ENISA today publishes a study on good practices for IoT security, with a focus on smart manufacturing and Industry 4.0.
The fourth industrial revolution (Industry 4.0) is closely associated with the topic of cybersecurity. A rapidly increasing number of Industry 4.0 cybersecurity incidents emerge, additionally stressing the need to strengthen cyber resilience.
This is particularly true for industrial operators who are beginning to utilise the Internet of Things (IoT) and Industry 4.0 solutions. The need to improve cybersecurity of Industry 4.0 is even more important, since the potential impact of relevant threats ranges from compromising physical security to production downtimes, spoilage of products to damaging equipment as well as ensuing financial and reputational losses.
The guidelines and security measures listed in this study by ENISA aim at improving the cybersecurity posture of Industry 4.0 organisations that have adopted or plan to adopt industrial IoT devices and solutions that enhance automation in industrial operations. These security measures apply to a wide audience, spanning from industrial IoT operators to manufacturers/vendors, which can utilise these measures and recommendations as a checklist to examine their security setup regarding their Industry 4.0 solutions.
Steve Purser, head of Core Operations Department at ENISA, said: “The advanced digitalisation envisaged within the Industry 4.0 framework is a paradigm shift in the way industries operate and blurs the boundaries between the physical and digital world. With a great impact on citizens’ safety, security and privacy due to its cyber-physical nature, the security challenges concerning Industry 4.0 and IoT are significant. Today, ENISA publishes the study that addresses those challenges and, combined with the baseline IoT security work, lies the foundations for a secure industrial IoT ecosystem. IoT, together with Industry 4.0 cybersecurity, are the springboard for a safer and more resilient connected world.”
The study makes a series of contributions. Most notably, it
- defines relevant terminology (i.e. terms such as Industry 4.0, smart manufacturing, industrial IoT),
- categorises the Industry 4.0 assets in a comprehensive taxonomy across the manufacturing process and value chain,
- introduces a detailed Industry 4.0 threat taxonomy based on related risks and attack scenarios, and
- lists security measures related to the use of IoT in smart manufacturing and Industry 4.0 and maps them against the threats and affected assets.
Additionally, the study presents existing security initiatives, standards and schemes. ENISA reviewed more than 150 resources on Industry 4.0 and IoT security and mapped them against the security measures proposed in this study. As a result, interested readers, who are nowadays facing a fragmented information landscape, will get a better overview resulting in a common basis of understanding.
The agency considered the security of Industry 4.0 devices and services throughout their whole lifecycle (from conception to end-of-life and decommissioning) and took into account the requirements that are specific for an Industry 4.0 environment. The study lists 110 security measures across 20 different security
domains, spanning from security and privacy by design to third-party and vulnerability management and access control and monitoring.
With this study, ENISA aims at setting the scene for Industry 4.0 and industrial IoT cybersecurity across the European Union to promote necessary collaborations and raise awareness of relevant threats and risks, with a focus on “security for safety”.
Download the report here.
Contact
For press questions and interviews, please contact: press@enisa.europa.eu.