Last year, researchers from Gartner surveyed 800 IT leaders and found spending on cybersecurity as a percentage of IT budgets was 4.7% for industrial manufacturing outfits versus software publishing firms and internet service providers that spent 8.7%. No less than consumers, machine builders and manufacturers are vulnerable to cyberthreats. Machine builders could help manufacturers make up this spending gap in three ways.
First, they could encourage customers to take some basic cybersecurity steps. Second, machine builders could incorporate extra security layers in their new equipment. And third, machine makers can advise facility managers on how to connect legacy equipment.
Investigators looking at the large cyberattacks recently perpetrated found some of the victimized manufacturers failed to avail themselves of basic defenses. For example, some victims had never implemented measures like multi-factor authentication, or MFA. Putting MFA in place is a starting point for protecting machines, data and systems from hacks.
Machine builders also must include cybersecurity features in their designs from the start, at all levels, and meet the latest standards tied to cryptography and establish unique identities for devices. The Industrial Internet Consortium is one example of a group that has written frameworks, including a how-to guide on security, that machine builders and designers can turn to for help.
Since cloud applications are, of course, a means of communication between industrial equipment and networks, communicating safely requires a secure route for data transfer between each connected device and all the others it could interact with. By using asymmetric algorithms, machine designers can create safe routes for data exchange. And by incorporating a cryptographic chip, machine builders could add a layer of security to encrypt outgoing data; that way, a hacker can’t listen to the device’s data output. These chips are tamper-proof, too, so bad guys can’t lift the device or machine’s certificates.
Connecting Legacy Machines
Thinking about how to better secure already-connected industrial machines is critical. But plant managers might want to get their old hardware or technology onto an IIoT stack, too. Facility managers and machine makers can team up and adapt legacy machines to the latest security protocols.
To do that, machine users and builders could carry out a risk-benefit analysis. For example, they could ask what the benefits are for collecting data from legacy equipment. A plant manager could find it incredibly helpful to get temperature readings and cycle times for a connected legacy machine. That connected data could help a plant owner or machine builder peg when it’s time to carry out preventative maintenance, which could justify investing the time and money in making a legacy machine internet-enabled.
The tools for connecting legacy machines should be vetted, of course. While it’s possible to use hobbyist tools to diagnose or beta test, it's ill-advised to create a custom long-term security solution through use of common hobbyist tools such as a Raspberry Pi, with its applications processor, or Arduino, a microcontroller.
For machine builders and manufacturers, new security threats related to connectivity will always lurk. Creating innovative designs and security measures that stymie bad actors is one way to block attempts to hack into newly designed machines and manufacturing networks. But another way to protect networks might be retrofitting older machines with software and sensors that keep a steady stream of data flowing back to the machine’s owner and manufacturer to detect anomalies.
While being connected introduces risks for new and legacy equipment, there are benefits like real-time updates and upgrades related to security patches, features and functions. Connected legacy machines could even be another set of eyes and ears for plant owners and their industrial networks.
Adam Justice is CEO of Grid Connect, Inc. and co-host of The Smart Home Show podcast. Connor Bolton is a graduate research assistant in computer science at the University of Michigan.