Traditionally, industry has paid a lot of attention to 'safety'. How do I protect humans from the machine? Much less attention is paid to the reverse: how do I prevent cybercriminals from bringing machines to a standstill? Unjustified, thinks Pieter van der Klooster, director of International Business Development at the International Society of Automation (ISA). "We need to start protecting machines better from humans," he says.
Cyber attacks on industrial companies and critical infrastructures have long been no exception. In late 2015, hackers already managed to use malicious software to knock out the power supply in the Ukrainian capital Kiev. In 2017, transport and energy company Maersk and medicine manufacturer MSD, among others, were victims of ransomware. Chinese hackers had once targeted the intellectual property of chip machine manufacturer ASML.
Cyber threat increases
These are just the examples that have hit the media. According to ISA, however, the problem is much broader. "You have two types of companies: those that have been hacked, and those that do not yet know they have been hacked," says Pieter van der Klooster. "Particularly in the last three to four years, the cyber threat to the industry has become very high. It is a real problem."
There are several reasons for this. A first explanation is the trend that more and more industrial machines are being connected to the internet. Unfortunately, this does not always happen in a secure way. With easily available tools such as the search engine Shodan, cyber criminals search for machines that are openly connected to the internet. Through the found unprotected machines, they can then penetrate the company network and steal data, or endanger business processes by infecting the machines with malware.
On top of this, according to Van der Klooster, cybercriminals can certainly make a financial killing in industry. "Suppose a hacker at a brewery manages to hold the can filling machine hostage with ransomware. The damage quickly amounts to hundreds of thousands of euros per day. For the victim, it is then tempting to pay the "ransom" of perhaps "only" ten thousand euros. Infected machines can also jeopardise safety. Safety and security cannot actually be separated."
ISA/IEC 62443
"For industrial companies, it is unfortunately difficult to protect themselves against the increasing cyber threat," Van der Klooster knows. "You are often dealing with fast-paced processes that should never stop. Securing then is a challenge." Yet Bram van der Klooster, Marketing Manager at ISA EMEA, sees a bright spot. Although the focus in the industry is still on safety, the focus on security is indeed increasing. "In the Netherlands, too, we see that the popularity of our cyber security training courses is on the rise," he says. So companies are increasingly working on it.
Joshua Smits, Technical Specialist and Cybersecurity Expert at ISA EMEA, has similar experiences. "More and more system integrators and machine builders are taking our cybersecurity expert training courses. Because they are increasingly dealing with customers who want engineers to be certified according to the 'cybersecurity standard' ISA/IEC 62443."
ISA training courses
For a long time, ISA - founded in 1945 as the Instrumentation Society of America - was mainly known in Europe for the batch-related standards ISA-88 and ISA-95 and ISA-18 for alarm systems. In recent years, the main focus of the European ISA office has been on the development of the cybersecurity standard ISA/IEC 62443 (ISA-99) for industrial automation and control systems. "Cybersecurity is our number one priority," says Bram van der Klooster.
The development of the standards is mainly financed from the proceeds of training courses provided by practical teachers on behalf of ISA. From a brand new office in Eindhoven, ISA Europe coordinates the training courses as far outside Europe as Asia and the Middle East.
Theory and practice
In the field of cybersecurity, ISA provides four different training courses: a 'fundamentals' training course and follow-up courses on risk assessment, design and implementation, and maintenance. Those who successfully complete all four training courses can call themselves cybersecurity experts and are included in ISA's register. Prometric, as an independent body, takes the exam and provides the certification.
During the training courses, trainees are introduced to both theory and practice. Smits: "They learn to deal with the technical solutions of different suppliers. During the training courses, for instance, we use Phoenix Contact's mGuard as industrial security appliances. For example, the trainees have to set up firewall rules or build a demilitarised zone (DMZ)."
Boosting security awareness
"Cyber security experts who have certification really have something in their hands," stresses Pieter van der Klooster. But according to the director, more is needed to make critical infrastructures and the industrial sector more resilient against cyber attacks. "It's about everyone in an organisation being aware of the cyber threat," he says.
"We also encourage this awareness, for example, with webinars and animations and by entering into discussions with boards of directors," concludes Pieter van der Klooster. "That is really the next step in the development of ISA. That's what we're putting more effort into in the coming period."
