Maintworld 2/2017

CYBERSECURITY
Digital Automation
System Maintenance
and Cybersecurity
– the Perfect Partnership?
In the last years, the number of cyber-attacks has
increased dramatically. In light of this, it is not
surprising that organizations are increasingly looking
to invest in cybersecurity.
ROBERT VALKAMA,
Senior information
security consultant at
Nixu Corporation,
robert.valkama@nixu.fi
WHAT DOES a cyber-attack mean to you?
The term brings many different mental
images; from pizza driven nerds in a dark
basement to organized operations funded
and supported by state level actors.
The intents for attacks vary greatly; from
opportunistic hacking or showing off for
friends to pursue of financial benefit and
to well organized disruption of a specific
physical function.
Even in the best-case scenario,
cyber-attacks in industrial automation
are highly inconvenient. An example of
such a scenario would be an inadvertent
attack, where malware intended for
ordinary ICT systems enters a production
environment, causing disruptions
40 maintworld 2/2017
and production downtime. Example of
this type of an attack is a crypto malware
infecting the HMI systems. In the worstcase
scenario, the attack is intentional
and causes total destruction, incurring
substantial replacement and recovery
costs both in terms of time and money,
i.e. jeopardizing safety.
Despite the intent of the attack, there
are steps that can be taken in order to
make it harder for the adversary to succeed
in the attack. Securing industrial
systems requires both technical and administrative
controls to be put in place
(essentially in the same way as securing
ICT systems, but with slightly different
emphasis), and in many cases, these controls
also benefit the maintenance of the
systems.
Mutual benefits
When it comes to automation systems,
the goals of cybersecurity and maintenance
are practically the same: ensuring
error-free production and safety. The essence
of automation systems is that they
operate in the right way at the right time.
In some industries, automation system’s
cybersecurity also includes protecting
intellectual property. In practical terms,
this means protecting manufacturing
processes’ run parameters from information
leaks.
Cybersecurity controls can also have