IT in Manufacturing


Is your enterprise secure?

November 2016 IT in Manufacturing

Manufacturing and industrial facilities are operating in ways they scarcely could have imagined a few decades ago. Greater connectivity and information sharing is significantly transforming companies and their operations. They are converging IT and operations technology (OT) systems and using new technologies such as mobile, analytics, cloud and virtualisation to do more than ever before.

However, just as the nature of manufacturing and industrial operations has changed, so have the security risks. More connected operations can create more potential entrance points for security threats. These threats can come in many different forms – physical or digital, internal or external, malicious or unintentional.

As a result, industrial security must be holistic. It should extend from the enterprise through the plant level and even out to end devices, and address risks across people, processes and technologies. It should also involve collaboration between IT and OT personnel. Both sides have vital roles to play.

An holistic approach

Three key elements of an holistic approach to security include:

1. Security assessment: conduct a facility-wide assessment to understand risk areas and potential threats.

2. Defence-in-depth approach: deploy a multi-layered security approach that establishes multiple fronts and tiers of defence.

3. Trusted vendors: verify that automation vendors follow core security principles when designing their products.

Security assessment

Developing and implementing an effective industrial security programme requires that users first understand the risks and areas of vulnerability that exist within an organisation.

A security assessment will help to understand the current security posture regarding software, networks, control system, policies and procedures, and even employee behaviours. It should be the starting point for any security policy. At a minimum, a security assessment should include the following:

• An inventory of authorised and unauthorised devices and software.

• Detailed observation and documentation of system performance.

• Identification of tolerance thresholds and risk/vulnerability indications.

• Prioritisation of each vulnerability based on impact and exploitation potential.

The final outcome of any security assessment should include a documented and actionable list of mitigation techniques required to bring an operation to an acceptable risk state.

Defence-in-depth security

Industrial security is best implemented as a complete system across operations, and a defence-in-depth (DiD) security framework supports this approach. Based on the notion that any one point of protection can and likely will be defeated or breached, DiD security establishes multiple layers of protection through a combination of physical, electronic and procedural safeguards.

A DiD security approach consists of six main components including: defined policies and procedures, physical security, network infrastructure, computer/software, application, and device authentication and identification.

Trusted vendors

Automation vendors are just as integral to helping you meet security goals as they are to production, quality and safety goals. Before selecting vendors, request they disclose their security policies and practices. Consider if they follow five core security principles for designing products used in a control system. These include:

• A secure network infrastructure: vendors can help keep information in the automation layer secure and confidential. For example, embedded technology can validate and authenticate devices before they are granted access to a network.

• Authentication and policy management: company policies dictate data access levels for employees. Automation products can support these policies using access control lists to manage user access to devices and applications.

• Content protection: intellectual property is the lifeblood of operations. Automation solutions can help protect it by assigning passwords to routines and add-on instructions, and by using digital rights management to limit users’ ability to view and edit device data.

• Tamper detection: built-in tamper detection can detect any unauthorised system activity and alert the right personnel. It also can log key details, such as where the attempted intrusion took place, how it occurred and if anything was modified.

• Robustness: a robust vendor security approach includes providing security training to employees, using design-for-security development practices, and testing products to global security standards. It also includes conducting final security reviews before products are released, verifying processes stay current with standards and technologies, and having a plan in place to address vulnerabilities.

Monitor and evolve

Security threats are not relenting. They will only continue to evolve as the industry changes its security practices or implements new defences. A good risk management strategy must keep pace, and should be ongoing, and evolve with or ahead of the changing threat landscape.

With the continual evolution of operations toward greater connectivity, the vastness of today’s security concerns can be daunting. The approaches outlined here can help align the company with best industry practices for protecting intellectual property, facilities, assets, employees and competitive advantages.

For more information contact Christo Buys, Rockwell Automation, +27 (0)11 654 9700, [email protected], www.rockwellautomation.co.za



Credit(s)



Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Revolutionising mining operations with MineOptimize
IT in Manufacturing
Now more than ever, mining and mineral processing companies need to boost productivity, ensure safety, and protect the environment. ABB’s comprehensive electrification, automation and digital solutions portfolio is ideally positioned to meet these challenges across all mining processes, from mine to port, transforming performance in a digital world.

Read more...
Buildings in Africa’s urban evolution
Schneider Electric South Africa IT in Manufacturing
Africa is now an urban continent. How does the continent mobilise to accommodate urban dwellers and maintain and implement critical infrastructure that allows for this expansion? Building management systems provide a tangible solution to optimise resource use, lower operations costs and ultimately contribute to a growing continent that also employs green practices.

Read more...
TwinCAT Vision functionality extended
Beckhoff Automation IT in Manufacturing
The image processing and camera integration capabilities of Beckhoff’s TwinCAT 3 Vision software have been expanded.

Read more...
Automation software to future-proof your operations
Adroit Technologies IT in Manufacturing
As the official partner of Mitsubishi Electric Factory Automation, Adroit Technologies empowers businesses with cutting-edge solutions that reduce costs, improve quality and increase productivity.

Read more...
Siemens automation portfolio, your bridge to the industrial metaverse
Siemens South Africa IT in Manufacturing
Step into the future with Siemens’ automation portfolio, your bridge to the industrial metaverse. Our cutting-edge solutions integrate AI, digital twins and real-time simulation, driving smarter, more efficient production.

Read more...
Transform your manufacturing efficiency
TransLution Software IT in Manufacturing
MÄDLER offers a wide range of gears in various materials, modules and designs, available directly from stock.

Read more...
Optimise the cutting of metal materials
IT in Manufacturing
KRON Cutting is a comprehensive web-based system designed to optimise the cutting of metal materials, including rebar, pipes and profiles.

Read more...
Black Rock Mining centralises mining operations with AVEVA
IT in Manufacturing
Black Rock Mine Operations replaced and upgraded its existing infrastructure, and installed additional capacity to expand production from 3 to 4,6 million tons in three years. The new system is powered by a suite of AVEVA solutions.

Read more...
The strategic role of technology in today’s economy
IT in Manufacturing
In an era of economic uncertainty and persistent market volatility, businesses are under immense pressure to manage costs while maintaining operational effectiveness. The role of chief information officers and chief technology officers has never been more critical, as they are tasked with leveraging technology not just as a tool for efficiency but as a strategic asset in navigating these turbulent times.

Read more...
Minutes to meltdown: surviving a cyber attack
IT in Manufacturing
Commvault recently hosted its Minutes to Meltdown event. Led by the company’s security experts, this was an interactive and detailed ransomware attack simulation designed to help companies understand how to respond in the event of a cyber attack.

Read more...