Pilz: IEC 62443 – Industrial Information Security Standard (Part II)

In the context of industrial automation, the term "safety" refers to the functional safety of equipment, which means that people and the environment are protected from damage from foreseeable coercion from machines, and the residual risk is more or less always present, but the residual risk cannot exceed the acceptable level. By using components such as safety relays and safety switches, we ensure that the machine is in a safe state and does not cause damage to people, machines, or the environment, even if problems occur.

The history of the hijacking of industrial information security

With the integration of IT technology, equipment is also facing the coercion from the network world, and the coercion of industrial information security mainly comes from the following three aspects:

1. External attacks

a. Malicious cyber attacks

b. Industrial espionage

c. Ransomware

1. Insider attacks

a. Implanting malware through USB flash drives, etc

b. Treating employees as voluntary by deceiving them into trust

1. Unintentional violations

The equipment is equipped at fault, or it may be misoperated

Enforcement of security policies

In terms of security protection strategies, hardware-related methods are as follows:

1. Firewall

One way to enforce a security strategy is to protect the network with dedicated devices. While routers and switches can support security mechanisms, firewalls still play an important role. In this case, software solutions or devices (a combination of hardware and software) that monitor the entire data traffic according to individually defined rules and have functions such as deep packet inspection or intrusion detection. Firewalls are often complex and require a lot of IT knowledge, which is something that is lacking in the production department.

2. Zones and passages

Networks are differentiated by "zones and channels", i.e. by separating the handling network from the production network. If required, the network can also be segmented into individual manufacturing units, where devices with the same security requirements are grouped into the same area, and then these areas are blocked from each other by firewalls or security routers, so that only the appropriate authorized devices can send and receive information through the lines (channels) between the zones.

Pilz: IEC 62443 – Industrial Information Security Standard (Part II)

　　3. Protection-in-depth

The principle is based on the fact that new and different obstacles are always set up in the path of the aggressor. The areas and passages of the network are equivalent to the gates of the castle, and the security devices of different security mechanisms, such as firewalls and security routers, act as walls and other obstructions, forming a multi-level "fortification" of deep protection.

　　4. Patch handling

Timely updates and patches can help reduce the risk of the system being exposed to the latest cyber hacks. In addition, consider not only patches and updates released by manufacturers, but also third-party software (e.g., Office applications, PDF readers).

Industrial security solutions from Pilz

Pilz also attaches great importance to the field of industrial information security, and has launched a series of products, such as the operation form selection and access authorization system PITmode fusion, the modular safety gate system, the PNOZmulti 2 small controller, the firewall industrial safety bridge, etc., which can provide comprehensive security solutions according to the practical needs of users, including mechanical safety requirements, information and data security requirements, and can also define different permissions for employees according to different personalities. Ensure that employees are not exposed to the risks that may arise from the machine, and that the machine is not affected by operator error (unintentional mistakes) and operation (intentional actions).

1. PITmode fusion can help you protect your equipment and machines from unauthorized access and prevent damage to your equipment due to improper use. In addition to controlling access rights with PITreader, you can also use PITmode fusion to select functionally safe forms of operation. Unify safety and protection functions in a single system.

2. If an external intruder can hack into your control network and operate the control system, even the most secure access control for your equipment and machines will be a no-brainer. SecurityBridge is an industry-standard firewall developed by Pilz, a plug-and-play plan that can be easily put into use with application-specific presets that protect controller data from tampering. It monitors the data flow between the PC and the controller and reports unauthorized changes to control items. In this way, the inferior controller is protected from network-based intrusions and unauthorized access.

Pilz: IEC 62443 – Industrial Information Security Standard (Part II)

Sections viewed

Contact

working hours