Good Practices for Security of Internet of Things in the context of Smart Manufacturing

Utgivare: Europeiska unionens cybersäkerhetsbyrå
Antagen: 2018-11-19
Språk: engelska
Ämnesord: State of cybersecurity in the EU
Källa: www.enisa.europa.eu

Good Practices for Security of Internet of Things in the context of Smart Manufacturing NOVEMBER 2018 www.enisa.europa.eu European Union Agency For Network and Information Security

Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

About ENISA

The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Contact For queries in relation to this paper, please use iot-security@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu. Acknowledgements Over the course of this study, we have received valuable input and feedback from: Ernie Hayden 443 Consulting Adrien Becue Airbus Cybersecurity Jalal Bouhdada Applied Risk Hannes Tschofenig, Reed Hinkel ARM Ltd. Denis Justinek BIOKODA D.O.O. Alessandro Cosenza Bticino S.p.A. Cédric Lévy-Bencheton Cetome Jeff Schutt CISCO Mirko Ross Digital Worx GmbH Gianmarco Baldini DG JRC Georges-Henri Leclercq Engie Laborelec Brice Copy, Pascal Oser European Organization for Nuclear Research (CERN) Jens Mehrfeld Federal agency for information security (BSI) Rafal Leszczyna Gdansk University of Technology Carlos Valderrama Geomantis Corporation Limited Ian Smith GSM Association (GSMA) Konstantin Rogalas Honeywell Antonio J. Jara HOP Ubiquitous S.L. (HOPU) Vangelis Gazis Huawei Technologies Co., Ltd. Luca Bizzotto, Mike Edwards, Arndt Kohler, Ivan IBM Reedman Samuel Linares 02 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Victor Fidalgo Villar INCIBE (The Spanish National Cybersecurity Institute) Steve Olshansky, Andrei Robachevsky Internet Society Andrey Nikishin, Ekaterina Rudina, Vyacheslav Kaspersky Lab Zolotnikov Mahmoud Ghaddar Legrand Benedikt Abendroth, Kadri Umay Microsoft Corporation Vytautas Butrimas NATO Energy Security Center of Excellence Sergi Cuny Lafond Nestle Jacques Kruse-Brandao NXP Semiconductors N.V. Andrew Tierney, Mark Harrison PenTestPartners Stefano Zanero Politecnico di Milano Marcin Blasiak, Marcin Tarchalski Pratt&Whitney Pirmin Heinzer MELANI Jay Thoden van Velzen SAP Pierre Kobes, Wolfgang Klasen SIEMENS AG Sylvie Wuidart STMicroelectronics N.V. Yun Shen Symantec Corporation Steffen Zimmermann Trade Association (VDMA) Julio Hernández Castro University of Kent Antonio Raposo Volkswagen AG Filip Chytrý EC3/Europol Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged. ISBN: 978-92-9204-261-5, DOI: 10.2824/851384 03 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

Executive Summary 6 1. Introduction 7 Objectives 7 Scope 8 EU and International policy context 8 Target Audience 10 Methodology 10 Structure 11 2. Industrial IoT: Industry 4.0 and Smart Manufacturing 12 Definition 12 Security Challenges 16 High-level reference model 18 Asset taxonomy 19 3. Threats and risk analysis 26 Threats taxonomy 26 Examples of Industry 4.0/Smart Manufacturing cyber security attack scenarios 32 4. Security measures and good practices 36 Security Measure categorisation 36 Policies 37 4.2.1 Security by design 37 4.2.2 Privacy by design 37 4.2.3 Asset Management 37 4.2.4 Risk and Threat Management 38 Organisational practices 38 4.3.1 Endpoints lifecycle 39 4.3.2 Security Architecture 39 4.3.3 Incident handling 39 4.3.4 Vulnerabilities management 39 4.3.5 Training and Awareness 40 4.3.6 Third Party Management 40 Technical practices 40 4.4.1 Trust and Integrity Management 40 04 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 4.4.2 Cloud security 41 4.4.3 Business continuity and recovery 41 4.4.4 Machine-to-Machine security 41 4.4.5 Data Protection 42 4.4.6 Software/Firmware updates 42 4.4.7 Access Control 42 4.4.8 Networks, protocols and encryption 42 4.4.9 Monitoring and auditing 43 4.4.10 Configuration Management 43 Glossary 44 Annex A: Relation to ENISA Baseline IoT Security Recommendations 45 Annex B: Detailed list of security measures/good practices 47 Annex C: Security standards and references reviewed 103 Annex D: Description of indicative Industry 4.0 security incidents 113 05 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

Executive Summary

Industry 4.0 is rapidly becoming a reality, making use of intelligent, interconnected cyber-physical systems to automate all phases of industrial operations, spanning from design and manufacturing to operation, supply chain and service maintenance. With a great impact on citizens’ safety, security and privacy due to its cyber-physical nature and the inherent autonomy, the threat landscape concerning Industry 4.0 and IoT is extremely wide. Following a methodological approach, ENISA has developed this study on Good Practices for Security of the IoT in the context of Industry 4.0 and Smart Manufacturing. The study makes a series of contributions, most notably the following:  Defines relevant terminology (i.e. terms such as Industry 4.0, Smart manufacturing, Industrial IoT) to promote common understanding of relevant cybersecurity scenarios.  Categorizes in a comprehensive taxonomy the Industry 4.0 assets across the manufacturing process and value chain.  Introduces a detailed Industry 4.0 threat taxonomy based on related risks and attack scenarios.  Maps the identified threats to assets, thus facilitating the deployment of security measures based on the customized requirements of interested stakeholders.  Lists security measures related to the use of IoT in Smart Manufacturing and Industry 4.0 and maps them against the aforementioned threats. In conducting this study, ENISA identified and extensively analysed the current state of available documentation on security in IoT, Industrial IoT, Industry 4.0 and Smart Manufacturing. ENISA also collected input from a number of security experts through a structured questionnaire and a series of interviews. ENISA considered the security of Industry 4.0 devices and services throughout their lifecycle (from conception to end-of-life and decommissioning) and paid close attention to issues that are particular to the requirements of Industry 4.0. Accordingly, the study highlights security measures in three dimensions:  Policies  Organisational measures  Technical measures One additional noteworthy element of this study is the mapping to existing security initiatives, standards and schemes. ENISA reviewed more than 150 resources on Industry 4.0 and IoT security and mapped them against the security measures proposed in this study. This mapping facilitates stakeholders, who are nowadays faced with a fragmented field, to have a common basis of understanding. The guidelines and security measures listed in this study aim at improving the cybersecurity posture of Industry 4.0 organisations that have adopted or plan to adopt Industrial IoT devices and solutions that enhance automation in industrial operations. These security measures apply to a wide audience spanning Industrial IoT operators and manufacturers/vendors, which can utilise these measures and recommendations as a checklist against which to examine their Industry 4.0 security solutions. The aim of the study is to serve as a reference point to promote collaboration on Industry 4.0 and Industrial IoT security across the European Union and raise awareness of the relevant threats and risks with a focus on “security for safety”. 06 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

1. Introduction

In recent years, we have seen a significant and rapid decline in data transfer and storage costs due to the accelerating shift in the global economy driven by more connectivity, collaboration and sharing. This development, accompanied by a bimodal IT organisation, supports exponential growth in the smart connected world, especially in manufacturing. Recent trends include the emergence of Industry 4.0, a concept that is revolutionising traditional manufacturing and other industries by introducing new capabilities, such as digitisation, decision-making decentralisation and value chain integration. Industry 4.0 is tightly bound to cyber-physical systems that in turn are enabling intelligent and connected infrastructures – including Smart Manufacturing infrastructures – by enhancing their quality of service provisioning. Transforming the industrial landscape, Industry 4.0 with the Internet of Things (IoT) at its core has already exerted an impact on society, transforming products, customer experience and the labour market. It is therefore playing a central role within the European Union’s initiatives, becoming the subject of various studies, programs and regulations . The fourth industrial revolution and exponential growth in the quantity of connected devices all over the world together with the rapidly increasing number of cyber security incidents further stress the need for strengthening cyber resilience, especially among the industrial operators who are beginning to utilise IoT solutions. Recent initiatives towards Industry 4.0 and Smart Manufacturing are attracting more attention to aspects related to the security of technical solutions and the safety of citizens who rely on them. This subject is all the more important since the potential impact exerted by new threats ranges from compromising physical security to production downtime, spoilage of product, damage to equipment and the ensuing financial and reputational losses. Industry 4.0 and Smart Manufacturing, in particular, accelerate the introduction of intelligence, automation and autonomy in manufacturing and supply chain environments. Accordingly and given the significant attention and prioritization that has been given to the digitisation of the EU industrial sector, this study has a focus on security of IoT in the context of Industry 4.0. The topic is of great importance as vendors’ and users’ / consumers’ awareness of the threats related to the deployment of Smart Manufacturing and Industry 4.0 is usually limited. At the same time, cyberattacks focusing on industrial assets, such as Safety Instrumented Systems, using new attack vectors have been recently observed with an increasing frequency. Objectives This ENISA study aims at addressing the security and privacy challenges related to the evolution of industrial systems and services precipitated by the introduction of IoT innovations. The main objectives were to collect good practices to ensure security of IoT in the context of Industry 4.0/Smart Manufacturing, while mapping the relevant security and privacy challenges, threats, risks and attack scenarios. The aim of the study is to serve as a reference point to promote collaboration on Industry 4.0 and Industrial IoT security across the European Union and raise awareness of the relevant threats and risks with a focus on “security for safety”. See examples of EU initiatives related to Industry 4.0 concept: https://ec.europa.eu/growth/toolsdatabases/dem/monitor/tags/industry-40 See examples of national initiatives for digitizing industry within the EU: https://ec.europa.eu/growth/toolsdatabases/dem/monitor/category/national-initiatives 07 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 An additional important element of the study is to define the notion of Industry 4.0 and Smart Manufacturing to set the perimeter of the work to be done and serve as the basis for future developments. Scope This study outlines good practices for cybersecurity in the IoT applied in an industrial environment. Due to the extensive landscape of IoT deployments, this study focuses on Industrial IoT (IIoT) and Smart Manufacturing because they are among the most representative elements of the overall Industry 4.0 landscape . In this study ENISA identified and extensively analysed the current state of available documentation on security in IoT, IIoT, Industry 4.0 and Smart Manufacturing and other related subjects. ENISA also collected input from a number of security experts through a structured questionnaire and a series of interviews. Based on a thorough review of existing works, ENISA identified threats and developed possible critical attack scenarios targeting various domains of Industry 4.0 and Smart Manufacturing. This enabled the Agency to develop good practices and security measures to ensure security in IoT in Industry 4.0. In this respect, the study also made it possible to identify gaps in, and barriers to, security adoption. The study highlights three groups of security measures to address security challenges in technologies, people and processes. A risk-based and holistic approach to security was undertaken. ENISA considered the security of IoT devices and services in industrial settings throughout their lifecycle (from conception to end-of-life) and paid particular attention to the overall supply chain and third party management, which constitute essential elements of Industry 4.0. EU and International policy context With a globally emerging trend of connected things and the increasingly common adoption of IoT concepts by organisations across the world, cybersecurity of IoT in recent years has become a matter of interest for the European Commission and other regulation bodies. IoT in Industry and Smart Manufacturing is a specific subset of IoT cybersecurity. Being aware of the potential of IoT and the related cyber security challenges, the EU has been striving to ensure security in the IoT and accelerate development in this area through numerous policy actions that include the creation of alliances and centres of expertise, development of regulatory documents and launch of pilot projects. In March 2015, the European Commission launched the Alliance for Internet of Things Innovation (AIOTI) with the objective to create an innovative European IoT ecosystem. It has become the largest IoT association in Europe illustrating the EU’s intention to collaborate with stakeholders in order to establish a competitive European IoT market and develop new business models. Two months later, in May 2015, the EU adopted the Digital Single Market (DSM) Strategy . In terms of the IoT, which is one of its five main development areas, the DSM aims to address common issues that may lead to the deceleration of secure IoT adoption, such as fragmentation of guidelines and lack of interoperability. In April 2016, to fulfil DSM needs and ensure awareness of its upcoming policy, the European Commission published a staff working document related to the IoT . It constitutes part of the "Digitising European See EC, Fourth Industrial Resolution: https://ec.europa.eu/digital-single-market/en/fourth-industrial-revolution See The Alliance for Internet of Things Innovation: https://ec.europa.eu/digital-single-market/en/alliance-internetthings-innovation-aioti See more about Digital Single Market: https://ec.europa.eu/commission/priorities/digital-single-market/ See European Commission (2016) “Advancing the Internet of Things in Europe”: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=CELEX:52016SC0110 08 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Industry" initiative and outlines the EU's vision of IoT based on three pillars: a thriving IoT ecosystem, a human-centred IoT approach and a single market for IoT. Like the Internet of Things, Cybersecurity is another DSM priority in terms of standards development. It is a broad concept that, among others, spans cybersecurity in the Internet of Things and cybersecurity in industrial systems. When it comes to IoT cybersecurity, ENISA developed a document entitled “Baseline Security Recommendations for IoT” in 2017 to address systematically cybersecurity issues that emerged because of the introduction of IoT concepts . Considering EU policy in terms of typical industrial initiatives, the DSM focuses on facilitating coordination 9 10 of European, national and regional initiatives, such as the German Industrie 4.0 , Dutch Smart Industry and 11 12 French Industrie du Futur . In 2016, a relevant communication from the European Commission was issued . Through these initiatives, the EU aims to boost innovation and prepare for new products and services. As IoT and digitisation of industry rely on the exchange, processing and storage of large amounts of data, the recent General Data Protection Regulation (GDPR) must be mentioned when discussing EU policy actions. Its objective is to protect privacy and personal information. It applies to all organisations, including Smart Manufacturing companies and the vendors and operators of IoT devices. Moving from the EU policy landscape to the international context, in 2017 the US IoT Cybersecurity Improvement Act was introduced to address IoT security issues. Even more recently, the governor of California signed the first IoT cybersecurity law in the United States that is planned to take effect in 2020. It requires manufacturers to equip connected devices with reasonable security features . Apart from this example, the US Department of Homeland Security, NIST and other entities have also worked on addressing cybersecurity issues associated with IoT and Smart Manufacturing through development of guidelines, frameworks and other documents. Notable examples of these initiatives include the Department of Homeland Security’s publication “Strategic Principles for Securing the Internet of Things” or NIST’s “Cybersecurity Framework Manufacturing Profile” . See ENISA (2017) “Baseline Security Recommendations for IoT”: https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot/at_download/fullReport Relation of this document to ENISA Baseline Security Recommendations for IoT has been described in Annex A:. See more about Plattform Industrie 4.0: https://www.plattform-i40.de/I40/Navigation/EN/Home/home.html See more about Smart Industry: https://www.smartindustry.nl/ See more about Alliance Industrie du Futur: http://www.industrie-dufutur.org/ See European Commission (2016) ”Digitizing European Industry. Reaping the full benefits of a Digital Single Market”: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52016DC0180 See European Parliament and Council of European Union (2016) “General Data Protection Regulation”: https://eurlex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679 See United States Congress (2017) “Internet of Things (IoT) Cybersecurity Improvement Act of 2017”: https://www.congress.gov/bill/115th-congress/senate-bill/1691/text?format=txt See more about the California’s IoT cybersecurity law: https://www.cnet.com/news/california-governor-signscountrys-first-iot-security-law/ See U.S. Department of Homeland Security (2016) “Strategic Principles for Securing the Internet of Things”: https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-See NIST (2017) “Cybersecurity Framework Manufacturing Profile”: https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8183.pdf 09 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Analysing EU and international initiatives makes it possible to highlight several policy initiatives related to the security of IoT. However, IoT security in the industrial environment is still regarded as a matter for consideration by regulatory bodies, as Industry 4.0 and Smart Manufacturing concepts utilising IoT are still in the process of being devised. Target Audience This study provides a set of guidelines and security measures to improve the IoT cybersecurity posture of Industry 4.0 and Smart Manufacturing organisations, namely organisations that have adopted or plan to adopt Industrial Internet of Things devices and solutions. These security measures apply to a wide audience spanning IIoT operators and manufacturers/vendors. The list of potentially targeted profiles includes (but is not limited to) the following:  Industrial IoT experts, software developers and device manufacturers  Industrial IoT operators and users  OT and IT security experts and solution architects  Persons in charge of security within Industry 4.0 organisations (e.g. CISOs)  Members of international Industry 4.0 organisations and security communities  Academic and Research Development Institutions. In addition, this document may also support discussions at the policy-making level and therefore be of interest to the potential development of related regulations on Industrial IoT security. Methodology The methodology (as depicted in Figure 1) followed to conduct this study consists of the following five tasks. Figure 1: Methodology adopted for the study Task 1: Definition of the project scope and identification of experts – The first step consisted of establishing the scope of the project and selecting subject matter experts whose input and insights were considered for 18 19 the development of the report. The members of the ENISA IoTSEC (IoT Security) and EICS (ENISA Industry 4.0 Cyber Security) Informal Expert Groups as well as selected additional stakeholders formed the pool of subject matter experts. In total experts from 42 different bodies contributed to the development and validation of the study. Task 2: Desktop research – During this step, extensive search for relevant documents in the context of the project was conducted. The identified sources served as a reference to develop good practices and other parts of the report. See more about IoT Security Experts Group: https://resilience.enisa.europa.eu/iot-security-experts-group-1 See more about EICS Experts Group: https://resilience.enisa.europa.eu/eics-experts-group Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Task 3: Questionnaire and series of interviews with selected subject matter experts – ENISA developed a questionnaire covering various Industrial IoT and Industry 4.0 security aspects. The questionnaire was completed by a group of subject matter experts. Furthermore, a series of interviews with these experts took place, through which ENISA collected valuable input to prepare this report. Task 4: Analysis of collected material and report development – The inputs collected from desktop research and collaboration with stakeholders were thoroughly analysed by ENISA’s experts. Based on this analysis, the first draft of this report was developed. Task 5: Review and validation – ENISA once again reached to its subject matter experts, this time to share the draft of the report with them to obtain comments and feedback. Taking into account the stakeholders’ feedback, the final version of this report was developed and validated by the subject matter experts during th the validation workshop held in The Hague, NL on the 26 of October 2018. This methodology enabled ENISA to engage actively with the interested stakeholders and:  define terminology (e.g. Industry 4.0, Smart manufacturing, Industrial IoT etc.),  identify the corresponding assets (what kind of assets and where and how they are used across the manufacturing process and value chain, its path and evolution over time),  identify possible threats, risks and attack scenarios posed against the Industrial IoT,  map identified threats to assets,  list security measures related to the use of IoT in Smart Manufacturing. Structure The study is structured as follows:  Chapter 1: Introductory information on the objectives, scope, context, target audience, methodology and structure of the study.  Chapter 2: Definition of Industry 4.0 and its components with an overview of the concepts discussed and the related security challenges.  Chapter 3: Threat and risk analysis containing a taxonomy of the threats and examples of Industry 4.0/Smart Manufacturing attack scenarios.  Chapter 4: Description of security measures and good practices mapped to threats, security domains, standards and other relevant documents. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

