in industrial cybersecurity, for example: good password management, having system backups, checking USB keys before use... However, certain activities are essential and priorities. Here are three:
Have competent resources
Indeed, if you want to make a good cake, you need a good cook. Having the right ingredients is not enough…. Well, it's the same in cyber! Be careful not to focus only on technical resources, resources in the field of governance are very important.
Have visibility on your industrial information system
“To protect your jewels, you have to know how many we have and where they are!” Indeed, having full visibility of its industrial information system and then identifying its critical systems (“Crown jewels”) is one of the first essential steps.
Develop and apply a cyber strategy (based on repositories) adapted to the context
Indeed, we are not going to secure the car wash station and a nuclear power plant in the same way. It is important to identify the risks incurred in order to implement appropriate security solutions.
Questions
Why is IEC 62443 an industrial cybersecurity standard?
The IEC 62443 standard comes in addition to the ISO 27000 standard, which allows the security of information systems, and the IEC 61508 standard which ensures industrial security. It is a basis that allows manufacturers to adapt the standard to their facilities. It is broken down into four parts: general documents, measures and recommendations for operators, evaluation of the operational means of tool safety as well as safety requirements for equipment.
What skills are needed for the cybersecurity of industrial systems?
Industrial cybersecurity applies to a specific sector that requires specific skills. It is necessary, like any cybersecurity specialist, to be competent in cryptology or risk analysis, but also to have a mastery of innovative industrial tools: connected objects, robots, embedded solutions. The strategist must also be sensitive to the production chain to limit the risk of loss to the industry.
What does industrial cybersecurity protect against?
Hardware failures or snooping employees are not the primary issue in industrial cybersecurity strategy. The heart of these systems is the prevention and analysis of the risks of programmed systems. Many companies have suffered from cyberattacks, which take the form of private data leaks, destruction of equipment or plant paralysis, affecting, for example, control-command systems.
Key figures about industrial cybersecurity
Manufacturers realize the importance of successful cybersecurity, because the figures underline the danger that unanticipated hackers can represent.
ransomware in 2020 affected manufacturers
median loss from VSEs to cyberattacks
security incidents detected every day on average in a French company
What about cybersecuroty ?
To find out more about cybersecurity, its challenges, its problems but also its evolution.