How to securely implement digital transformation for manufacturing processes

Digital transformation is more of a journey than a destination. Because of the constantly evolving nature of cybersecurity risks, digital transformation, information technology (IT)/operational technology (OT) convergence and cybersecurity best practices must stay continually vigilant. Larry Grate, GICSP, director of technology at EOSYS (formerly PREMIER System Integrators Inc.), offers guidance for the secure digital transformation journey.

CFE Media: Should IT security be involved in my digital transformation project?

Larry Grate: When IT is not involved, it has been our experience that decisions are often made to avoid IT engagement, which either reduces the effectiveness of the solution, increases the risk, or both. As a result, we encourage our OT-centric customers to include IT in the planning process. Your IT department has a vested interest in your Industrial Internet of Things (IIoT) solution being appropriately architected, developed and commissioned.

Since they manage your business systems, any integration with those solutions will require their engagement. We have found IT/OT language barriers are a consistent challenge. The same words sometimes have different definitions depending on your perspective, so taking the time to define terms up front and set reasonable expectations will result in a working relationship that sets your transformation team on a road to success.

CFE Media: What standards exist to provide direction for my manufacturing (OT) network architecture?

Grate: The document we typically recommend is the Rockwell/CISCO CPwE validated design document. While focused on the use of Cisco technology, the architecture and concepts can be applied to any switch hardware vendor. Additionally, the application of IEC 62443, specifically around segmentation through the zones and conduit model, is key to providing sufficient horizontal and vertical segmentation in the OT network to allow for the implementation of appropriate security controls based on risk.

CFE Media: Why is an OT-focused risk assessment important?

Grate: An OT-focused risk assessment, performed with operations, maintenance and engineering alongside security personnel is key to understanding the business risk associated with your process. This starts with identifying the key threat actors to be concerned with, and then working through the different ways they could nefariously or accidentally harm processes. Finally, you will work through your existing security controls and identify new controls required to reduce your business risk to a tolerable level.

CFE Media: What are the key security controls for an implementation?

Grate: Security is always a journey; this is never truer than when dealing with manufacturing or OT systems. It is almost impossible to identify key controls in the absence of the risk assessment previously discussed. With that said, it is important to note that with rare exceptions, most manufacturing systems are insecure by design. They are open and often don’t require authentication, and their network traffic is unencrypted, making it vulnerable to anyone who can get on the wire physically or as a remote user.

As a result, it’s important to remember the manufacturing traffic should never be allowed out of the OT network. At a minimum, deploy a firewall between your manufacturing and enterprise networks, preferably with an industrial demilitarized zone (IDMZ) and appropriate application gateways used to enforce protocol conversion from something insecure by design to something secure by design. Appropriate deployment of an authentication mechanism, along with a way to synchronize time is also critical. Finally, deploy appropriate monitoring tools to allow inspection of all the traffic entering and leaving your manufacturing network.

Do you have experience and expertise with the topics mentioned in this content? You should consider contributing to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.