2. Industrial IoT: Industry 4.0 and Smart Manufacturing

Definition This report focuses on the IoT, Industry 4.0, Smart Manufacturing and IIoT, which are relatively new terms. There is a veritable plethora of definitions for these terms while commonly held definitions are lacking. Depending on the source and context, the descriptions of these terms may vary significantly. Thus, it is important to adopt specific definitions and clarify our understanding of those terms. In this study, ENISA defines IIoT as IoT (as defined in the ENISA Baseline IoT Security Recommendations ) applied in the industrial environment. Industry 4.0 is, in turn, a much broader concept that encompasses IIoT and Smart Manufacturing alike. ENISA defines Industry 4.0 as “a paradigm shift towards digitalised, integrated and smart value chains enabling distributed decision-making in production by incorporating new cyber-physical technologies such as IoT”. Figure 2: Communication relationships in Industry 4.0 Industry 4.0 design principles, often referred to as the fourth industrial revolution, include interoperability, autonomy, information transparency, technical assistance and distributed decisions . Recent technological See ENISA (2017) “Baseline Security Recommendations for IoT”: https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot/at_download/fullReport See Connected Factory Global (2016) “Manufacturing Control System Cybersecurity: Risk Assessment & Mitigation Strategies”: http://www.connectedfactoryglobal.com/resources/cybersecurity-report/ Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 advances that resulted in reversal of the traditional production process logic led to the formation of this concept, representing a shift towards decentralised production. With the advent of Industry 4.0, a product is not merely processed by machines – it communicates with its environment providing relevant information and instructions (referring to the notion of digital twin). No longer isolated, products and production lines have become integral parts of the overall network. Contrary to the traditional approach to industry in which a hardware-based structure with a clear communication hierarchy was prevalent, Industry 4.0 introduced flexible systems whose functions are not bound to hardware but distributed throughout the network. In these new systems internal communication can now be observed across an organisation’s hierarchical levels. New types of interactions have been introduced (see Figure 2) and external interactions between organisations have changed significantly and become more flexible. Industry 4.0 connects production to information and communication technologies. It merges end user data with machine data and enables machines to communicate with each other. As a result, it has become possible for components and machines to manage production autonomously in a flexible, efficient and resource-saving manner. Its benefits include, among others, higher product quality, greater flexibility, shorter product launch times, new services and business models. It is important to note that the flows depicted in the figure refer to physical goods and data (e.g. exchange of digital twins). Data flows are bidirectional at least, e.g. customers may provide feedback to the production/manufacturing process. Figure 3: Smart Manufacturing in Industry 4.0 By introducing a wide array of new capabilities, Industry 4.0 acts as an enabler for a new approach to manufacturing, namely Smart Manufacturing. This particular concept, focusing on product manufacturing using new technologies, constitutes only a small part of Industry 4.0, which may be regarded as a superset See Plattform Industrie 4.0 (2016) “Technical Overview: Secure Identities”: https://www.plattformi40.de/I40/Redaktion/EN/Downloads/Publikation/secure-identities.pdf?blob=publicationFile&v=9 See Plattform Industrie 4.0 (2018) “RAMI4.0 – a reference framework for digitalisation”: https://www.plattformi40.de/I40/Redaktion/EN/Downloads/Publikation/rami40-an-introduction.pdf?blob=publicationFile&v=4 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 encompassing a variety of industrial areas. Figure 3 illustrates how Smart Manufacturing is related to Industry 4.0 and other technologies in use. ENISA defines Smart Manufacturing as “next-generation industrial manufacturing processes and systems built on emerging information and communication technologies in line with Industry 4.0, such as additive manufacturing, advanced analytics and IT/OT integration”. This new term describes systems that – by using connected devices and sensors – attempt to maximise capabilities such as cost, delivery, flexibility and quality by using advanced technologies that promote rapid flow and widespread use of digital information . Smart Manufacturing combines some of the functionalities of earlier manufacturing models, while introducing its own new capabilities included advanced decision-making. Together with collaborative supply chains, organisations may quickly adapt to market changes and disruptions. To achieve innovation and the desired enhanced capabilities, Industry 4.0 and Smart Manufacturing benefit from various technologies (see Figure 4), such as:  IIoT end devices Devices that have various capabilities, such as sensing, actuating, storing and/or processing data and that exchange data over the network.  Machine-to-machine (M2M) communication Technologies that facilitate direct communication between devices in the network without human assistance.  Big data analytics Process of examining vast amounts of various types of data sets generated in real time by smart sensors, devices, log ﬁles, video and audio.  Advanced Robotics Advanced industrial robots designed for complex tasks with smart capabilities, such as the ability to learn from their errors and improve their performance.  Artificial Intelligence (AI) Algorithms that enable computers and digital machines to perform tasks typically associated with intelligent human beings.  Machine Learning (ML) Algorithms that enable computers to act and improve their ability to predict without being explicitly programmed.  Predictive Maintenance Solutions that monitor the condition of equipment predicting when the failure may occur to perform maintenance effectively at the lowest possible frequency.  Real time monitoring Technologies that enable collection and aggregation of security data from system components and monitoring and analysis of events that occur in the network.  Advanced loss analytics Methods for analysis of various types of losses that may occur in a Smart Manufacturing environment with the objective to eliminate or reduce them.  Cloud Computing Solutions enabling access to shared sets of resources such as networks, servers and applications with minimal requirements concerning managerial effort and service provider interaction. See NIST (2016) “Current Standards Landscape for Smart Manufacturing Systems”: https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8107.pdf Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  Additive Manufacturing Technologies that enable the creation of objects of various geometric shapes by adding material, e.g. 3D printing or rapid prototyping.  Augmented reality Technologies that modify the perception of the real-world environment, for example technologies used in Smart Manufacturing to improve the efficiency of manual assembly tasks. Figure 4: Industry 4.0 and Smart Manufacturing capabilities The notions of Industry 4.0 and Smart Manufacturing are rather complex. Based on the responses received by the subject matter experts in interviews and analysis of relevant publications, ENISA has identified the following main elements:  ICS (Industrial Control Systems) – This group consists of control systems, such as SCADA (supervisory control and data acquisition) and DCS (distributed control systems), as well as other control system elements and devices, such as PLCs (programmable logic controllers) and HMIs (human machine interfaces). Various control components within the system cooperate with each other to achieve a specified control objective, e.g. manufacturing a product or desired state that is within pre-set parameters such as keeping the flow of a liquid in a pipe within the bounds of the desired flow rate, pressure or temperature, respectively. Additionally, ICSs may contain remote diagnostics and maintenance tools.  IIoT End Devices – These devices have various capabilities, such as sensing, actuating, storing and/or processing information. What distinguishes them from traditional devices such as sensors and actuators that have been used in industrial applications for years is the fact that IIoT End Devices exchange data over the network. In Smart Manufacturing environments, by making large amounts of new types of data available, they contribute to streamlining production.  Manufacturing and business processes – This group consists of activities that lead to achieving a certain goal, in this case obtaining a final product from raw materials or components. These processes include technological procedures that may vary considerably depending on the characteristics of the company, as well as organisational processes, which enable the whole company to operate successfully. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  Artificial Intelligence and Machine Learning – In Smart Manufacturing, due to the collection of enormous amounts of data from industrial process, various ML and AI algorithms are utilised for analysis. Artificial Intelligence transforms manufacturing by making it easily adaptable without having to spend long hours to reprogram industrial robots, enabling predictive maintenance and increasing flexibility.  Control systems communication networks and their components – This group includes networks, network devices and industrial protocols. Networks play a significant role in a Smart Manufacturing ecosystem since they allow different nodes to exchange data and information with each other via a data link. Networks in control systems communication include serial and digital links to transfer inputs and outputs to/from end devices. Network devices include gateways, routers, switches, etc. Typical examples 26 27 of industrial communication protocols include (but are not limited to): e.g. HART , Modbus TCP/IP , 28 29 OPC and OPC-UA . Security Challenges The numerous benefits of adopting Industry 4.0 technologies and making manufacturing Smart go hand in hand with significant security challenges. A recent survey revealed that stakeholders are becoming aware of this problem, as 65% of companies believe that OT/ICS cybersecurity risks are more likely with IoT technologies . The following detail the generic security challenges that Smart Manufacturing and Industry 4.0 face:  Vulnerable components – Along with the fourth industrial revolution, the new Internet of Things (IoT) landscape has emerged with millions of connected devices globally. That is why securing IoT in Smart Manufacturing entails affording protection to an enormous number of connected assets. What is more, IoT cybersecurity is not an isolated concept; it is interconnected with a number of security disciplines, e.g. IT security, OT security and physical safety making this landscape even broader. As a result of shifting from closed to connected cyber-physical systems, Smart Manufacturing companies need to handle the issue of the typical vulnerabilities in those systems. In industrial environments this may pose a considerable challenge since most systems of this type were not designed with cybersecurity in mind and thus vulnerabilities in this hardware are becoming more and more common .  Management of processes – In addition to the large attack surface in terms of connected devices, a multitude of complex processes involved in Smart Manufacturing should also be considered. Management of processes with cybersecurity in mind poses a challenge for Industry 4.0 companies, especially since functionality and production efficiency are usually seen as having a higher priority than cybersecurity.  Increased connectivity – Manufacturing processes need to interact with objects and environments on a global scale and systems used in Smart Manufacturing need to enable collaboration across multiple See TOPBOTS (2017) “Future Factories: How AI enables smart manufacturing”: https://medium.com/topbots/future-factories-how-ai-enables-smart-manufacturing-c1405f4ec0e6 See HART (Highway Addressable Remote Transducer Protocol): https://www.fieldcommgroup.org/technologies/hart See MODBUS TCP/IP Specification: http://www.modbus.org/specs.php See OPC (Open Platform Communications): https://opcfoundation.org/about/what-is-opc/ See OPC Unified Architecture (OPC UA): https://opcfoundation.org/about/opc-technologies/opc-ua/ See Kaspersky Lab (2018) “Worried about IoT, but hit by malware: Kaspersky Lab reveals industrial organization pain points”: https://www.kaspersky.com/about/press-releases/2018_ics-cybersecurity See Hongmei He (2017) “Security Challenges on the Way Towards Smart Manufacturing”: https://www.iotsecurityfoundation.org/security-challenges-on-the-way-towards-smart-manufacturing/ See Positive Technologies (2018) “ICS SECURITY: 2017 IN REVIEW”: https://www.ptsecurity.com/upload/corporate/ww-en/analytics/ICS-Security-2017-eng.pdf Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 organisations. One of the biggest challenges for higher connectivity is that security can exert a direct impact on safety.  IT/OT convergence – Industrial control systems ceased to be isolated once the incorporation of IT components in the ICS domain become a common practice. Converging with IT network-enabled organisations simplified the management of complex environments while also introducing new security risks. Managing IT/OT integration is a significant challenge. The contributing factors include insecure network connections (internal and external), utilisation of technologies with known vulnerabilities that introduce previously unknown risks into the OT environment, and insufficient understanding of requirements for ICS environments. Holistic security must cover digital twin and physical implementation.  Supply chain complexity – Companies that manufacture products or solutions are very rarely able to produce every part of the product itself and usually need to rely on third parties’ components. Developing technologically sophisticated products results in an extremely complex supply chain with a large number of people and organisations involved, thereby making it highly demanding in terms of management. Not being able to track every component to its source means not being able to ensure product security, which is only as secure as its weakest link.  Legacy industrial control systems – Legacy hardware is a significant barrier to adoption of the Industrial Internet of Things by over a third of the respondents according to a recent survey . Manufacturers build new systems on top of legacy systems, and this may result in outdated protection measures and contain unknown vulnerabilities that have been inactive for years. Adding new IoT devices to outdated hardware raises concerns that it may allow attackers to find a new way to compromise systems.  Insecure protocols – Manufacturing components communicate over private industrial networks using specific protocols. In modern network environments, these protocols often fail to ensure proper protection against cyber-threats. According to a recent report, 4 of the 5 least secure protocols are ICSspecific .  Human factors – Adopting new technologies means that factory workers and engineers have to work with new types of data, networks and systems in novel ways. They are unaware of the risks associated with gathering, handling and analysing that data and can thus become an easy target for attackers. This is becoming all the more disturbing given that the industry most targeted by phishing emails in 2016 was Manufacturing .  Unused functionalities – Industrial machines are designed to offer a large number of functions and services, many of which may not be necessary for operation. In industrial environments, machines or their selected components often have access to unused functionalities that may considerably expand the . potential attack area and become gateways for the attackers.  Safety aspects – The presence of actuators that act on the physical world makes safety aspects very relevant in IoT and Smart Manufacturing. Security for safety emerges as an objective of paramount importance.  