{"id":2174,"date":"2018-08-12T19:57:24","date_gmt":"2018-08-12T17:57:24","guid":{"rendered":"https:\/\/staging.blogs.yokogawa.de\/chemical-pharma\/uncategorized\/plant-security-perfect-fit-protection-for-your-crown-jewels\/"},"modified":"2025-03-14T12:05:00","modified_gmt":"2025-03-14T11:05:00","slug":"plant-security-perfect-fit-protection-for-your-crown-jewels","status":"publish","type":"post","link":"https:\/\/www.yokogawa.com\/eu\/blog\/chemical-pharma\/en\/plant-security-perfect-fit-protection-for-your-crown-jewels\/","title":{"rendered":"Plant security \u2013 perfect-fit protection for your crown jewels"},"content":{"rendered":"

Almost every industry is traversing the cycle of digital transformation \u2013 the<\/em> mega trend in the twenty-first century! Improved productivity, more flexibility, high customer satisfaction and the establishment of new business models are just a few examples of the numerous potential success prospects which are created. According to a Bitkom<\/a> study, more than 90% of all companies in Germany see digitalization as a fantastic opportunity. (Document: Digitale Transformation der Wirtschaft (2nd Edition) Berlin, 11 July 2017<\/a>; page 14)<\/p>\n

Digital transformation <\/strong><\/h3>\n

Of course, there are also a few uncertainties. The increasing professionalism of cybercriminals coupled with the steady rise in cyber attacks is causing considerable concern in the business world. No wonder \u2013 a representative study by Bitkom, Germany\u2019s digital association, in summer 2017 revealed that more than one in every two companies has been the victim of an online attack during the last two years. 53 percent of German firms have been hit by industrial espionage, sabotage or data theft. The damage adds up to some 55 billion euros a year.<\/p>\n

The \u201cshotgun\u201d approach <\/strong><\/h3>\n

It can happen to virtually anyone \u2013 large corporations and mid-market players in every sector of the economy. It\u2019s obviously very tempting for cybercriminals to focus their attacks on companies which simply don\u2019t have the capacity to implement a security concept as sophisticated as that of a multinational group. Yet unfortunately, even the biggest organizations are not immune because many cyber attacks are not targeted but carried out en masse according to the \u201cshotgun\u201d approach. \u201cWannaCry is a good example here \u2013 an aggressive ransomware campaign that went viral, so that it was impossible to predict where it would spread to next.<\/p>\n

Significance for critical infrastructures (KRITIS)<\/strong><\/h3>\n

Critical infrastructures (KRITIS) are organizations and facilities of major importance for society, whose failure or impairment would cause a sustained shortage of supplies, significant disruptions to public order or other dramatic consequences. (Source: BSI<\/a>)<\/p>\n

The availability and security of IT systems plays a central and immensely important role when it comes to critical infrastructures!<\/p>\n

A key enabler for the digital transformation \u2013 plant security\u00a0<\/strong><\/h3>\n

Plant security is the foundation that is necessary in order to capitalize on the significant opportunities, and master the challenges, presented by digitalization. Innovative, digital business processes can be driven forward agilely, flexibly and above all SECURELY in this way!<\/p>\n

Yokogawa\u2019s plant security portfolio<\/strong><\/h3>\n

It\u2019s probably crystal clear to anyone that functional safety (IEC 61511<\/a>) is a \u201cmust-have\u201d for safety instrumented automation solutions. However, cyber security \u2013 protection against cyber attacks \u2013 is no less crucial. There are two different aspects to safety and security which can be differentiated as follows: functional safety refers to the protection of people, equipment and the environment whereas cyber security comprises the availability, integrity, and confidentiality of a plant\u2019s IT components \u2013 in exactly the reverse order in industrial automation compared to ordinary IT! The aim is to shield the IT in an industrial plant from cyber threats. A combination of functional safety and cyber security is necessary to achieve holistic protection.<\/p>\n

Yokogawa\u2019s plant security portfolio conforms to international standards and recommendations such as the International Electrotechnical Commission (IEC) 62443<\/a>, national recommendations, e.g. NAMUR (NE) 153 and 163<\/a> or the German Federal Office for Information Security (BSI)<\/a> \u2013 especially with regard to critical infrastructures (KRITIS).<\/p>\n

All of this is reconciled with your individual requirements as the starting point for the perfect plant safety concept.<\/p>\n

IEC 62443<\/strong><\/h3>\n

This standard lays the foundation for an integrated view of plant security that encompasses the entire lifecycle of an automation solution. The plant system, including all safety relevant components, must be protected against unauthorized access, so that cybercriminals are left without a target! IEC 62443<\/a> also addresses the protection of networks within automation systems. The standard calls for the system as a whole to be partitioned into security zones. Secure conduits are specifically defined between these zones and protected by firewalls. The requirements vary according to the security levels of the individual zones. This structure results in a multilayer system of different defense mechanisms (also referred to as \u201cdefense in depth\u201d). The firewalls are hardened according to the required security level.<\/p>\n

