“There is much uncertainty”

Mr Pilz, is industrial security now equally as important as safety?

Thomas Pilz: Without indus­trial secu­rity, safety would no longer be pos­sible. In the past the two fields were con­sid­ered sep­a­rate enti­ties, but now indus­trial secu­rity encom­passes safety and ensures its integrity. This rethinking can be clearly seen in the ongoing revi­sion of the Machinery Direc­tive, as in the new ver­sion secu­rity is under­stood to be part of the safety chain. And I whole­heart­edly agree with this.

But there is still a fundamental difference in the understanding of the two terms, ­safety and security, right?

Exactly. When it comes to safety, one assumes that a person is injured due to a mechan­ical move­ment, but there is no mali­cious intent behind their actions and they are at worst grossly neg­li­gent. With secu­rity this is totally dif­ferent, as mali­cious intent is assumed: A crim­inal wants to damage the machine.

What are the implications for risk assessment?

First we must assume that the risk to secu­rity is always present and that we must always be on guard. Safety is posi­tioned oppo­site to this, where pos­sible risks can be detected and rec­ti­fied through reg­ular checks. This nat­u­rally also affects the risk assess­ment. We at Pilz are con­vinced that a holistic approach is nec­es­sary, as the terms safety and secu­rity – as pre­vi­ously stated – are inter­woven. Our experts have been trained on this and point out pos­sible risks and vul­ner­a­bil­i­ties as well as appro­priate mea­sures in dis­cus­sions with cus­tomers.

You already mentioned that the standards are changing with regard to security. What do you think is the situation when it comes to awareness: Do you find that operators are doing enough to protect their plants?

Aware­ness is changing, par­tic­u­larly with the increase in hacker attacks since 2017. After all, every prof­itable com­pany can become the target of this type of attack. With the imple­men­ta­tion of Indus­trie 4.0 and the Internet of Things with per­ma­nently net­worked machines, the threat level is crit­ical if no mea­sures have been taken. But we have noticed that there is much uncer­tainty when it comes to dealing with secu­rity. That is why our holistic approach to safety and secu­rity is so impor­tant to us and we would like to improve our cus­tomers’ and part­ners’ aware­ness of this topic. Taking action early on means being pro­tected against manip­u­la­tion or attacks, thereby ensuring not only the safety of humans and machinery but also the pro­duc­tivity.

What challenges come along with ­security? Is it enough to always supply ­machines with the latest updates?

That is an inter­esting ques­tion because it seems obvious that part of cyber secu­rity would be keeping soft­ware up to date. In reality, how­ever, this is not always nec­es­sary, or can even lead to a lim­i­ta­tion of pro­duc­tivity. Before an oper­ator per­forms updates on their older machine – and thus brings man­u­fac­turing to a stand­still – it is worth­while to ask whether the machine should be net­worked with other machines or whether it can work as a “stand-alone”. If the latter is the case, the latest soft­ware state is not absolutely nec­es­sary. If net­working is required, reg­ular updates increase the safety and secu­rity. Highly gran­ular seg­men­ta­tion of the OT net­work and the use of fire­walls such as our Secu­ri­ty­Bridge also offer addi­tional pro­tec­tion. This appli­ca­tion fire­wall pro­tects indus­trial automa­tion net­works against manip­u­la­tion and ­enables pro­tected con­nec­tions, e.g. in a cloud.

WiHow can older machines be made safe and secure?

Retro­fitting is gen­er­ally rel­a­tively simple: ­Secu­ri­ty­Bridge, for example, can be quickly set up by an elec­tri­cian or qual­i­fied IT per­sonnel thanks to the auto-con­fig­u­ra­tion. Another impor­tant topic is the con­trol of access per­mis­sions so that only autho­rised per­sons have access to a process. With the devices from the PIT­mode range, safe oper­ating modes and access per­mis­sions can be imple­mented with high flex­i­bility and in accor­dance with our cus­tomers’ respec­tive spec­i­fi­ca­tions. Meaning safety and secu­rity in one system.