Security updates – Applying security updates to IoT is extremely challenging, since the particularity of the user interfaces available to users does not allow traditional update mechanisms. Securing those mechanisms is in itself a daunting task, especially considering Over-The-Air updates. In OT environments in particular, applying updates may be challenging since this operation needs to be scheduled and performed during downtime. See World Economic Forum (2015) “Industrial Internet of Things: Unleashing the Potential of Connected Products and Services”: http://www3.weforum.org/docs/WEFUSA_IndustrialInternet_Report2015.pdf See Synopsys (2017) “State of Fuzzing 2017”: https://www.synopsys.com/content/dam/synopsys/sigassets/reports/state-of-fuzzing-2017.pdf See NTT Security (2017) “Global Threat Intelligence Report 2017”: https://www.nttsecurity.com/en-us/gtir-2017 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  Secure product lifecycle – Device security should be a subject of consideration through the product’s entire lifecycle, even end-of-life/end-of-support of the machine. High-level reference model Smart Manufacturing environments consisting of a large number of elements can seem unduly complicated. To provide a better explanation of this concept, a high-level reference model based on the Purdue Model (i.e. the Purdue Enterprise Reference Architecture developed by Theodore J. Williams and members of the Industry-Purdue University Consortium for Computer Integrated Manufacturing, as referenced in ISA-95 ) tailored to the scope of this project has been proposed (see Figure 5). Figure 5: High-level reference model The presented concept divides Smart Manufacturing environment into 6 layers. These layers are arranged in order, with the lowest one being the manufacturing processes (Layer 0), followed by devices, systems and services (Layers 1-5). Levels 1 and 2 represent OT layers. IIoT devices fall into the Layer 1 of this model. Layer 4 corresponds to the IT part of a corporation, while Layer 3 is an intermediate layer with systems classified in-between IT and OT. IIoT Platform utilisation was included as part of the Layer 3. The highest layer, which did not appear in the Purdue Model, is specific for Smart Manufacturing, where external services are commonly used. The objective of the reference model is to provide a general overview of relationships between the most important assets (see section 2.4) and components (see section 2.1). Grey arrows represent simplified communication paths between larger groups in the model (i.e. on the left of the picture). Additionally, new See The Purdue Enterprise Reference Architecture by T.J. Williams: https://www.sciencedirect.com/science/article/pii/0166361594900175 See ISA95: https://www.isa.org/isa95/ Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 communication paths introduced by Industry 4.0 and enabled by the incorporation of IIoT devices into the network, e.g. communication between IIoT devices and direct connection of IIoT devices to IIoT platform, have been added on top of the model with yellow arrows to emphasise their criticality in terms of security and privacy. In what follows, we briefly described the levels of the reference model. Level 0: Manufacturing processes and equipment (machines, robots) This is the lowest level of the IIoT environment where manufacturing processes executed by smart machines and robots take place. These processes are measured and controlled by devices and systems in higher layers of the reference model. Level 1: IIoT devices – sensors and actuators This layer comprises IIoT devices that measure system parameters (IIoT sensors) and execute specific actions (IIoT actuators). Data is transmitted between IIoT devices and control systems (Level 2) as well as IIoT platform (Level 3). Level 1 also includes SIS. Level 2: Industrial control devices and systems These are devices and systems that control the industrial processes (Layer 0) based on information from IIoT devices (Level 1). They include controllers (PLCs, RTUs), distributed control systems (DCS), operator panels (HMI) and supervision and control systems (SCADA). Level 3: Manufacturing operations systems and IIoT Platform This is an intermediate layer between OT and IT environment. It comprises systems that are used to manage manufacturing processes, e.g. Manufacturing Execution Systems (MES), Historian, Warehouse Management System (WMS) and Track & Trace systems. These systems communicate with both OT and IT environments. Distinguishing this layer makes it possible to control this communication and prevents direct communication between the OT and IT layers. Level 3 of the model also includes an IIoT platform that analyses and manages data from the manufacturing and control processes provided by IIoT devices. It is closely related to the OT environment and provides information to the systems in the layer above. Level 4: Enterprise operations systems These IT systems support a company’s operations at an enterprise level. They include supply chain and production management and planning. In contrary to level 2 systems, they do not operate in real-time. This layer includes the following systems (this list is not meant to be exhaustive): Enterprise Resource Planning (ERP), Supply Chain Management (SCM), Sales & Operations Planning (S&OP), Customer Relationship Management (CRM), Material Requirements Planning (MRP), Transaction Processing System (TPS) and Executive Support System (ESS). Level 5: Third Parties’ services As mentioned before, reliance on Third Parties' services is an inherent characteristic of Smart Manufacturing. For this reason, to better reflect Industry 4.0 and Smart Manufacturing specifics, we decided to place an additional layer on top of the ISA 95 model to include Third Parties services. These services may take different forms, e.g. Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). Asset taxonomy To focus on the details of IoT security in Smart Manufacturing it is essential to start from identification and decomposition of assets of such vast and complex environments. Here we provide an overview of the key asset groups and assets that need to be protected. Industry 4.0/Smart manufacturing assets are classified into key groups depicted in Figure 6 and described in Table 1. The levels assigned to each asset group in the table correspond to the levels defined in section 2.3, i.e. High-level reference model depicted in Figure 5. It Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 should be noted that the lowest level of the taxonomy is indicative and not exhaustive. For instance, not all sensor types or network protocols are listed, just some representative ones. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Figure 6: Industry 4.0 asset taxonomy Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 ASSET GROUP ASSETS DESCRIPTION These devices detect and/or measure events in their environment and transmit information to other electronic systems to be processed. There are Sensors sensors for many purposes, such as to measure temperature, motion, vibration etc. IIoT End Devices These systems consist of sensors, logic solvers, and final control elements Safety Instrumented Level 1 (actuators) whose objective is to bring the process to a safe state in case of Systems (SIS) a violation of predetermined conditions. These devices interact with the environment by moving or controlling a Actuators mechanism or system. In order to do so, they convert energy (e.g. electrical, hydraulic or pneumatic) into motion. These specialised industrial computers are used to automate control functions within the industrial network. Typically, they are equipped with PLCs additional plug-in modules, such as Input / Output modules to connect sensors and actuators. These devices are used typically in substations or remote locations. RTUs Their objective, similar to PLCs, is to monitor field parameters and send data to the central station. ICS Level 2 These control systems distribute intelligence, i.e. management logic, about DCS the controlled process instead of relying on a single central unit. These systems are used to collect data from industrial assets and processes, SCADA their visualisation, supervision and control. Such workstations usually operate on the Windows operating system. Human Machine These control panels and dashboards allow the operators to monitor and Interfaces control PLCs, RTUs and other electronic devices. These networking devices forward data packets between different networks Routers in industrial environments and IoT ecosystems. These network nodes are used to interface with another network from an IIoT Gateways IoT environment using different protocols. Gateways may provide protocol translators, fault isolators, etc., to provide system interoperability. These network components filter and forward packets within the local area Switches ICS communication network. networks & components Wireless Access Points These components enable wireless devices to connect to a wired network Levels 1 - 3 using Wi-Fi, or related standards. Firewall These network security devices or systems control network traffic between networks or between a host and a network based on predetermined rules. Networks They allow the different nodes of an IoT ecosystem to exchange data and information with one another, via a data link. There are different kinds of networks related to their spatial coverage, including e.g. (W)LANs, (W)PANs, PANs and (W)WANs, among others. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 ASSET GROUP ASSETS DESCRIPTION Protocols They define the set of rules on how two or more IoT devices communicate over a given channel. There are many communication protocols, which can be either wired or wireless. Power Supply It supplies electric power to an IoT device and its internal components. The power source can be external and wired or a battery integrated in the device itself. Operation and production This includes information about IIoT system operation and production data, data such as sensor data, MES and SCADA data, etc. Information Device Information This includes information such as model, type, configuration, firmware All levels version, status, etc. IP address, physical location, etc. The asset inventory contains this information about all system devices. User Information This includes information such as name, role, permissions, etc. These terms describe the ability of a machine (e.g. computer, robot, etc.) to Decision Making Artificial Intelligence and perform tasks typical for intelligent beings. In Smart Manufacturing, where Algorithms Machine Learning enormous amounts of data is collected from industrial process, various ML Levels 2-5 and AI algorithms can be utilised for analysis. Cloud Computing 38 These services enable swift universal network access to a shared set of resources such as networks, servers Services and applications with minimal requirement of management effort and service provider interaction. Levels 3-5 In Smart Manufacturing, this term describes the process of examining vast amounts of various data sets generated in real time by smart sensors, devices, log ﬁles, video and audio. This data is created on all Big Data Analytics automation levels including manufacturing plant, transaction applications, etc. Big Data is analysed to Levels 3-5 uncover hidden patterns, unknown correlations, trends and other useful information that can help make more-informed and deliberate decisions. These sophisticated industrial robots are designed to perform complex tasks Advanced Robotics Smart Robots, Automated with smart capabilities, such as the ability to learn from errors and improve Level 0 guided vehicles their performance. These applications are utilised to collect and aggregate security data from SIEM various system components and render them in the form of meaningful Real time information via a single interface. monitoring and security tools These systems enable automatic monitoring of the events that occur in a Levels 3-5 computer system or network and their analysis for signs of possible IDS/IPS incidents. In addition, IPS may execute actions in an attempt to stop detected incidents. Software and These programs are written for devices within an IIoT ecosystem to achieve Licenses Program (code) specific technological objectives, including PLC logic, SCADA applications, Levels 2-5 HMI applications, industrial robot programs, etc. See ENISA’s study on Cloud Computing, “Towards secure convergence of Cloud and IoT”: https://www.enisa.europa.eu/publications/towards-secure-convergence-of-cloud-and-iot Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 ASSET GROUP ASSETS DESCRIPTION This term refers to a system that manages computer hardware resources Operating System and provides common services for other computer programs to run. These programs run on mobile devices, such as tablets and smartphones, which are used for remote supervision and control of a process (e.g. mobile Mobile application SCADA client applications), equipment maintenance and other tasks (e.g. warehouse inventory). This term refers to a software that monitors a computer or network to Antivirus identify malware, prevent it from infecting devices and clean infected devices. This term refers to a class of software stored on a device’s read-only memory Firmware and provides instructions on how the device should operate. During execution, it cannot be dynamically written or modified. Historians These software systems gather data from industrial devices and store them in specialized databases. Application Servers These computers host applications, e.g. user workstations’ applications. Database Servers These servers are used as repositories for event information provided by sensors, agents, and management servers. Servers and Systems Enterprise operations These systems integrate information from various parts of an organization Levels 3-5 systems (e.g. ERP, CRM) (i.e. manufacturing, distribution, financials, human resources, etc.). They also provide a connection between organization and its customers and suppliers. Manufacturing These systems automate production control and process automation using operations systems network computing, bridging the gap between business and plant-floor. (e.g. MES) These systems are used for downloading instructions, scheduling and uploading information on production results. Mobile devices Tablets, smartphones These portable devices can be operated by hand. They run mobile Level 3 applications enabling operators to perform various tasks. Operators, maintenance This asset group refers to all the individuals who have physical or remote staff, third parties access to the OT system. People are inseparable elements of manufacturing environments and hence must be taken into consideration when defining critical assets in terms of security. All the people with access to an OT Personnel 39 environment can introduce malware to the system (intentionally or All levels unintentionally), become targets of phishing or cause damage to the system and compromise its security in a variety of ways. On the other hand, people require particular protection, as their privacy and physical safety may be endangered in the event of security incident. Table 1: Asset taxonomy Figure 7 provides a view of the criticality of the main assets described in the asset taxonomy, based on the responses provided by subject matter experts during their interviews. These interviews involved a structured Indicated levels correspond to the concept of layers as explained in subchapter 2.3 High-level reference model. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 questionnaire in which one of the questions referred to an in-depth evaluation of the main IIoT / Smart Manufacturing assets according to their criticality. The experts could select any number of assets they considered the most important in terms of cybersecurity of the IIoT ecosystem. The figures presented below correspond to the percentage of experts who selected a given option. Figure 7: Asset criticality The figure shows that stakeholders consider ICS, i.e. PLCs, RTUs, DCS and SCADA systems to be the most critical assets for Smart Manufacturing and Industry 4.0. Such a choice comes as no surprise as these systems control and supervise industrial processes and their functioning is therefore indispensable for proper execution and safety of production. As the study revealed, in terms of criticality, industrial control systems are followed by IoT devices, notably IIoT gateways, sensors and actuators. Over half of the respondents selected each of these types of assets confirming that the introduction of new connected devices to OT environments is in fact a security challenge and generates a need for additional protection. Among the other answers provided by the respondents, the human factor (e.g. operators, maintenance staff and third parties) was highlighted. People were identified as critical assets as they may become targets of phishing campaigns and their errors can allow malware to penetrate a system. Moreover, stakeholders noted that, apart from the assets themselves, asset management is of great importance. To secure the assets properly, companies should be aware of the devices and solutions they have, where they are located and how secure they are, i.e. what type of protection mechanisms/security measures have been applied. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