Defense in depth<\/strong><\/h3>\n

\u201cDefense in depth<\/a>\u201d is the coordinated placement of multiple security mechanisms to protect a company\u2019s databases. This strategy is based on the military principle which states that it is more difficult for an enemy to overcome a complex and multifaceted defense system. Defense-in-depth strategies typically include components such as antivirus software, firewalls, anti-spyware programs, a multilevel password system, intrusion detection mechanisms and biometric recognition systems. Along with countermeasures on the IT side, physical protection of a company\u2019s facilities also makes business critical information more secure against theft or destruction in conjunction with comprehensive, ongoing training for all employees.<\/p>\n

\"Plant
Yokogawa Lifecycle Performance Care Services<\/figcaption><\/figure>\n

NE 163 \u2013 Security risk assessment of SIS (safety instrumented systems)<\/strong><\/p>\n

This Namur recommendation<\/a> represents a practical and minimally disruptive method for assessing IT risks (i.e. the availability of the plant is maintained. A security risk assessment provides a starting point for increasing the resistance of safety instrumented systems to IT threats. Any weaknesses which exist are identified and specific improvements suggested.<\/p>\n

The method described here (based on ISO\/IEC 27005<\/a> and IEC 62443 3-2<\/a>) checks whether suitable security mechanisms are applied, particularly those defined in IEC 61511-1<\/a>, VDI\/VDE 2180<\/a>, VDI\/VDE 2182<\/a>, IEC 62443<\/a> and the BSI ICS Security Compendium<\/a>.<\/p>\n

IEC 62443 \u2013 the international canon \u2013 comprises four key pillars laid down by the cyber security concept: General + Policies & Procedures + Cyber Security Management\u00a0 (System Security + Component Security).<\/p>\n

In keeping with IEC 62443, we begin by carrying out the following steps together with you:<\/h3>\n
    \n
  1. Assessment & Analysis<\/li>\n
  2. Design & Implementation<\/li>\n
  3. Operation Support<\/li>\n
  4. Validation Support<\/li>\n<\/ol>\n

    These steps are important in order to comply with international industrial standards (IEC 62443) and eventually be certified. The big advantage for you is that by taking this approach, we establish security compliance at your company. You profit from clear processes which you can leverage to make your business fit for digitalization. Capture this competitive advantage.<\/p>\n

    \"Yokogawa
    Yokogawa Lifecycle Performance Care Services<\/figcaption><\/figure>\n

    Plant security is an issue that concerns the company as a whole.
    \nAre you fumbling in the dark? Profit from our rich expertise in the automation sector. We\u2019d be delighted to inform you how you can realize a 360\u00b0 security concept featuring state-of-the-art technology in line with international standards and simultaneously increase security awareness at your company, so that your entire organization is optimally protected against both internal and external threats.<\/p>\n

    Side note: The European legal basis \u2013 the General Data Protection Regulation (GDPR)<\/p>\n

    A few words about the GDPR<\/h3>\n

    We take a holistic view of security. That means we keep a close watch on all current, legally relevant developments and integrate them into our concept accordingly. We\u2019d therefore like to take this opportunity to say a few words about the GDPR:<\/p>\n

    The General Data Protection Regulation (GDPR)<\/a> of the European Union is the new, EU-wide regulation on data protection which becomes enforceable on 25 May 2018. It gives more control to citizens and residents over their personal data, creates transparency regarding data use and stipulates security mechanisms and checks to protect information. With just 88 pages, it is a decidedly slender document for a European regulation \u2013 but one which will greatly simplify the regulatory environment for businesses within the EU. It applies not only to European companies but also to organizations based outside of the EU: Facebook<\/a>, Alibaba<\/a> & Co. must in future abide by this general regulation if they collect or process personal data of individuals located inside the EU. Failure to comply with the GDPR will result in severe penalties of up to 4% of worldwide turnover or \u20ac20 million, whichever is higher.<\/p>\n

    Key questions \u2013 Which personal data do you process today?<\/strong><\/h3>\n
      \n
    • Customer databases<\/li>\n
    • Feedback forms<\/li>\n
    • Emails<\/li>\n
    • Photos<\/li>\n
    • Surveillance videos<\/li>\n
    • HR databases<\/li>\n
    • Log files<\/li>\n
    • Backups \/ archives<\/li>\n
    • For what purpose was this data stored?<\/li>\n
    • Where was this data stored?<\/li>\n
    • How long is this data stored for?<\/li>\n
    • Personal data for marketing purposes \u2013 prize competitions \/ Christmas cards \/ newsletters<\/li>\n<\/ul>\n

      If you\u2019d like to learn more about security, click here. We hope you enjoy browsing!<\/p>\n

      \n

      Plant security \u2013 the decisive move<\/a><\/p><\/blockquote>\n