Security that’s tangible – Pilz Austria on tour

After the cyber attack on Pilz in 2019, nothing was as it was before: com­mu­ni­ca­tion both inter­nally and with our cus­tomers broke down, valu­able data was encrypted and unus­able. Access to com­pany com­puters, including those of inter­na­tional sub­sidiaries, was also restricted. Pro­duc­tion at the Ost­fildern site was ini­tially halted.

Cyber threats have increased sig­nif­i­cantly in recent years. Leg­is­la­tors have also reacted, recog­nising that a secu­rity inci­dent can have serious con­se­quences for human, machine and com­pany: from pro­duc­tion down­times and data loss through to haz­ards to employees who operate the machine. Indus­trial Secu­rity will become manda­tory.

“Many medium-sized com­pa­nies were in the same sit­u­a­tion as Pilz at the time. We have learned from this, and are passing on the knowl­edge we gained to our cus­tomers,” says Mar­i­anne Ecker, Mar­keting Man­ager at the Pilz sub­sidiary in Aus­tria.

First-hand Security

The Pilz sub­sidiary, with branches in Vienna, Graz and Linz, pro­vides its cus­tomers with com­pre­hen­sive training courses on Secu­rity and also helps them imple­ment and improve risk assess­ments on plant and machinery. With around 40 employees, they have their own Indus­trial Secu­rity depart­ment, which now runs the “Safety & Secu­rity on Tour” pro­gramme, for example. This is a free event that runs annu­ally throughout the region, where experts from Pilz Aus­tria pro­vide infor­ma­tion about the latest devel­op­ments in Machinery Safety and Indus­trial Secu­rity. This year’s topics include inno­va­tions in Safety and Secu­rity (EN ISO 13849 and prEN 50742), a demo of IO-Link tech, details of how to carry out a gap analysis, through to CE marking in accor­dance with the Machinery Reg­u­la­tion and Cyber Resilience Act.

David Machanek, Gen­eral Man­ager at Pilz Aus­tria, is delighted with the pos­i­tive response to the Safety and Secu­rity Tour: “This is now the third year that we have run these events, and the con­tin­uous stream of inter­ested cus­tomers shows us that we are hit­ting an impor­tant nerve for our times with this format. In par­tic­ular, our cus­tomers appre­ciate the prac­tical insights into cur­rent Safety require­ments and the com­bi­na­tion of Safety and Secu­rity aspects.”

Security requirements overwhelm machine operators

The main problem with com­pa­nies is often that they don’t view Secu­rity holis­ti­cally, encom­passing both tech­nology and organ­i­sa­tion. Small busi­nesses often employ an external ser­vice provider for IT Secu­rity, but often they only take care of the com­pa­ny’s net­works and devices. Machines are also con­trolled by com­puters, so there are risks to the cyber­se­cu­rity of machines and their indi­vidual com­po­nents, but often this is not on the plant oper­a­tors’ radar. Also, higher-level busi­ness processes are often not taken into account.

“It’s impor­tant not to over­load the com­pa­nies affected, as there are many require­ments that will come into effect from 2027. This can be over­whelming, par­tic­u­larly for a com­pany with around 50 or more employees. A com­pany that man­u­fac­tures machinery, employs at least 50 people or achieves a cer­tain turnover or bal­ance sheet total must comply with the Machinery Reg­u­la­tion, the Cyber Resilience Act and the second EU direc­tive on net­work and infor­ma­tion secu­rity, known as ‘Net­work and Infor­ma­tion Secu­rity Direc­tive 2’, or NIS 2 for short,” explains Andreas Willert, Head of Indus­trial Secu­rity at Pilz Aus­tria.

At Pilz Aus­tria, the first step is to work with the cus­tomer to analyse the indi­vidual busi­ness processes. “Our top pri­ority is always what’s most impor­tant to our cus­tomers,” Andreas Willert is keen to stress. The second step is then to develop an indi­vidual Secu­rity con­cept by analysing the net­work infra­struc­ture and poten­tial risks.

Pilz is getting fit for the Cyber Resilience Act

Com­pa­nies in the mechan­ical engi­neering sector cur­rently face the chal­lenge of imple­menting the require­ments of the Cyber Resilience Act. With this in mind, the sub­sidiary is devel­oping inter­nally through appro­priate training. Col­leagues from sales and tech­nology, for example, are qual­i­fying as Cer­ti­fied Experts for Secu­rity in Automa­tion (CESA). This ben­e­fits our cus­tomers, as we can always keep them up to date with the latest stan­dards and direc­tives.