3. Threats and risk analysis

Threats taxonomy Industry 4.0 environments face numerous security challenges caused by a large number of factors and hence they need to be prepared to handle a wide variety of cybersecurity threats. In addition to threats related to IoT technologies, Industry 4.0 and Smart Manufacturing companies are likely to be affected by additional threats, which are typical in OT and IT environments. A good illustration of this is the recent large-scale ransomware attack called NotPetya , as more that 50% of the companies hit by this attack were industrial companies . In accordance with with ENISA Threat Taxonomy , we have developed a threat taxonomy focused on Industry 4.0, which is depicted in Figure 8 and described in detail in Table 2. See the list of indicative incidents in Annex A:D. See Kaspersky Lab (2017) “More than 50% of organizations attacked by ExPetr (Petya) cryptolocker are industrial companies”: https://ics-cert.kaspersky.com/alerts/2017/06/29/more-than-50-percent-of-organizations-attacked-byexpetr-petya-cryptolocker-are-industrial-companies/ See ENISA (2016) “ENISA Threat Taxonomy A tool for structuring threat information”: https://www.enisa.europa.eu/topics/threat-risk-management/threats-and-trends/enisa-threatlandscape/etl2015/enisa-threat-taxonomy-a-tool-for-structuring-threat-information Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Figure 8: Industry 4.0 threat taxonomy CATEGORY THREAT DESCRIPTION ASSETS AFFECTED A Denial of Service attack can be bi-directional: - IIoT end devices It can target an IIoT system resulting in system - ICS unavailability and production disruption caused - ICS communication networks & by a massive number of requests sent to the components system. - Information Denial of Service On the other hand, an attacker may take - Cloud computing services advantage of a large number of IIoT devices in an - Mobile devices industrial environment and create an army of IoT - Servers and systems botnets as a platform to attack some other - Software system. - IIoT end devices The penetration of malicious software in an IIoT - ICS aimed at performing unwanted and - Servers and systems unauthorised actions, which may cause damage - Real time monitoring and Malware to an OT system, operational processes and security tools related data. Ransomware, viruses, Trojan - Information horses and spyware are common examples of - Cloud computing services this threat. - Software - IIoT end devices Threat of unauthorized manipulation of devices - ICS software or applications within an OT system by - ICS communication networks & Manipulation of an attacker. In terms of industrial IoT systems, an components hardware & attacker’s actions may include manipulation of - Software software an industrial robot, manipulation of remote - Real time monitoring and Nefarious controller devices suppressing state of a control security tools activity / Abuse device and modification of its configuration. - Advanced robotics - Personnel - IIoT end devices The threat of unwanted and unauthorized data - ICS modification by an attacker. This may apply to - Information compromising OT or production supporting - Cloud computing services Manipulation of systems, such as SCADA, MES, Historian and - Big data analytics Information manipulation of process data. Possible - Real time monitoring and consequences may include inappropriate security tools decisions based on falsified data. - Servers and systems - Software and Licenses The threat of a cyberattack targeting a specific organisation (or a specific person in this organisation). Such attack aims at harming an organisation possibly to take control over the system using various technical means such as compromising key devices and falsifying telemetry deceiving unaware operators. Other - IIoT end devices Targeted attacks impacts include damage of reputation or theft of - ICS company secrets. When the target is a - Information manufacturing company, the attacker may, for instance, attempt to steal formulas or recipes and sell them to the competition. An attacker may use Artificial Intelligence to execute a highly personalised attack, tailored to selected group or individual employees. This attack is different from wider scale attacks whose objective is to Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 CATEGORY THREAT DESCRIPTION ASSETS AFFECTED infect any company that connects to a certain website prepared by an attacker or any company that uses a device or software with a certain vulnerability. The threat of compromising personal / sensitive information stored on devices or in the cloud. The attacker’s goal is to gain unauthorised access - IIoT end devices to this kind of data and use it in an illicit manner. Abuse of personal - Information In manufacturing companies this may apply to data - Cloud computing services names and roles of OT system users. Production - Personnel data is not considered to be subject to privacy but it may also pose problems if it can be linked to the performance of individual employees. The threat of gaining unauthorised access to an - IIoT end devices organisation’s resources (i.e. data, systems, - ICS devices, etc.) through a large number of - Mobile devices attempts to guess the correct key or password. Brute force - ICS communication networks & Industry 4.0 organisations that allow the components utilisation of uncomplicated or default - Real time monitoring and passwords for industrial devices and systems security tools may be especially vulnerable to such attacks. The threat of active eavesdropping, where messages exchanged between unaware affected - Information parties are relayed by an attacker. The attacker Man-in-the-Middle - ICS communication networks may just listen to the exchanged messages (e.g. attack / Session and their components to steal a company’s sensitive or confidential hijacking - IIoT end devices information) or modify or delete transmitted - Mobile devices information, leading to communication disruption. The threat of an attacker taking control of an - Information Eavesdropping existing communication session between two - ICS communication networks / Interception / IoT communication network components, which may lead to the and their components Hijacking protocol hijacking disclosure of passwords and other confidential - IIoT end devices information. - Decision making algorithms The threat of revealing internal network information (e.g. connected devices, used - Information protocols, open ports and used services, etc.) to Network - IIoT end devices an attacker who manages to scan a network reconnaissance - ICS communication networks & passively. With this knowledge, the attacker can components plan which actions to take next to compromise system operation. The threat of causing physical damage to the device by a saboteur who gains physical access to - IIoT end devices the OT environment - either an outsider who has - ICS managed to bypass insufficient physical security - Mobile devices Vandalism and Physical attack - ICS communication networks & theft measures or an insider, e.g. a disgruntled employee who, for some reasons, wants to harm components - Advanced robotics the organisation. This threat also includes theft. The necessity to replace a damaged or stolen - Personnel device may result in unplanned production Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 CATEGORY THREAT DESCRIPTION ASSETS AFFECTED downtime related to the delivery time of spare parts. The threat of tampering with a device by a saboteur who gains physical access to the OT environment - either an outsider who manages to bypass insufficient physical security measures - IIoT end devices or an insider, e.g. a disgruntled employee who, Sabotage - ICS for some reasons, wants to harm the - Mobile devices organisation. The attacker may take advantage of improper configuration of ports and possibility exploit open ports. The attacker may also use access to execute unauthorised operator actions. - IIoT end devices - ICS The threat of disrupting an operational process - ICS communication networks & by unintentional data or configuration change in components Unintentional the OT system performed by an insufficiently - Advanced robotics change of data or trained employee. Even with good intentions, an - Information configuration in the unskilled employee, unaware of the - Cloud computing services OT system consequences, may introduce improper changes - Big data analytics to the system, especially if he or she receives - Software and licenses higher than necessary privileges. - Servers and systems - Personnel The threat of disrupting an operational process - IIoT end devices or causing physical damage to the device by - ICS Unintentional unintentional misuse of an IIoT/OT device by an Erroneous use or - Mobile devices damages insufficiently trained employee. Even with good administration of - ICS communication networks & (accidental) intentions, an unskilled employee may devices and components inadvertently fail to use a device in accordance systems - Advanced robotics with the manuals and guidelines thereby - Information disrupting the operation of the device or causing - Personnel physical damage to it. The threat of damaging OT assets caused by a - IIoT end devices third party. In Industry 4.0, third parties may - ICS have access to the OT system, for example, for - ICS communication networks & Damage caused by maintenance or software update purposes. If components a third party this access is not controlled in a sufficient way, - Advanced robotics security breaches of a third party organisation - Cloud computing services may affect the company that receives the - Information service. The threat of failure or malfunction of IIoT end Failure or devices. This can occasionally happen, especially - IIoT end devices malfunction of a if proper maintenance and compliance with the - ICS sensor / actuator devices’ manuals and instructions during the exploitation is not ensured. Failures / Malfunctions The threat of failure or malfunction of control Failure or - IIoT end devices system. This can occasionally happen, especially malfunction of a - ICS if proper maintenance and compliance with the control system - ICS communication networks & devices’ manuals and instructions during the (PLC, RTU, DCS) components exploitation is not ensured. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 CATEGORY THREAT DESCRIPTION ASSETS AFFECTED The threat that an attacker takes advantage of Software IIoT end device firmware or software - IIoT end devices vulnerabilities vulnerabilities. Such devices are often vulnerable - Information exploitation due to lack of updates, usage of weak or default - Software and Licenses passwords and improper configuration. - IIoT end devices - ICS Failure or The threat of disruption of processes that rely on - ICS communication networks & disruption of third party services in case of failure or components service providers malfunction of these services. - Information - Cloud computing services - Big data analytics The threat of unavailability of communication Communication - ICS communication networks & links related to problems with cable, wireless or network outage components mobile network. The threat of failure or malfunction of the power - IIoT end devices supply. If no emergency power supply exists for - ICS Power supply Outages critical systems, any power supply disruption - ICS communication networks & outage may result in serious consequences due to a components sudden shutdown of production processes. - Advanced robotics Loss of support The threat of failure or malfunctions of systems services (MES, ERP, supporting production or logistics, i.e. MES, ERP - Servers and systems CRM) and CRM. The threat of legal issues and financial losses Violation of rules related to personal data processing, e.g. related and regulations / to the usage of IIoT end devices without - IIoT end devices Breach of complying with local laws or regulations. In - Information legislation / Abuse operations within the European Union, these of personal data requirements are imposed on companies by the Legal GDPR. - IIoT end devices The threat of violating contractual requirements Failure to meet - Cloud computing services by components manufacturers and software contractual - Information providers in case of failure to ensure the required requirements - ICS security measures. - Software & licences - IIoT end devices The threat of natural disasters such as floods, - ICS lightning strikes, heavy winds, rain and snowfall, - ICS communication networks & Natural disasters which may cause physical damage to the OT components environment components. - Advanced robotics - Personnel Disaster - IIoT end devices The threat of incidents and unfavourable - ICS Environmental conditions such as fires, pollution, dust, - ICS communication networks & disasters corrosion, explosions, which may cause physical components damage to OT environment components. - Advanced robotics - Personnel Table 2: Industry 4.0 threat taxonomy Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Examples of Industry 4.0/Smart Manufacturing cyber security attack scenarios Subject matter experts have assessed attack scenarios based on these threats during the interview process to identify critical attack scenarios for Smart Manufacturing organisations. For each proposed attack scenario, experts selected their perceived criticality level (not important, of low, medium or high importance or as crucial). Analysis of the experts’ answers is the source of the results presented in Table 3. ATTACK SCENARIOS SEVERITY 1. Against the connection between the controller (e.g. DCS, PLC) and the actuators High 2. Against sensors (modification of measured values / states, their reconfiguration, High etc.) 3. Against actuators (suppressing their state, modifying the configuration) High - Crucial 4. Against the information transmitted via the network High - Crucial 5. Against IIoT gateways High - Crucial 6. Manipulation of remote controller devices (e.g. operating panels, smartphones) High 7. Against the Safety Instrumented Systems (SIS) Crucial 8. Malware High 9. DDoS attack using (IoT) botnets Medium - High 10. Stepping stones attacks (e.g. against the Cloud) Medium 11. Human error-based and social engineering attacks High 12. Highly personalised attacks using Artificial Intelligence Technologies Medium - High Table 3: IIoT attack scenarios For each attack scenario, a brief description detailing the potential impact and related threats based on the Threats taxonomy (section 3.1) can be found below. 1. Against the connection between the controller (e.g. DCS, PLC) and the actuators This type of attack takes place when an attacker injects and executes code or sends (manipulated) data by a compromised system using a line that is not monitored.  Impact: Manipulation or loss of control, damage of the batch/product and infrastructure.  Related threats: Internal and external sabotage, manipulation of hardware & software, control device configuration manipulation. 2. Against sensors (modification of measured values / states, their reconfiguration, etc.) The measurement data is manipulated in the end devices, e.g. by breaking into the sensor and modifying its firmware or configuration, such as measurements adjustment etc. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  Impact: Making the wrong operator decisions based on manipulated data. Conducting the process based on incorrect measurements. Measurements covered by the regulations will not be evaluated properly.  Related threats: Modification of information, sabotage, manipulation of hardware & software, manipulation of transmitted sensor data. 3. Against actuators (suppressing their state, modifying their configuration) Manipulation of the actuators’ configuration/parameters making them use wrong configurations, thresholds or data, and therefore affecting their normal behaviour by sabotaging their normal operation settings.  Impact: It varies depending on the actuators affected. It can affect production processes.  Related threats: Manipulation of hardware & software, failure or malfunction of a sensor / actuator, failure or malfunction of a control system (PLC, RTU, DCS). 4. Against the information being transmitted via the network The attack aims to manipulate the data at the network layer (layer 2,3,4 model OSI). At the level of layer 5,6,7 of the OSI model, i.e. controller and control system (DCS, SCADA), data values seem to be correct. Manipulation can be detected by network layer traffic monitoring.  Impact: It varies depending on the data manipulated. It can affect production process or cause damage to the process, e.g. manipulation of furnace temperature that can cause explosion.  Related threats: APT, Man-in-the-Middle attack, sabotage, malware. 5. Against IIoT gateways An attacker tries to compromise an IIoT gateway, potentially compromising the entire environment. It can be quite successful if weak/vulnerable protocols or default passwords or protocols are used. This type of attack comprises different stages/phases and it is usually launched in a covert manner. It should be noted that this type of attack should be taken into account over a device’s entire lifecycle.  Impact: An attacker gains access to the network and data including access to the devices, systems and network equipment. It can be the first stage of exploitation of the whole system and its components.  Related threats: Password attacks, exploit kits, abuse of personal data, malware and DDoS. 6. Manipulation of remote controller devices (e.g. operating panels, smartphones) An attacker can break into a device that is far away from the control system (distributed environment). Often such devices are intended for local control and are not monitored on an ongoing basis. The acquisition of such a device is a great threat to the possibility of infiltration of the entire network as well as causing damage to the equipment, where it will take a long time to obtain this information and could therefore magnify the damage.  Impact: Gaining access to the system and full access to the control layer as well as engineering tools and changes. It can cause dangerous changes to the IoT environment.  Related threats: Password attacks, software vulnerabilities exploitation, session hijacking, disclosure of information. 7. Against the Safety Instrumented Systems (SIS) Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 One of the most dangerous attacks is against systems that are ultimately supposed to protect the environment, human life and/or companies against large financial losses. Taking over the control system or any manipulation of this system can lead to the destruction of the installation or in the least dangerous case to the unplanned interruption of the process. An example of such attack is the recent Triton attack .  Impact: Compromise of SIS, manipulation or interruption of SIS may affect many people, cause environmental issues and even extend to other systems, affecting their operations or even disabling them.  Related threats: Malware, sabotage, remote controller devices manipulation, APT. 8. Malware These attacks are carried out by a malicious code that spreads over the network. It can give access to the victim's data. Since these attacks are malware-based, they can be avoided by updating/patching vulnerable devices. This can also be done outside the IIoT ecosystem. The problem regarding IIoT is the difficulty to update/patch the different devices - some of them do not offer the ability to be updated or patched.  Impact: There are many possible targets for malware within IIoT – an attacker could take control of a smart thermostat in the middle of winter and not turn on the heat, or he or she could hold power grids or hospitals systems, etc., putting people’s safety at risk.  Related threats: Exploit kits, malware, DDoS, password attacks. 9. DDoS attack with (IoT) botnets This type of attack does not target IIoT devices themselves, but instead uses them to attack other devices, not necessarily IIoT devices. Firstly, malware automatically finds vulnerable Internet of Things devices, infecting and conscripting them into a botnet, which then can be used to mount DDoS attacks, flooding the target's servers with malicious traffic.  Impact: The target device or service is flooded with malicious traffic, taking it down.  Related threats: Exploit kits, DDoS and malware. 10. Stepping stones attacks (e.g. against the Cloud) This type of attack is a common way to launch anonymous attacks. They are often used by network intruders to hide their identities, since they launch attacks not from their own computer but from intermediary hosts they have previously compromised.  Impact: If an attacker launches a stepping stone attack, he or she could compromise a collection of hosts, using them as stepping stones to relay attack commands.  Related threats: APT, DDoS, malware. 11. Human error-based and social engineering attacks FireEye (2017) “Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure”: https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attackframework-triton.html Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 This type of attack is usually the gateway to launch other types of attacks; it is a means to an end. Attacks or human-errors are used to gain unauthorised privileged access to a system, which can lead to the installation of other malicious content or backdoors or even physical access to the devices. It is used as part of an attack, regardless of whether the target is a single system/device or a whole network or facility. It is difficult to detect these attacks due to non-technical character, and it is much easier to detect the suspicious actions in the environment based on very good awareness trainings for employees.  Impact: If successful, the social engineering attack creates an entry point to a system or facilities, in some cases with elevated privileges. A human error-based attack could cause the system to crash or become unstable. This attack is commonly used as part of a larger, sophisticated attack, which could be simple data theft or a complex APT.  Related threats: Erroneous use or administration of devices and systems, unintentional change of data or configuration in the OT system, physical damage to equipment, theft of intellectual values. 12. Highly personalised attacks using Artificial Intelligence Technologies (AIT) Attacks to identify patterns for reconciliation or direct attack on IIoT systems. Their main threat is the use of often potentially insignificant information. With the application of AIT attackers can combine specific data obtained from the Internet and explicit data to find a hole in the security.  Impact: These attacks can be very personalised and target particular people, e.g. system administrators. The development of communication throughout the IIoT ecosystem could also be a target. Such an attack may be the first attack or one of the subsequent phases of an attack.  Related threats: Loss of data, network reconnaissance. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

