Comprehensive service for Industrial Security

With digi­ti­sa­tion and net­working, the risk of machinery being affected by secu­rity inci­dents increases. They are not always tar­geted attacks from out­side; internal manip­u­la­tion can also damage machinery. Leg­is­la­tors have recog­nised the impor­tance of secu­rity. This is reflected in the new Machinery Reg­u­la­tion, for example: In order to import machinery into Europe, machine builders have always had to undergo the con­for­mity assess­ment pro­ce­dure, ending with the CE mark. In accor­dance with the new reg­u­la­tion, machine builders must prove that their machines are not only func­tion­ally safe, but are also pro­tected against manip­u­la­tion. This means: secu­rity is a legal require­ment in future!

On the other hand, secu­rity is uncharted ter­ri­tory for many com­pa­nies: there is a knowl­edge gap, so there are no strate­gies; respon­si­bil­i­ties are often not defined. So what to do?

“The new Machinery Reg­u­la­tion is a good oppor­tu­nity for machine builders and oper­a­tors to deal with Indus­trial Secu­rity”, explains Bernd Eisen­huth, Senior Con­sul­tant Busi­ness Areas at Pilz. For this is the first time a spe­cific require­ment will be set, and a frame­work spec­i­fied.

Because machinery in future no longer needs to be just Safe, but also Secure, Eisen­huth and his team will offer a ser­vice to advise and sup­port com­pa­nies on Indus­trial Secu­rity. This will be avail­able ini­tially in Ger­many, but will be offered world­wide from next year.

Proven methodology from machinery safety

Pilz has devel­oped the Indus­trial Secu­rity Con­sulting Ser­vice, building on the proven method­ology for machinery safety ser­vices and based on the secu­rity stan­dard series IEC 62443. Once com­pa­nies have used this ser­vice, they will be well equipped in terms of Indus­trial Secu­rity, and will meet the cur­rent legal require­ments.

Modular service for the protection of human and machine

Ini­tially, the ser­vice package will con­sist of the fol­lowing mod­ules: Pro­tec­tion Require­ments Analysis, Indus­trial Secu­rity Risk Assess­ment, Indus­trial Secu­rity Con­cept and Indus­trial Secu­rity System Ver­i­fi­ca­tion.

The Pro­tec­tion Require­ments Analysis is the first step towards Indus­trial Secu­rity. It is used to iden­tify the applic­able stan­dards and reg­u­la­tions, define the scope of the plant or machine to be pro­tected and deter­mine the system’s pro­tec­tion goals. Bernd Eisen­huth explains what cus­tomer can expect in this first step:

As with machinery safety, this is fol­lowed by a Risk Assess­ment. Here it is a case of iden­ti­fying all the risks for each sub­sec­tion over the system’s com­plete life­cycle. Vul­ner­a­bil­i­ties and poten­tial haz­ards are doc­u­mented. Pilz experts dis­cuss the result and poten­tial solu­tions with the cus­tomer:

In step 3, experts from Pilz create an Indus­trial Secu­rity Con­cept. This describes poten­tial strate­gies for repelling or mit­i­gating haz­ards. Specif­i­cally, work­flows for coun­ter­mea­sures are devel­oped, and a check looks at which indi­vidual mea­sures make sense – from user authen­ti­ca­tion and phys­ical pro­tec­tive mea­sures to backing up and restoring data. In addi­tion, poli­cies, rules and guide­lines are cre­ated for the con­tinued “safe” oper­a­tion of the system over the whole life­cycle:

The fourth and final step is the Indus­trial Secu­rity System Ver­i­fi­ca­tion. This checks the effec­tive­ness of the imple­mented coun­ter­mea­sures. The results, including any poten­tial dis­crep­an­cies, are recorded in a test report. The cus­tomer can rest assured that the con­cepts and mea­sures also work in prac­tice.

The Indus­trial Secu­rity Con­sulting Ser­vice from Pilz expands the pre­vious safety-related inspec­tion of machines that focused on func­tional safety, to create a holistic approach to Safety and Secu­rity. Machine builders and users receive a ser­vice package from Pilz, which takes into account all aspects for the pro­tec­tion of human and machine.

Specif­i­cally, users ensure the avail­ability and integrity of their machinery and system, so that the integrity of the machine, processes, and ulti­mately the end product, is guar­an­teed.

How­ever, Bernd Eisen­huth has another, quite per­sonal, moti­va­tion: “Our greatest incen­tive is always the pro­tec­tion of humans, because without Indus­trial Secu­rity, func­tional safety mea­sures can be defeated. Nobody should be injured by automa­tion.”