4. Security measures and good practices

Security Measure categorisation Development of Security Measures for IoT in Smart Manufacturing was one of the focal points of this study. The idea behind it was to provide guidelines and recommendations for Operators, Manufacturers and Users of Industrial IoT that, if applied, can help prevent or properly respond to potential cyberattacks and ensure overall security and safety of the industrial IoT environment. As part of this study, a considerable effort was expended to identify all the relevant aspects related to this issue. Firstly, extensive desktop research was conducted. Thorough analysis of relevant sources (listed in Annex C) allowed distinguishing frequently mentioned topics in IIoT security. These topics were then aggregated to create an initial list of security domains. Final set of domains was clarified and adapted based on the interviews conducted with the stakeholders resulting in a list of 20 domains that provide a comprehensive view of the Industry 4.0 landscape and indicate areas that require protection. To organise the domains in a logical manner, they were classified into three main groups:  Policies  Organisational practices  Technical practices These groups provide a high-level division and are in line with the classification of the ENISA “Baseline Security Recommendations for IoT” study. Figure 9: Good practices overview Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 Policies This first group of Security Measures mostly refers to policies and procedures that should be established within organisations to help ensure a good level of cybersecurity, especially where IIoT solutions are concerned. In addition, privacy issues have been covered in the context of manufacturers who should ensure that their solutions do not violate privacy regulations, and operators, who should be sensitised to privacy related risks and made aware of how to utilise IIoT devices without exposing users’ personal information. 4.2.1 Security by design Security measures which should be applied from the very beginning of product development.  PS-01: Treat IoT cybersecurity as a cycle, not as an end-to-end process, adopting a security by design approach from the perspective of the devices and infrastructure at every step of a smart manufacturing system development lifecycle (SDLC).  PS-02: Address cybersecurity through embedded features of endpoints rather than only at the network level.  PS-03: Equip, as deemed appropriate after a security and safety assessment, even the most basic connected devices holding very limited processing capabilities (e.g. actuators, converters) with identification and authentication features and ensure compatibility with IAM class solutions.  PS-04: Perform risk and threat analysis involving cybersecurity experts from the very early stages of the design process of the device to find out which security features will be necessary.  PS-05: In each design document include a chapter addressing the security of all the information and control systems in the industrial environment. 4.2.2 Privacy by design Security measures related to privacy and protection of personal data. These measures should be applied from the first stages of product development.  PS-06: Address privacy related issues based on applicable local and international regulations, such as the General Data Protection Regulation (GDPR) .  PS-07: Define the scope of the data that will be processed by the device as well as the objective of this processing during the design phase, avoiding collecting or unnecessarily providing sensitive data.  PS-08: Establish a physical location of data storage and define between which organisations data will be transferred restricting access to collected personal data only to authorised individuals.  PS-09: Conduct a Privacy Impact Analysis (PIA) for the data that will be processed by the device.  PS-10: Separate data that can be used to identify an individual from other information and ensure its security, e.g. through encryption of any personal data transferred within the IIoT environment. 4.2.3 Asset Management Security measures regarding asset discovery, administration, monitoring and maintenance.  PS-11: Utilise tools supporting asset management that are able dynamically to discover, identify and enumerate assets specific to the organisation and industrial environment.  PS-12: Ensure that your company has a consistent and up-to-date asset inventory. General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/2016-05-04 Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  PS-13: In complex industrial environments with legacy systems, use passive monitoring devices wherever feasible or precede the implementation with a testing phase if you consider active monitoring tools.  PS-14: Use a centralised asset inventory for the entire computerised environment inside a manufacturing plant.  PS-15: Consider secure administration of assets with management of the infrastructure and security devices via a dedicated management network.  PS-16: Introduce a new device into the system only according to an established, accepted and communicated change management process.  PS-17: Avoid the usage of removable devices disabling the USB ports if there is no accepted business requirement. 4.2.4 Risk and Threat Management Security measures regarding the recommended approach to the process of risk and threat management adapted to Industry 4.0 environment.  PS-18: Adopt an approach to risk management dedicated to Industry 4.0 and Smart Manufacturing considering new parameters, threats and attack scenarios.  PS-19: For critical infrastructures in manufacturing environments, establish a number of risk management areas completely aligned with corporate, safety and environmental sides. Assess and characterise threats, vulnerabilities and protection measures against those risk management areas.  PS-20: Establish risk and threat management process according to the individual needs and security requirements of your company.  PS-21: Perform risk analysis which includes cybersecurity aspects at least annually. Also, integrate it with other processes, such as change management, incident handling and vulnerability management. The risk assessment should cover technical and procedural testing of effectiveness of the security policies and process.  PS-22: Consider incorporating threat intelligence process within the threat management approach of your company relying on various sources of information and sharing information with trusted industry partners, ISACs and CERTs.  PS-23: From an organisational perspective, monitor selected threats and determine their impact on systems by performing a risk analysis.  PS-24: Regarding the Risk Management process, adopt two different approaches at the same time: topdown, addressing cybersecurity from the organisation-wide perspective, and bottom-up , providing a very granular and detailed view on the company’s situation. Organisational practices Organisation principles and governance are indispensable factors that are usually critical in terms of company security. The following Security Measures explain how Smart Manufacturing and other Industry 4.0 companies should operate, what organisational rules and responsibilities they should establish and follow and what approach they should adopt towards their employees and third party contractors to handle effectively cybersecurity incidents, manage vulnerabilities and ensure security of IIoT solutions throughout their lifecycle. See more information on the top-down and bottom-up approach in Annex B:. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 4.3.1 Endpoints lifecycle Security measures related to security at different stages of product (including end devices and infrastructure) lifecycle, including the procurement process, supply chain, handover phase, exploitation and end-of-life.  OP-01: Focus on the security of software and hardware during every stage of the endpoint lifecycle.  OP-02: Take into account security considerations throughout the supply chain.  OP-03: Consider security aspects during the overall procurement process defining security measures and requirements tailored to particular devices/solutions.  OP-04: Conduct cybersecurity acceptance tests against technical specification during different validation activities or stages of the product lifecycle.  OP-05: During the handover phase of the project implementation process, properly build and transfer all cybersecurity documentation, processes and procedures. 4.3.2 Security Architecture Security measures regarding the architectural-based approach and establishment of security architecture.  OP-06: To ensure security in a computerised ecosystem, adopt a holistic architectural-based approach and develop a risk-aligned security architecture based on business requirements.  OP-07: While defining security architecture, ensure that it comprises all relevant security aspects – from organisational to physical implementation issues.  OP-08: Within the security architecture, allocate clear roles and responsibilities for security. Clearly define and communicate roles for both OT systems and security processes.  OP-09: Integrate compliance enforcement controls to the established Security Architecture and ensure that all products meet the requirements defined within it. 4.3.3 Incident handling Security measures regarding the detection and response to incidents that may occur in Industry 4.0 environments.  OP-10: Define cyber incidents relevant for your organisation based on the company's area and range of operation and classify them according to applicable standards.  OP-11: Consider creation of a Cybersecurity Operations Centre (SOC) consisting of OT and IT cybersecurity specialists to support cybersecurity incidents dividing them into specific lines of support with appropriate roles and responsibilities.  OP-12: Establish a process for incidents handling that consists of identification of affected assets, identification and classification of vulnerabilities, escalation and notification.  OP-13: Detect and investigate promptly every unusual security related event. 4.3.4 Vulnerabilities management Security measures on the vulnerability management process, related activities and vulnerability disclosure.  OP-14: Define a comprehensive vulnerability management process within the organisation that covers utilisation of automatic and manual tools resulting from risk analysis.  OP-15: While eliminating vulnerabilities, begin from the most critical ones taking into account criticality of assets and systems.  OP-16: Establish a comprehensive and well-defined process for disclosure of vulnerabilities.  OP-17: Conduct penetration tests of new IIoT solutions in a controlled environment or before / during commissioning phase, and also regularly and after an important update of the system. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  OP-18: Establish tight collaboration of OT and IT departments ensuring that their collaboration with systems business owners, decision-making authorities and other stakeholders is effective as well. 4.3.5 Training and Awareness Security measures regarding the recommended approach related to security training and raising awareness of employees working with IIoT devices and systems.  OP-19: Adopt a holistic approach to security training and awareness of the employees, covering employees on all levels of the organisation and addressing new Industry 4.0 related threats.  OP-20: Provide all newly hired employees with cybersecurity training before the start of the job.  OP-21: Ensure that security training is continuous, regular and frequently updated.  OP-22: Train users of IIoT on the secure usage of their devices explaining to them the technologies deployed to protect IIoT devices and the ecosystem.  OP-23: Consider communicating with other companies on a sector level including the supply chain and participate in international security infrastructures formed to enable discussion, cooperation and intelligence sharing across organisations to improve security awareness. 4.3.6 Third Party Management Security measures related to third party management and control of third party access.  OP-24: Strictly control access of third parties to a control or production layer only granting access ondemand, in a specified time window, for a specific purpose, and in a least privileged way.  OP-25: Do not provide a direct connection for the vendor to a system in a control or production layer. Allow access only to the necessary selected functions and parts of the network.  OP-26: Prompt the suppliers for information on security of their processes and commitments to their product and develop dedicated security requirements for vendors and service providers.  OP-27: Clearly define all relevant aspects of the partnership with third parties, including security, within the appropriate agreements and contracts. Technical practices Apart from implementing policies and organisational practices, security also needs to be addressed through the appropriate technical capabilities of IIoT solutions and the environments where they are deployed. The Technical Security Measures listed below constitute a last piece of the puzzle enabling Industry 4.0 and Smart Manufacturing companies to improve their level of security. This section provides an overview of what technical security measures should be implemented in the devices, as well as corresponding solutions and how they should be implemented. We also discuss recommended methods for Smart Manufacturing companies to ensure resilience of their infrastructure and continuity of production processes. 4.4.1 Trust and Integrity Management Security measures that can help ensure the integrity and trustfulness of data and devices.  TM-01: Verify the integrity of the software before starting to run it ensuring that it comes from a reliable source (signed by the vendor) and that it is obtained in a secure manner.  TM-02: Authorise all IIoT devices within the OT network utilising appropriate methods, e.g. digital certificates/PKI.  TM-03: Define data exchange channels between IIoT devices in the form of a whitelist and choose only secure channels whenever possible.  TM-04: Implement application whitelists and review the list at least annually and in case of a change to the system. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  TM-05: Ensure production data integrity through utilisation of appropriate cryptographic mechanisms and key storage tailored to processing capabilities of the implemented solutions.  TM-06: Monitor the production data at rest and in transit to identify potential unauthorised data modification. 4.4.2 Cloud security Security measures regarding various security aspects of cloud computing.  TM-07: Base your decisions regarding the choice of the type of cloud on a business and privacy impact assessment taking also into consideration laws and regulations applicable to the cloud security provider’s country and points of presence.  TM-08: Include security and availability aspects in agreements with cloud security providers, if applicable.  TM-09: In the context of cloud-based application and centralised systems, avoid single points of failure.  TM-10: Locate critical systems and applications within the private or at least hybrid deployment models and precede implementation with a risk analysis if you consider utilisation of a public cloud.  TM-11: To mitigate the risk related to cloud attacks, adopt a zero-knowledge security approach and protect all data within the cloud and in transfer. 4.4.3 Business continuity and recovery Security measures regarding the development, testing and reviewing of company’s plan to ensure resilience and continuity of operations in the event of security incidents.  TM-12: Focus on ensuring resilience of Industry 4.0 systems by creating a business continuity plan (BCP) and disaster recovery plan (DRP). Test the plans periodically and adapt them according to lessons learnt from tests and actual security incidents.  TM-13: Define critical business and technological processes and determine to what extent they influence business continuity.  TM-14: Perform threat and risk assessment and develop written procedures on how to return to the normal – well-defined – state of operation tailored to the assessment’s results.  TM-15: Consider contingency planning preceded by risk analysis. Define contingency plans and test them executing controlled exercises. Regularly review the plan and adjust it appropriately.  TM-16: In business continuity and recovery plans, include third party aspects.  TM-17: Define important parameters for your company’s business continuity, such as a recovery time objective (RTO), recovery point objective (RPO), maximum tolerable outage (MTO) and minimum business continuity objective (MBCO). 4.4.4 Machine-to-Machine security Security measures regarding key storage, encryption, input validation and protection in Machine-to- Machine communications security.  TM-18: Store long-term service-layer keys (other than public keys) in a server-HSM residing in infrastructure equipment.  TM-19: Establish a security association with proven and secure cryptographic algorithms between the communicating entities to provide mutual authentication, integrity and confidentiality.  TM-20: Use communication protocols that include the functionality to detect if all or part of a message is an unauthorised repeat of an earlier message.  TM-21: Use positive / whitelist input validation to protect against cross-site scripting and command injection. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 4.4.5 Data Protection Security measures regarding protection of confidential data on various levels of an organisation and management of access to data.  TM-22: Protect data at rest (both in volatile and non-volatile memory), in transit and in use.  TM-23: Categorise data related to the OT system based on risk analysis, assess its criticality and define required security measures that will ensure proper level of security.  TM-24: Grant access to certain categories of data to Third Parties with least privilege and need-to-know principles in mind and document this access.  TM-25: For data of high confidentiality implement encryption and key management so that the information can be read only by authorised users and use data loss prevention solutions.  TM-26: Anonymise and secure any direct or indirect personal data processed within the company, e.g. through role-based access control and encryption, having considered all relevant legal requirements. 4.4.6 Software/Firmware updates Security measures regarding verification, testing and execution of patches.  TM-27: Verify endpoints' software/firmware authenticity and integrity and ensure tight control over the update.  TM-28: Verify the source of the update and execute automatic update procedures only if they are based on the risk analysis.  TM-29: Perform deployment of patches for the IIoT devices only after proving that no negative consequences exist and test the patches in a test environment before implementing them in production.  TM-30: Allow Third Parties to perform patching only if they guarantee and are able to prove that the patch has been tested and will not lead to any adverse consequences on the device or if they accept liability for the update according to an applicable agreement.  TM-31: For control systems that cannot be updated, apply compensating measures. 4.4.7 Access Control Security measures regarding the control of remote access, authentication, privileges, accounts and physical access.  TM-32: Segregate remote access, i.e. develop a set of rules for control of the remote communication.  TM-33: Ensure minimal level of authentication for the IIoT devices and systems and ensure that authorisation allows only for access to a certain segment of the system.  TM-34: Implement / Use multi-factor authentication capability in the IIoT solutions.  TM-35: Change default passwords and usernames during the commissioning / first use. Use strong passwords and require the setting of a new password after a defined period.  TM-36: Apply the least privilege principle and ensure that in an environment with multiple users, roles are properly segregated and approved by a proper person.  TM-37: Create individual accounts for every user whenever possible.  TM-38: Implement / Use an account lockout functionality in IIoT devices.  TM-39: In case of extensive and diversified networks with a large number of devices, adopt a Privilege Access Management (PAM) solution.  TM-40: Within access control, consider aspects of physical access to buildings, areas, rooms and cabinets. 4.4.8 Networks, protocols and encryption Security measures can help ensure security of communications through proper protocols implementation, encryption and network segmentation. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018  TM-41: Secure communication channels related to IIoT solutions and encrypt communication in case of important data, where technically possible.  TM-42: Segment industrial plants networks based on a pre-defined zoning model that includes establishment of De-Militarised Zones (DMZ) and control of traffic between zones, e.g. according to the Purdue Model.  TM-43: Follow the micro segmentation approach, i.e. build small islands of components within a single network that communicate only with each other and control the network traffic between segments.  TM-44: If possible, isolate safety networks from business and control networks.  TM-45: For IIoT solutions implement proven-in-use protocols with known security capabilities, based on standards and technical recommendations. Choose solutions that use protocols that have been proved secure or tackle previous security issues (e.g. TLS 1.3) and avoid the ones with known vulnerabilities (e.g. Telnet, SNMP v1 or v2).  TM-46: Ensure security capabilities and interoperability between protocols when implementing different protocols for various devices within the same system.  TM-47: If possible, limit the number of protocols implemented within a given environment and disable default network services that are unused.  TM-48: Ensure a secure environment for key exchange and key management avoiding sharing cryptographic keys across multiple devices.  TM-49: Ensure the proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of data and information (including control messages), in transit and at rest. Ensure the proper selection of standard and strong encryption algorithms and strong keys, and disable insecure protocols. Verify the robustness of the implementation. 4.4.9 Monitoring and auditing Security measures regarding the network traffic and availability monitoring, logs collection and reviews.  TM-50: Implement a passive monitoring solution in the IT and OT environments to create an industrial network traffic baseline and monitor anomalies and adherence to the baseline.  TM-51: Collect security logs and analyse them in real-time using dedicated tools, e.g. SIEM class solutions, for example within a Security Operation Centre (SOC).  TM-52: Perform periodic reviews of network logs, access control privileges and asset configurations.  TM-53: Monitor availability of the IIoT devices in real time, where technically feasible. 4.4.10 Configuration Management Security measures regarding security configuration, management of changes in configuration, devices hardening and backup verification.  TM-54: Establish baseline security configurations tailored to different types of assets.  TM-55: Implement a mechanism and supporting tools that enable configuration management.  TM-56: Implement and document changes in configuration according to a change management policy developed by the organisation based on risk analysis.  TM-57: Develop a dedicated procedure for impact analysis and perform it before implementation of change to the system.  TM-58: Harden IIoT solutions and include this in change management policy.  TM-59: Create and apply a comprehensive backup plan, including provisions for periodic testing, tailored to different types of assets. Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

Glossary

APT Advanced Persistent Threat BCP Business Continuity Plan BLE Bluetooth Low Energy CRM Customer Relationship Management CERT Computer Emergency Readiness Team (D)DoS (Distributed) Denial of Service DCS Distributed Control System DRP Disaster Recovery Plan ERP Enterprise Resource Planning ESS Executive Support System HMI Human Machine Interface ICS Industrial Control System IDS Intrusion Detection System IP Internet Protocol IPS Intrusion Prevention System ISAC Information Sharing and Analysis Centre M2M Machine to Machine MES Manufacturing Execution System ML Machine Learning MQTT Message Queuing Telemetry Transport PLC Programmable Logic Controller QC Quality Control RTU Remote Terminal Unit SCADA Supervisory Control and Data Acquisition SIEM Security Information and Event Management SIS Safety Instrumented System SOC Security Operations Centre TCP Transmission Control Protocol WMS Warehouse Management System Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

Annex A: Relation to ENISA Baseline IoT Security Recommendations

Baseline Security Recommendations for IoT is a previous study conducted by ENISA, which aimed at developing guidelines for IoT security in critical information infrastructures. It serves as a foundation and point of reference for the current study, which focuses on the in-depth exploration of cybersecurity aspects within the specific area of IIoT and Industry 4.0. Because this study relies on Baseline Security Recommendations for IoT, the adopted definitions and connection with IoT are in line with ENISA’s general approach. Hereafter, the relation of IIoT to IoT is explained. ENISA defines the Internet of Things (IoT) as “a cyber-physical ecosystem of interconnected physical and potentially virtual sensors and actuators, which enable intelligent decision making. Information lies at the heart of IoT, feeding into a continuous cycle of sensing, decision making, and actions”. Based on the criteria of business function, as illustrated in Figure 10, the Internet of Things can be divided into Consumer IoT – which includes smart connected product platforms that add value to an individual customer and, Industrial IoT - which corresponds to machine connectivity that increases asset performance, product quality as well as traceability and accountability. Figure 10: Consumer and Industrial IoT devices The Industrial Internet of Things (IIoT) concept is associated with IoT focusing on digitising industries. IoT in general is a much wider concept that includes a variety of consumer products, while IIoT is specific for IoT used in OT (Operational Technology) environments. Characterised by similarities in terms of technology, IoT systems are usually more focused on usability than safety. IIoT systems however need to meet the security Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 requirements specific to the OT environments resulting in differences in terms of business drivers and characteristics , as described in Table 4. SELECTED CHARACTERISTICS INTERNET OF THINGS INDUSTRIAL INTERNET OF THINGS Prevention of process interruption, Focus Protection of personal data and assets. safety Priorities Confidentiality, Integrity, Availability Availability, Integrity, Confidentiality Interruption of processes, Impact on Device Failure Implications No critical consequences production, Potential physical threats Reaction to threat Possible shut down and remediation Maintenance of operation Need to be scheduled and performed Possible during operation time, no during down time, which may postpone Upgrades and Patch Management reasons for significant delays. the upgrade for a considerable amount of time. Relatively frequent upgrades of Long lifespan of the devices Lifecycle of the device 47 equipment (over 15 years ) Harsh environments Conditions of deployment Regular (temperature, vibration, etc.) Table 4: Indicative differences in terms of selected aspects between IoT and IIoT See Industrial Internet Consortium (2016) “Industrial Internet of Things Volume G4: Security Framework”: https://www.iiconsortium.org/pdf/IIC_PUB_G4_V1.00_PB.pdf See CISCO (2017) “Cybersecurity for Industry 4.0”: https://i40.hkpc.org/CyberSec/pdf/Day%201_1110- 1150_Mr.%20Garrick%20Ng%20(new).pdf Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

Annex B: Detailed list of security measures/good practices

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-01: Treat IoT cybersecurity as  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things a cycle - not as an end-to-end  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview process. Take into consideration Document cybersecurity aspects in any  Nefarious activity  Huawei - IoT Security White Paper 2017 activity of the development of / Abuse  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices the solution from the very  Eavesdropping / beginning. Adopt security by Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

design approach both from the Hijacking  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

devices as well as from the  Physical attack  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

infrastructure perspective.  Unintentional  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for Security by design damages the Manufacturing of the Future In a "Security by design" (accidental)  VDC - Industry 4.0: Secure by design concept, this relates to  Failures / Continuous Security Malfunctions Improvement cycles at every  Outages step of a smart manufacturing  Legal system development lifecycle  Disaster (Secure SDLC), that is analysis,

design, implementation, testing,

operations & maintenance.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-02: Address cybersecurity  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance through embedded features of  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things endpoints rather than only on  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview the network level, if it is possible Security by design / Abuse Document considering constraints such as  Failures /  Huawei - IoT Security White Paper 2017 limited computing power. Malfunctions  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Embed cybersecurity in automation systems by  Symantec - An Internet of Things Reference Architecture

 VDC - Industry 4.0: Secure by design

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

introducing fail-safe and failsecure mechanisms from design.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-03: Equip, as deemed  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things appropriate after a security and  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint safety assessment, even the Ecosystems most basic connected devices of  Huawei - IoT Security White Paper 2017 very limited processing  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices capabilities (e.g. actuators,  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 converters) with identification and authentication features and  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

ensure compatibility with IAM information security controls

class solutions.  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile This especially applies to  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy protection against unauthorized Risks re-calibration or re-  Nefarious activity  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for configuration, e.g. of measuring / Abuse the Manufacturing of the Future Security by design devices, through:  Physical attack

 Unintentional a) principle of least privilege for damages accessing device configuration (accidental) and calibration engineering tools

b) authorization and authentication for engineers

accessing engineering tools

c) strong physical security for

L0/L1 devices

d) disabling of vulnerable

wireless protocols

e) disabling of test/debug

features

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-04: Perform risk and threat  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things analysis involving cybersecurity  ETSI (European Telecommunications Standards Institute) - ETSI GR QSC 004 V1.1.1 (2017-03) Quantum experts from the very early Safe Cryptography; Quantum-Safe threat assessment stages of the design process of  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview the device to find out which / Abuse Document security features will be  Eavesdropping /  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use necessary. The analysis should Interception /  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines include possible and tailored use Hijacking  ISA - ANSI/ISA-95 Part 1: Models and Terminology cases that the device may  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations encounter. It is recommended to Security by design develop threat modelling for the  Unintentional

IIoT systems and attack trees to damages

consider resilience to various (accidental)

attack scenarios. Cybersecurity  Failures /

experts should be involved in the Malfunctions

process to provide insights on  Outages

threats and risks that the control  Legal

systems are facing based on the  Disaster

experience and knowledge of

current threat and risk

landscape.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance PS-05: In each design document  Nefarious activity  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things include a chapter addressing / Abuse  European Parliament and Council of the European Union - General Data Protection Regulation (GDPR) security of all information and  Eavesdropping / (EU) 2016/679 control systems in industrial Interception /  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview environment. Hijacking Security by design Document  Physical attack The functional and/or technical  Huawei - IoT Security White Paper 2017  Unintentional specification should at least  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program damages include information on security  IEEE - Internet of Things (IoT) Security Best Practices (accidental) measures used, including but not  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework  Failures / limited to:  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines Malfunctions

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

a) system architecture  Outages  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for  Legal information security controls b) access control  Disaster  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations c) interfaces and communication  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products security and Services

d) policy enforcement

e) mobile security

f) cloud security

g) backup/disaster recovery

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance PS-06: Address privacy related  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things issues based on applicable local  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview and international regulations, Document such as The General Data  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use Protection Regulation (GDPR).  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines A compliance function in the  IoT Security Foundation - Security Challenges on the Way Towards Smart Manufacturing organization should ensure that  ISA - ANSI/ISA-95 Part 1: Models and Terminology all new systems comply with  LNS - Putting Industrial Cyber Security at the top of the CEO agenda regulatory requirements. This  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations involves having written Privacy by design  OWASP (Open Web Application Security Project) - IoT Security Guidance requirements in technical  Legal  VDC - Industry 4.0: Secure by design specifications during tendering/procurement process.

Organizations should also take into account accountability aspect of privacy protection and implement measures that will enable them to demonstrate their relevant actions and their effectiveness.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-07: Define the scope of the  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance data that will be processed by  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview the device as well as the Document objective of this processing  ETSI (European Telecommunications Standards Institute) - ETSI TR 103 375 SmartM2M; IoT Standards during the design phase. Ensure  Nefarious activity landscape and future evolutions that only minimal amount of Privacy by design  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program personal data is collected by the / Abuse

 Legal  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework device. Avoid collecting sensitive data. If you are a user of an IIoT  ISA - ANSI/ISA-95 Part 1: Models and Terminology

system, do not provide any  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

personal or sensitive information  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

if it is not necessary.  OWASP (Open Web Application Security Project) - IoT Security Guidance

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-08: Establish the physical  ENISA - Baseline Security Recommendations for IoT location of data stored by the  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview organization and define between Document which organizations data will be  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework transferred. Restrict access to / Abuse  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 Privacy by design collected personal data only to authorized individuals.  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

Periodically revise access rights  Legal  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products

and terminate them as soon as and Services

possible after employee's change

of position/leaving company.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-09: Conduct a Privacy Impact  ETSI (European Telecommunications Standards Institute) - ETSI TR 103 375 SmartM2M; IoT Standards Analysis (PIA) –in line with GDPR landscape and future evolutions requirements- for the data that  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview Privacy by design will be processed by the device. / Abuse Document It may be integrated with the  Legal  Huawei - IoT Security White Paper 2017 overall risk management  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework process.  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance PS-10: Separate data that can be  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things used to identify an individual  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview from other information and  Nefarious activity Document ensure its security (for storing / Abuse  IEC - IEC 62443-3-3:2013 System security requirements and security levels and retrieving information, Privacy by design  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework communication services, Interception / cryptography, etc.). Any personal  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Hijacking data transferred within the IIoT  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Legal environment shall be encrypted  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products

in the traffic. and Services

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance PS-11: Utilize tools supporting  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things asset management (i.e.  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program automatic asset discovery). Asset  IEC - IEC 62443-3-3:2013 System security requirements and security levels management systems should be  Nefarious activity  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques – Information security solid and robust. / Abuse management systems -- Requirements Choose asset management tools  Eavesdropping / Asset Management  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Interception / that are able dynamically to information security controls Hijacking discover, identify and enumerate  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations assets specific to the  Failures /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security organization and industrial Malfunctions  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile environment (including those  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns using proprietary protocols).  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-12: Ensure that your company  Eavesdropping /  Huawei - IoT Security White Paper 2017 has a consistent and up-to-date Interception /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program asset inventory. This inventory Asset Management Hijacking  IEC - IEC 62443-3-3:2013 System security requirements and security levels should include, among others, IP  Physical attack  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework addresses, physical location,  Failures /  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy host, current firmware / OS Malfunctions Risks version, used communication

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

protocols, etc. Asset inventory  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security should also include gathered known vulnerabilities related to particular assets.

Clearly define and communicate the responsibility for maintaining an up-to-date asset inventory to the system owner/administrator.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance PS-13: In complex industrial  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things environments with legacy system  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program asset discovery, use passive  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework monitoring devices instead of  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations active monitoring solutions. It is  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices advisable to utilize passive automatic tools whenever it is feasible, as they do not disrupt systems operation. Utilization of active monitoring devices can  Nefarious activity cause adverse effects on the OT / Abuse Asset Management environment and disrupt the  Eavesdropping / production process. Interception / Hijacking If you consider implementation of active monitoring tools, precede it with a testing phase in a laboratory/testing environment to verify whether it will exert an adverse impact on the system, i.e. whether it will not considerably increase the network load.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy PS-14: Use a centralized asset Recommendations inventory for the entire  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things computerized environment  IEC - IEC 62443-3-3:2013 System security requirements and security levels inside a manufacturing plant.  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 While implementing change to a  Nefarious activity  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines system, update the inventory. Store the latest version of / Abuse  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

Asset Management software after implementation  Physical attack

and after every change. Periodic  Unintentional

reviews, e.g. annual, are also damages

recommended. It is also (accidental)

advisable to use security tools that enable configuration

management and change detection.

 GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint PS-15: Consider secure Ecosystems administration of assets, e.g.  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program utilize secure/encrypted  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework methods for administration of  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use IoT devices (e.g. HTTPS, SSH) and  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security associated key management. management systems -- Requirements Management of the  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Asset Management infrastructure and security  Nefarious activity information security controls devices should occur via a / Abuse  LNS - Putting Industrial Cyber Security at the top of the CEO agenda dedicated management network.  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program PS-16: Deploy a new device into  IEC - IEC 62443-3-3:2013 System security requirements and security levels the system only according to an  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework established, accepted and  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use communicated change  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for management process. Do not information security controls allow for any changes unless  LNS - Putting Industrial Cyber Security at the top of the CEO agenda designated approvals are  Nefarious activity received. Approved changes / Abuse  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

should be documented and the  Eavesdropping /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

relevant documentation Interception /  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

Asset Management updated.  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Hijacking  Physical attack Risks Emergency changes may be  Unintentional  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor carried out based on a verbal damages approval from the Change (accidental) Management Committee Head

and the system owner. However,

post emergency, the standard

procedure for documenting the

change and risk analysis is to be

applied.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-17: Avoid the usage of  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint removable devices and disable  Nefarious activity Ecosystems USB ports (or technically restrict / Abuse  Huawei - IoT Security White Paper 2017 use of removable media on USB  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework ports) if there is no accepted Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Asset Management business requirement. At least Hijacking scan the removable media  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Physical attack devices using malware detection  NIST - NIST.SP 1500-202 - Framework for Cyber-Physical Systems: Volume 2, Working Group Reports  Unintentional  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile software with up-to-date damages definitions if they need to be  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy (accidental) connected to the environment. Risks

 SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for

the Manufacturing of the Future

 Homeland Security - Strategic Principles for Securing the Internet of Things PS-18: Adopt an approach to risk  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework management dedicated to / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use Industry 4.0 and Smart  Eavesdropping /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Manufacturing. The approach to Interception / information security controls risk management can be Hijacking  NIST - NIST SP 800 30r1 - Guide for Conducting Risk Assessments qualitative or quantitative.  Physical attack Risk and Threat  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Consider new parameters,  Unintentional Management threats and attack scenarios and  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security damages cover all interdependencies NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile (accidental) between cyber-physical  Failures /

scenarios, cyber-physical Malfunctions

environmental and safety during  Outages the assessment phase.  Legal

 Disaster

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-19: For critical infrastructures  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program in manufacturing environments, / Abuse  IEC - IEC 62443-4-1:2013 Secure product development lifecycle requirements establish a number of risk  Eavesdropping /  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices management areas completely Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework aligned with the corporate, Hijacking safety, environmental, etc. sides.  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use  Physical attack Risk and Threat Assess and characterize threats,  IoT Alliance Australia - Internet of Things Security Guidelines v1.2  Unintentional Management vulnerabilities and protection  LNS - Putting Industrial Cyber Security at the top of the CEO agenda damages measures against those risk  NIST - NIST SP 800 30r1 - Guide for Conducting Risk Assessments (accidental) management areas. Based on  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Failures / that, in case of OT and Critical  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile Malfunctions Infrastructures, build a specific  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for  Outages impact-driven risk management the Manufacturing of the Future  Legal approach.  Disaster

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program PS-20: Establish risk and threat  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework management process according / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use to the individual needs and  Eavesdropping /  LNS - Putting Industrial Cyber Security at the top of the CEO agenda security requirements of your Interception /  NIST - NIST SP 800 30r1 - Guide for Conducting Risk Assessments company. It should consist of Hijacking  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations security risk assessment to  Physical attack Risk and Threat identify critical security assets  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile  Unintentional Management and threat modelling to identify  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices damages security risks and mitigations. (accidental)

 Failures /

Malfunctions

 Outages

 Legal

 Disaster

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-21: Perform risk analysis  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview which includes cybersecurity Document aspects at least annually. Also,  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network integrate it with other processes, / Abuse Operators such as change management,  Eavesdropping /  Huawei - IoT Security White Paper 2017 incident handling and Interception /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program vulnerability management in Hijacking  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use order to ensure that risk analysis  Physical attack Risk and Threat is performed:  IoT Alliance Australia - Internet of Things Security Guidelines v1.2  Unintentional Management  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security damages - in case of introducing a new management systems -- Requirements (accidental) system or a significant change to  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  Failures / an existing system, Malfunctions  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

- in the event of a critical security  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for  Outages incident, the Manufacturing of the Future  Legal

 Disaster - in case of critical vulnerabilities

detection,

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

- ad-hoc at the owners' request or in case of an exceptional

situation.

The risk assessment should cover

technical and procedural testing of effectiveness of the security

policies and process.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary PS-22: To be informed on the  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things potential attack types and  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network sources and new vulnerabilities Operators which are relevant to your  Huawei - IoT Security White Paper 2017 company’s field of operation,  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework consider incorporating threat  Nefarious activity  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use intelligence process within the / Abuse  International Telecommunications Union - Security capabilities supporting safety of the Internet of things threat management approach.  Eavesdropping /  NIST - NIST SP 800 30r1 - Guide for Conducting Risk Assessments Rely on various sources of threat Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations information, such as vendor's Hijacking  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile feed, specialized entities, other  Physical attack  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for Risk and Threat companies' sites and open  Unintentional the Manufacturing of the Future Management source. Details of threat damages

intelligence program should be (accidental) tailored to an individual  Failures / company’s needs and may vary Malfunctions from the very basic methods,  Outages such as following cyber security  Legal news, to very advanced with the  Disaster utilization of special tools and aforementioned sources,

especially in case of large companies. Before the

implementation, plan in advance how the received data will be

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

handled, who the responsible persons will be and what the

company's goals are in terms of this programme.

Incorporate information sharing with trusted industry partners,

ISACs (Information Sharing and Analysis Centres) and CERTs

(Computer Emergency Readiness Teams).

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-23: From an organizational  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview perspective, monitor selected / Abuse Document threats and determine their  Eavesdropping /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program impact on systems by Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework performing a risk analysis. Hijacking  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use Control threats detected through  Physical attack Risk and Threat  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 the threat intelligence process.  Unintentional Management  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices damages  VDC - Industry 4.0: Secure by design (accidental)

 Failures /

Malfunctions  Outages

 Legal

 Disaster

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things PS-24: Regarding the Risk  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Management process, adopt two / Abuse  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 Risk and Threat different approaches at the same  Eavesdropping /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Management time: Interception /  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile - Top-down to follow a holistic Hijacking

approach with a well-defined  Physical attack

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

strategy on how to address an  Unintentional organisation’s security issues damages taking into account its business (accidental) needs. This will help address  Failures / cybersecurity from an Malfunctions organisation-wide perspective  Outages through uniform policies,  Legal procedures and practices.  Disaster

- Bottom-up to provide a very granular and detailed view on the company’s situation also from the perspective of people and assets. It will make it possible to distinguish the differences between departments, personnel roles, specific processes etc. and make the organisation-wide programme adapted to particular needs specific to smaller parts of the organisation.

Combine these two approaches to establish a security plan tailored to the organisation as a whole and to its specific lower level aspects.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance OP-01: Focus on the security of  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint software and hardware during Ecosystems every stage of the endpoint  Failures / Endpoints lifecycle  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program lifecycle. Malfunctions  Legal  IEC - IEC 62443-3-3:2013 System security requirements and security levels At the ordering stage, provide  International Telecommunications Union - Security capabilities supporting safety of the Internet of things the vendor with defined security  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

requirements, including the  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations security capability level of  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security individual components. For IIoT  NIST - NIST SP 800-61r2: Computer Security Incident Handling Guide - Recommendations of the National devices perform local Institute of Standards and Technology commissioning before using the  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile device. During the exploitation  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for phase, ensure security of the the Manufacturing of the Future maintenance procedures. At the decommissioning stage of the device's lifecycle, remove critical data from the device and remove the device from production in a controlled manner.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things OP-02: Take into account  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint security considerations Ecosystems throughout the whole supply  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program chain. Monitor software,  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework hardware and its components / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use throughout the supply chain to  Eavesdropping /  IoT Security Foundation - Security Challenges on the Way Towards Smart Manufacturing detect and prevent unauthorized changes, e.g. introduction of Interception /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for malware to the software. Create Hijacking information security controls Endpoints lifecycle unique device identity and  Physical attack  NIST - Best practices in cyber supply chain risk management. Smart Manufacturing The Future of maintain it over the lifecycle of  Unintentional Manufacturing and Value Chain Competitiveness the device. Integrity may be damages  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations verified based on roots of trust, (accidental)  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security digital signatures and embedded  Failures /  NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security identifiers. Ensure that the Malfunctions (TLS) Implementations integrity of the manufactured  OWASP (Open Web Application Security Project) - IoT Security Guidance device can be measured and attested.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Elsevier - Avoiding the internet of insecure industrial things OP-03: Consider security aspects  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint during whole procurement Ecosystems process defining security  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program measures and requirements  IEC - IEC 62443-3-3:2013 System security requirements and security levels tailored to particular  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework devices/solutions. The security  IoT Security Foundation - Security Challenges on the Way Towards Smart Manufacturing subject matter expert shall participate during offers revision.  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

 Failures / management systems -- Requirements During the IIoT procurement Malfunctions ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Endpoints lifecycle  process prepare IIoT Technical information security controls  Outages Requirements Specification  Disaster  NIST - Best practices in cyber supply chain risk management. Smart Manufacturing The Future of document in which you will Manufacturing and Value Chain Competitiveness define preferred technologies  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations and minimum cybersecurity

requirements including product

support and security support

lifecycle aspects.

 IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework OP-04: Conduct cybersecurity  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security acceptance tests against management systems -- Requirements technical specification during  Failures /  NIST - Cybersecurity for Smart Manufacturing different validation activities or Malfunctions Endpoints lifecycle  NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security stages of the product lifecycle,  Outages (TLS) Implementations e.g. FAT, SAT and penetration  Disaster  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations testing before go-live.  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things OP-05: During the handover  Nefarious activity  Huawei - IoT Security White Paper 2017 phase of the project / Abuse Endpoints lifecycle  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program implementation process,  Eavesdropping /  IEC - IEC 62443-3-3:2013 System security requirements and security levels properly build and transfer all Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework cybersecurity documentation, Hijacking

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

processes and procedures.  Failures /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

Within the documentation, Malfunctions  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

include a list of system and  Legal  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

service accounts, security logs, information security controls

response plans, confirmation of  LNS - Putting Industrial Cyber Security at the top of the CEO agenda

all software and firmware  MIT - Security Analysis of Zigbee

versions, up-to-date network  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

diagrams, system architecture,  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security risk register and security  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile limitations. Processes should  Smart Factory Innovation Forum - Managing security, safety and privacy in Smart Factories comprise maintenance routines,  VDMA - Industrie 4.0 Security Guidelines Recommendations for actions anti-virus deployment and  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products assurance, patching processes and Services and accounts' management and

authentication processes.

Procedures should include

firewalls baseline configurations,

management and monitoring,

change control and fall-over

testing.

 GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview OP-06: To ensure security in a  Nefarious activity Document computerized ecosystem, adopt / Abuse  Homeland Security - Strategic Principles for Securing the Internet of Things a holistic architectural-based  Eavesdropping /  Huawei - IoT Security White Paper 2017 approach and develop a risk- Interception /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program aligned security architecture Hijacking  IEC - IEC 62443-3-3:2013 System security requirements and security levels based on business requirements.  Physical attack Security  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Architecture  Unintentional  ISA - ANSI/ISA-95 Part 1: Models and Terminology damages  LNS - Putting Industrial Cyber Security at the top of the CEO agenda (accidental)  VDC - Industry 4.0: Secure by design  Failures /

Malfunctions

 Outages

 Legal

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Disaster

 Homeland Security - Strategic Principles for Securing the Internet of Things OP-07: While defining security  Huawei - IoT Security White Paper 2017 architecture, ensure that it  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program comprises all relevant security  IEC - IEC 62443-3-3:2013 System security requirements and security levels aspects – from organizational to  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework physical implementation issues.  Nefarious activity  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use / Abuse The Security Architecture should  ISA - ANSI/ISA-95 Part 1: Models and Terminology  Eavesdropping / consist of (but not be limited to) Interception /  LNS - Putting Industrial Cyber Security at the top of the CEO agenda the following domains: Hijacking  VDC - Industry 4.0: Secure by design

- Security Policy & Design  Physical attack

Security Principles Unintentional  Architecture damages - Security Governance & (accidental) Operating Model (Organization)  Failures /

- Security Network Blueprint Malfunctions

(Zoning model)  Outages

 Legal - Security Technical  Disaster Requirements

- Security Services design

- Security Procedures

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program OP-08: Within the Security  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1: Architecture, allocate and  Nefarious activity Reference architecture distribute clear roles and / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework responsibilities for security Security  Unintentional  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use between IT, Architecture damages  ISA - ANSI/ISA-95 Part 1: Models and Terminology Engineering/Automation and (accidental)  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security Operations departments. Clearly  Failures / management systems -- Requirements define and communicate roles Malfunctions  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

information security controls

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

for both OT systems and security  SANS Institute - Building the New Network Security Architecture for the Future

processes.

Appoint a Governance Body with

a clear mandate and defined

decision-making process.

 Homeland Security - Strategic Principles for Securing the Internet of Things OP-09: Integrate compliance  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program enforcement controls to the  Failures /  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1: established Security Architecture Malfunctions Reference architecture and ensure that all products  Unintentional Security  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework meet the requirements defined damages Architecture  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use within it. (accidental)  ISA - ANSI/ISA-95 Part 1: Models and Terminology  Legal  LNS - Putting Industrial Cyber Security at the top of the CEO agenda  Disaster  SANS Institute - Building the New Network Security Architecture for the Future

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program OP-10: Define cyber incidents  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework relevant for your organization / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use based on the company's area  Eavesdropping /  LNS - Putting Industrial Cyber Security at the top of the CEO agenda and range of operation. Classify Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations these incidents according to Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security applicable standards, e.g. by  Physical attack grouping them based on  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for Incidents handling  Unintentional utilization of a common attack the Manufacturing of the Future damages vector (removable media, email, (accidental)

website, etc.) or according to  Failures /

their impact (on organization's Malfunctions

operation, on data, etc.).  Outages

 Legal

 Disaster

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary Incidents handling OP-11: Consider creation of OT  Nefarious activity  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Cybersecurity Operations Centre / Abuse  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things (SOC) consisting of specialists

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

with clear roles, responsibilities  Eavesdropping /  ENISA - Baseline Security Recommendations for IoT and IT, OT and cybersecurity Interception /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program competences to support Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework cybersecurity incidents. Divide  Physical attack  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for them into specific lines of  Unintentional information security controls support with appropriate roles damages  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations and responsibilities. (accidental)  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Failures /  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile Malfunctions  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for  Outages the Manufacturing of the Future  Legal  Disaster  Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary Incidents handling OP-12: Establish a process for  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance incidents handling that consists  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program of identification of affected / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use assets, identification and  Eavesdropping /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for classification of vulnerabilities, Interception / information security controls escalation and notification. Make Hijacking  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations a revision of the process at least annually and as soon as possible  Physical attack  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security in case of a major change, e.g.  Unintentional  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile change in organizational damages  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices hierarchy, contracts, etc. Update (accidental) the process with lessons learned  Failures / from analysing and resolving Malfunctions security incidents. Test the  Outages process at least annually and  Legal consider different possible  Disaster incidents.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary Incidents handling OP-13: Detect and investigate  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program promptly every unusual security  Nefarious activity / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework related event. Require  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

employees, contractors and  Eavesdropping /  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

external companies with access Interception / management systems -- Requirements

to the IT/OT environment to Hijacking  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

notify and report about any  Physical attack information security controls

observed or suspected security  Unintentional  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

weaknesses and anomalies. damages  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

(accidental)  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices

 Failures /

Malfunctions

 Outages

 Huawei - IoT Security White Paper 2017 OP-14: Define a comprehensive  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use vulnerability management  LNS - Putting Industrial Cyber Security at the top of the CEO agenda process within the organization  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations that covers utilization of  Nefarious activity  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security automatic and manual tools, e.g. / Abuse  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy passive vulnerability scanners,  Eavesdropping / Risks resulting from risk analysis. In Interception / case of active scanners  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns Vulnerabilities Hijacking implementation, precede it with  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for management  Physical attack a testing phase require the Manufacturing of the Future  Unintentional acceptance by the system damages owner. Have in mind that active (accidental) scanners in the OT environment  Failures / may cause adverse effects to the Malfunctions system and disrupt the

production process, especially if

legacy equipment is used.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things OP-15: While eliminating  Nefarious activity  Homeland Security - Strategic Principles for Securing the Internet of Things security gaps, begin from the Vulnerabilities / Abuse  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations most critical vulnerabilities management  Eavesdropping /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security taking into account the criticality Interception /  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile of assets and systems. This Hijacking  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

process may be supported by  Failures /  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices asset inventory, if the inventory Malfunctions

contains data related to assets  Outages and systems criticality.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things OP-16: Establish tight  ENISA - Baseline Security Recommendations for IoT collaboration between the OT  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview and IT department. Do not allow Document any individual responsible for IT  Homeland Security - Strategic Principles for Securing the Internet of Things security to implement any  IEEE - Internet of Things (IoT) Security Best Practices cybersecurity policies, including  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use Vulnerabilities vulnerability management, on  Failures / Management the OT side without the full  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 Malfunctions knowledge and cooperation of  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

the plant engineers. Ensure that  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

IT and OT departments share  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

their knowledge about systems  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

operations as well as about

threats.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things OP-17: Establish a  Huawei - IoT Security White Paper 2017 comprehensive and well-defined  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program process for disclosure of  IEEE - Internet of Things (IoT) Security Best Practices vulnerabilities.  Nefarious activity  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

If you are a manufacturer, in / Abuse  LNS - Putting Industrial Cyber Security at the top of the CEO agenda Vulnerabilities case of vulnerability  Eavesdropping /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

management identification, inform the users Interception /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security on how to patch the device via Hijacking  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile dedicated emails or portals.  Failures /  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation Malfunctions To promote vulnerability  SANS Institute - Vulnerability Management: Tools, Challenges and Best Practices

disclosure within a company,

launch a bug bounty program, i.e. reward people who identify

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

significant security vulnerabilities in the implemented

infrastructure or in the final product.

 ECSO (European Cyber Security Organisation) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for OP-18: Conduct penetration the industry 4.0 and ICS sector tests of new IIoT solutions in a  Cloud Security Alliance - Future Proofing the connected world controlled environment (e.g. in a  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program lab, testing environment) or  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use before / during commissioning  Unintentional  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Vulnerabilities phase (e.g. during FAT or SAT damages information security controls management phase). In addition, conduct (accidental)  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations penetration tests regularly, e.g. once every 2 or 3 years, and  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

after important update of the  Shaun Bligh-Wall - Industry 4.0: Security imperatives for IoT — converging networks, increasing risks.

system with acceptance of a  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

system owner.  VDMA - Industrie 4.0 Security Guidelines Recommendations for actions

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program OP-19: Adopt a holistic approach  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for to security training and information security controls awareness among employees –  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations ensure that it includes  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security employees on all levels of the  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile organization, covers new threats introduced to manufacturing  Nefarious activity  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products

/ Abuse and Services Training and environment by Industry 4.0 new Awareness capabilities and is tailored to  Unintentional

employees' roles and damages responsibilities as well as to (accidental)

different levels of knowledge of the participants. Moreover,

ensure that an additional training follows every change in

employee responsibilities.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Training and OP-20: Provide all newly hired  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Awareness employees with a cybersecurity  IoT Security Foundation - Security Challenges on the Way Towards Smart Manufacturing training starting the job. Provide  Nefarious activity  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for all users of IIoT solutions with / Abuse information security controls basic security awareness and  Unintentional  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations training materials before they damages  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security receive authorization to access (accidental)  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile the system.  World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products

and Services

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Training and OP-21: Ensure that security  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Awareness trainings are continuous and  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program regular. Update the training / Abuse  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for programme after new important  Unintentional information security controls threats disclosure and adjust damages  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security them according to the lessons learned from ongoing incident (accidental)  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

handling and recovery activities.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Training and OP-22: Train users of IIoT on the  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Awareness secure usage of their devices.  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program During training sessions, explain  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security to the IIoT users all the  Nefarious activity management systems -- Requirements technologies deployed to protect / Abuse  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for IIoT devices and the ecosystem  Unintentional information security controls where the solution is deployed. damages  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

(accidental)  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 World Economic Forum - Industrial Internet of Things: Unleashing the Potential of Connected Products

and Services

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary OP-23: To improve awareness,  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance consider communicating with  ECSO (European Cyber Security Organization) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for other companies on a sector the industry 4.0 and ICS sector level including the supply chain -  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use communication with  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for manufacturers, components information security controls providers, software providers, service providers and customers  NIST - NISTIR 8200: Interagency Report on Status of International Cybersecurity Standardization for the

Internet of Things (IoT) is recommended. Also, consider Training and OWASP (Open Web Application Security Project) - IoT Security Guidance participation in international  Failures / Awareness Malfunctions security infrastructures based on

trust formed to enable

discussion, cooperation and

intelligence sharing across

organizations. Examples of such

infrastructures already exist and

include Plattform Industrie 4.0,

Industrial Internet Consortium,

Cloud Security Alliance, etc.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary OP-24: Strictly control access by  Nefarious activity  ECSO (European Cyber Security Organization) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for Third Parties to a control or / Abuse the industry 4.0 and ICS sector production layer, e.g. by  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework physically plugging the RJ45 jack Interception /  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use when the vendor has access or Hijacking Third Party  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 through timer systems. In  Physical attack Management addition, utilize dedicated  NIST - Framework for Cyber-Physical Systems: Volume 1, Overview  Unintentional registry accounts, multifactor  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security damages authentication and encryption.  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy (accidental) Grant access to a control or Risks  Failures / production layer to Third Parties Malfunctions

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

only on-demand, in a specified

time window, for a specific

purpose, and in a least privileged

way. Record and supervise

sessions and do not allow for idle

sessions.

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary OP-25: Do not provide direct  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things connection for the vendor to a  ECSO (European Cyber Security Organization) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for system in a control or production  Nefarious activity the industry 4.0 and ICS sector layer. Support security of remote / Abuse  ENISA - Baseline Security Recommendations for IoT access with network Eavesdropping /   Homeland Security - Strategic Principles for Securing the Internet of Things segmentation, VLANS Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Third Party configuration, implemented Hijacking Management firewalls and network traffic  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines  Unintentional filtering. Allow only for access to  IoT Security Foundation - Security Challenges on the Way Towards Smart Manufacturing damages the selected necessary functions  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile (accidental) and parts of the network (the  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy  Failures / rule of least privilege should be Risks Malfunctions in place).  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

 SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns

 Auto ISAC - Automotive Cybersecurity Best Practices - Executive Summary OP-26: Prompt suppliers for  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things information on the security of  ECSO (European Cyber Security Organization) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for their processes and the industry 4.0 and ICS sector commitments to the product  Unintentional  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program they deliver, e.g. by preparing a damages  IEEE - IEEE Std 802.1X-2010 - Port-Based Network Access Control Third Party questionnaire for the suppliers (accidental)  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Management regarding their security contributions to the items they  Failures /  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use

deliver and select partners taking Malfunctions  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

into account its results. management systems -- Requirements

 ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Develop dedicated Security information security controls Requirements for Vendors and

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

service providers. Vendors and  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

service providers’ audits should  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

be performed before choosing  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

an IIoT solutions provider and Risks

periodically throughout a

system’s lifecycle.

 ENISA - Baseline Security Recommendations for IoT Third Party OP-27: Clearly define all relevant  Huawei - IoT Security White Paper 2017 Management aspects of the partnership with  IEC - IEC 62443-3-3:2013 System security requirements and security levels Third Parties, including security,  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1: within the appropriate Reference architecture agreements and contracts (e.g.  Unintentional  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices SLA - service level agreement, damages  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework NDA - Non-Disclosure (accidental) Agreements). Sign these  IoT Alliance Australia - Internet of Things Security Guidelines v1.2  Failures / agreements and contracts before  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines Malfunctions the start of cooperation.  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  Legal  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

 VDC - Industry 4.0: Secure by design

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service TM-01: Verify the integrity of the Ecosystems software before starting to run  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint it. Verify the root of trust and Ecosystems secure boot mechanisms. Ensure  Nefarious activity  Huawei - IoT Security White Paper 2017 that the software comes from a / Abuse  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Trust and Integrity reliable source (signed by the  Eavesdropping /  IEC - IEC 62443-3-3:2013 System security requirements and security levels Management vendor) and that it is obtained in Interception / a secure manner, e.g.  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1: Hijacking Reference architecture downloaded via an encrypted  Physical attack connection.  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices

 IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Software signing and/or  International Telecommunications Union - Security capabilities supporting safety of the Internet of things checksum control should be in

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

place to ensure that the  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 software is legitimate.  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

 NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 VDC - Industry 4.0: Secure by design

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service TM-02: Authorise all IIoT devices Ecosystems within the OT network utilising  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint the appropriate methods, e.g. Ecosystems digital certificates/PKI.  Nefarious activity  Huawei - IoT Security White Paper 2017

/ Abuse  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Trust and Integrity Management  Eavesdropping /  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1:

Interception / Reference architecture

Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

 NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service TM-03: Define data exchange Ecosystems channels between IIoT devices  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint and ensure that the system Ecosystems owner accepts them. Choose  Huawei - IoT Security White Paper 2017 only secure channels whenever Trust and Integrity  Eavesdropping /  IEC - IEC 62443-3-3:2013 System security requirements and security levels possible and implement Management Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations whitelists. Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security When sending sensitive data on  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile mobile devices, do not use OWASP (Open Web Application Security Project) - Mobile Top 10 2016  insecure channels such as SMS,  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for MMS or notifications. the Manufacturing of the Future

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance TM-04: Implement application  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program whitelists, i.e. lists of  IEC - IEC 62443-3-3:2013 System security requirements and security levels applications that are allowed to  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework run in the industrial control  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 environment and mechanisms  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations that prevent all other applications from running. Such  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

lists shall be provided by vendor  Unintentional  Symantec - An Internet of Things Reference Architecture

or defined in consultation with damages Trust and Integrity the vendor and reviewed at least (accidental) Management annually and in case of  Failures /

implementation of a change to Malfunctions

the system. On the whitelists, all  Outages

unnecessary applications and applications with known vulnerabilities shall be avoided,

as they contain backdoors to the system that can be used by

attackers.

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service TM-05: Ensure production data Ecosystems integrity through utilisation of  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint appropriate cryptographic  Nefarious activity Ecosystems mechanisms and key storage / Abuse  Huawei - IoT Security White Paper 2017 Trust and Integrity tailored to processing  Eavesdropping /  IEC - IEC 62443-3-3:2013 System security requirements and security levels Management capabilities of the implemented Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations solutions. Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

 Cloud Security Alliance - Future Proofing the connected world Trust and Integrity TM-06: Monitor the production  Nefarious activity  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Management data at rest and in transit to / Abuse

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

identify potential unauthorised  Eavesdropping /  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service

data modification. Interception / Ecosystems

Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

 SANS Institute - Building the New Network Security Architecture for the Future

 Cloud Security Alliance - Future Proofing the connected world TM-07: Base your decisions  Nefarious activity  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things regarding the choice of the type / Abuse  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service of cloud on a business and  Eavesdropping / Ecosystems privacy impact assessment, i.e. a Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework type of quantitative risk Hijacking  SANS Institute - Building the New Network Security Architecture for the Future assessments, taking also into Cloud security consideration laws and  Unintentional

regulations applicable to cloud damages

service provider’s country and (accidental)

points of presence. Risk based  Failures /

approach to assess the criticality Malfunctions

is of great importance.  Legal

 Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management TM-08: Include security and  Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management availability aspects in  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service agreements with cloud security  Eavesdropping / Ecosystems providers. Responsibilities for Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework cloud security aspects shall be Cloud security Hijacking  Online Trust Alliance - IoT trust framework 2.5 clearly defined and allocated to particular parties or persons.  Outages

Availability of service shall be  Legal

measurable and defined through

specified parameters.

 ECSO (European Cyber Security Organization) - INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber security for Cloud security TM-09: In cloud-based the industry 4.0 and ICS sector application and centralised  Failures /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework systems, avoid single points of Malfunctions  Outages  NIST - NIST SP 800-146 Cloud Computing Synopsis and Recommendations failure.  Online Trust Alliance - IoT trust framework 2.5

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

SANS Institute - Building the New Network Security Architecture for the Future

 Cloud Security Alliance - Future Proofing the connected world Cloud security TM-10: Locate critical systems  Nefarious activity  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance and applications within the / Abuse  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things private or at least hybrid  Eavesdropping /  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service deployment models. If you Interception / Ecosystems consider utilisation of a public Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework cloud, precede this decision with  Failures /  Online Trust Alliance - IoT trust framework 2.5 risk analysis. Malfunctions

 Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management Cloud Security TM-11: To mitigate the risk  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program related to cloud attacks, adopt a  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework zero-knowledge security  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 approach. It means that  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security providers of services should  Nefarious activity management systems -- Requirements store and manage data without / Abuse  NIST - NIST Advanced Manufacturing Series 300-1 Reference Architecture for Smart Manufacturing Part access to encryption keys.  Eavesdropping / 1: Functional Models

Protect all the data within the  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Interception / cloud and data in transfer. Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security Ideally, all data should be  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile encrypted.

Application and interfaces

should be secured as well.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Business continuity TM-12: Focus on ensuring the  Nefarious activity  Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management and recovery resilience of Industry 4.0 systems / Abuse  Homeland Security - Recommended Practice: Improving Industrial Control System Cybersecurity with by creating a business continuity  Eavesdropping / Defense-in-Depth Strategies plan (BCP) and disaster recovery Interception /  IEC - IEC 62443-3-3:2013 System security requirements and security levels plan (DRP). Ensure continuity of Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework the systems operation even in  Physical attack the event of security incidents.  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use  Unintentional Perform periodic testing of the  NIST - NIST Advanced Manufacturing Series 300-1 Reference Architecture for Smart Manufacturing Part damages plans and adapt them according 1: Functional Models (accidental)

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

to lessons learnt from tests and  Failures /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations actual security incidents. Malfunctions  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 Outages  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 Legal  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for

 Disaster the Manufacturing of the Future

 ETSI (European Telecommunications Standards Institute) - ETSI GR QSC 004 V1.1.1 (2017-03) Quantum Business continuity TM-13: Define critical business  Nefarious activity Safe Cryptography; Quantum-Safe threat assessment and recovery and technological processes and / Abuse  Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management determine to what extent they  Eavesdropping /  Huawei - IoT Security White Paper 2017 influence business continuity. Interception /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program

Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

 Physical attack  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

 Unintentional management systems -- Requirements

damages  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

(accidental) information security controls  Failures /  NIST - NIST Advanced Manufacturing Series 300-1 Reference Architecture for Smart Manufacturing Part

Malfunctions 1: Functional Models

 Outages  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 Legal  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 Disaster  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Business continuity TM-14: Develop written  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program and recovery procedures on how to return to / Abuse  IEC - IEC 62443-3-3:2013 System security requirements and security levels the normal – well-defined – state  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework of operation. Before establishing Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations these procedures, perform Hijacking  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile threat and risk assessment and  Physical attack tailor the procedures to the  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for  Unintentional assessment's results. Within the the Manufacturing of the Future damages procedures, define roles and (accidental) responsibilities for particular  Failures /

required actions. Distribute Malfunctions copies of the incident response  Outages

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

plan to active incident response  Legal personnel.  Disaster

 Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management Business continuity TM-15: Consider contingency  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for and recovery planning preceded by a risk information security controls analysis. Define contingency  NIST - NIST Advanced Manufacturing Series 300-1 Reference Architecture for Smart Manufacturing Part plans and test them executing  Nefarious activity 1: Functional Models controlled exercises. Regularly / Abuse  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations review the plan (at least annually  Eavesdropping /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security and in case of a major change) Interception /  The Cavalry - Hippocratic Oath for Connected Medical Devices and adjust it appropriately. Hijacking While preparing a contingency  Physical attack plan, consider both major disasters and smaller scale  Unintentional

events caused by cyber damages incidents, which may disrupt (accidental)

normal operation of the  Failures /

company. Define responsible Malfunctions

persons for every stage of the  Outages

plan and establish a reporting  Legal

process. Keep in mind that the  Disaster

plan needs to be simple and ensure employees' awareness

through adequate training.

 Center for Internet Security (CIS) - Critical Security Controls Business continuity TM-16: In business continuity  Federal Office for Information Security (BSI) - BSI-Standards 100-4 - Business Continuity Management and recovery and recovery plans, include Third  Unintentional  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Parties aspects. Appropriate damages  NIST - NIST Advanced Manufacturing Series 300-1 Reference Architecture for Smart Manufacturing Part Third Party management and (accidental) 1: Functional Models control over its involvement is  Failures /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations essential for ensuring company's Malfunctions  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security continuity of operations.  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IEC - IEC 62443-3-3:2013 System security requirements and security levels Business continuity TM-17: Define important  Nefarious activity  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices and recovery parameters for business / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework continuity of your company, such  Eavesdropping /  Infineon - Hardware-based solutions secure machine identities in smart factories as the recovery time objective Interception /  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines (RTO), recovery point objective Hijacking  oneM2M - Standards for M2M and the Internet of Things - TR 0008 Security V2.0.0 - Security. Technical (RPO), maximum tolerable  Physical attack outage (MTO) and minimum Report  Unintentional business continuity objective damages

(MBCO). (accidental)

 Failures /

Malfunctions

 Outages

 Legal

 Disaster

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Machine-to- TM-18: Store long-term service-  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service Machine security layer keys (other than public Ecosystems keys) in a server-HSM residing in  Huawei - IoT Security White Paper 2017 infrastructure equipment. The  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework HSM containing the M2M long-  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 term service keys should be  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines bound to the M2M Device or M2M Gateway, using physical  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  Eavesdropping /  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security and/or logical means. Interception /  NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security HSM/server-HSM should not Hijacking (TLS) Implementations

reveal the value of the stored  oneM2M - Standards for M2M and the Internet of Things - TR 0008 Security V2.0.0 - Security. Technical secret keys (other than public Report keys), even to a management  Symantec - An Internet of Things Reference Architecture system or to an authorised

representative of the M2M

System Operator, such as a

System Administrator.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Machine-to- TM-19: Establish a security  IEC - IEC 62443-3-3:2013 System security requirements and security levels Machine security association with proven and  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework secure cryptographic algorithms  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use between the communicating  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 entities to provide mutual  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for authentication, integrity and  Eavesdropping / information security controls confidentiality. Interception /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security

(TLS) Implementations

 oneM2M - Standards for M2M and the Internet of Things - TR 0008 Security V2.0.0 - Security. Technical

Report

 ENISA - Baseline Security Recommendations for IoT Machine-to- TM-20: Use communication  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service Machine security protocols that include the Ecosystems functionality to detect if all or  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint part of a message is an  Nefarious activity Ecosystems unauthorised repeat of an earlier / Abuse  Huawei - IoT Security White Paper 2017 message.  Eavesdropping /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Interception /  IEC - IEC 62443-3-3:2013 System security requirements and security levels Hijacking  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

 NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Machine-to- TM-21: Use positive/whitelist  Nefarious activity  ENISA - Baseline Security Recommendations for IoT Machine security input validation to protect / Abuse  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service against cross site scripting and  Eavesdropping / Ecosystems command injection, i.e. decode Interception /  Huawei - IoT Security White Paper 2017 any encoded input and then Hijacking IEC - IEC 62443-3-3:2013 System security requirements and security levels  validate the length, characters,  Failures /  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices Malfunctions  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

and format on that data before  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 accepting the input.  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile  OWASP (Open Web Application Security Project) - IoT Security Guidance

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Data protection TM-22: Protect data at rest (both  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things in volatile and non-volatile  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service memory), in transit and in use. Ecosystems For data at rest, it can be  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint achieved through role-based Ecosystems access control and requirement  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program of authentication. For critical  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use data, implementation of  IOActive, Embedi - SCADA And Mobile Security In The Internet Of Things Era encryption algorithms is IoT Alliance Australia - Internet of Things Security Guidelines v1.2  advisable. Take special care not  Nefarious activity  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines to store any sensitive data on SD / Abuse  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security cards without proper security  Eavesdropping / management systems -- Requirements measures such as access control Interception /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for lists. Hijacking information security controls In terms of data in transit, it is  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security advisable to ensure that traffic  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy between system components is Risks encrypted, e.g. utilising an SSL/VPN Tunnel or TSL.

To protect data in use, implement access control and authentication mechanisms.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Data protection TM-23: Categorise data related  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things to the OT system based on risk  Nefarious activity  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework analysis. Take into account / Abuse  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

production, device and user  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 information. Defined categories  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

may include for example information security controls production schedule data, NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

customer data, R&D data, asset management data, defect and

quality data, production line data, etc. For each category,

assess the criticality of data and define required security

measures that will ensure proper level of security. Recipes for

instance are considered critical for manufacturing companies and shall be therefore protected

with the most advanced

measures, e.g. encryption.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Data protection TM-24: Grant access to certain  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service categories of data to Third Ecosystems Parties with least privilege and  Huawei - IoT Security White Paper 2017 need-to-know principles in mind  Nefarious activity  IEC - IEC 62443-3-3:2013 System security requirements and security levels and document this access, i.e. / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework ensure that Third Parties have  Eavesdropping /  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use access only to the necessary data Interception /  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 and have minimal privileges, e.g. Hijacking read only access to data that  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines  Unintentional  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for they should not be alter. damages information security controls (accidental)  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for

the Manufacturing of the Future

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Data protection TM-25: For data of high  Nefarious activity  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things confidentiality, implement / Abuse  Huawei - IoT Security White Paper 2017 encryption and key management  Eavesdropping /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program so that the information can be Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework read only by authorised users. In Hijacking addition, use data loss  IoT Alliance Australia - Internet of Things Security Guidelines v1.2  Unintentional prevention solutions.  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines damages  OWASP (Open Web Application Security Project) - IoT Security Guidance (accidental)

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Data protection TM-26: Anonymise any direct or  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview indirect personal data processed Document within the company system (e.g.  Homeland Security - Strategic Principles for Securing the Internet of Things names of system operators and  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices information on their  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use performance), having considered  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 all relevant legal requirements,  Nefarious activity or properly secure it, e.g. / Abuse  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

through role-based access  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for  Eavesdropping / control and encryption. information security controls Interception / Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

 The Cavalry - Hippocratic Oath for Connected Medical Devices

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Software/Firmware TM-27: Verify endpoints'  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint updates software/firmware authenticity  Nefarious activity Ecosystems and integrity and ensure tight / Abuse  Homeland Security - Strategic Principles for Securing the Internet of Things control over the update. Signing  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices code updates (to be able to

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

authenticate the code before it is  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

loaded) and maintaining the Interception /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

authenticity is advisable. Hijacking information security controls

 Physical attack  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 Failures /  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

Malfunctions The Cavalry - Hippocratic Oath for Connected Medical Devices

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Software/Firmware TM-28: Execute automatic  Homeland Security - Strategic Principles for Securing the Internet of Things updates update procedures only if they  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework are based on the risk analysis  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines and if the devices for which the  Nefarious activity  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for automatic update can be / Abuse information security controls allowed are identified. Verify the  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations source of the update.  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

The Cavalry - Hippocratic Oath for Connected Medical Devices

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Software/Firmware TM-29: Perform deployment of  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use updates patches for the IIoT devices only  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines after proving that no negative  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for consequences exist. Test the information security controls patches in a test environment  NIST - Framework for Improving Critical Infrastructure Cybersecurity V1.1 before implementing them in  Failures / NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security production. If this is not possible, Malfunctions (TLS) Implementations begin with deploying patches

only on a segment of a system,

ensuring that other zones will

continue to operate normally in

case a patch exerts any negative

impact on a chosen segment.

 IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines Software/Firmware TM-30: Allow Third Parties to  Unintentional  IoT Security Foundation - Establishing Principles for IoT Security updates perform patching only if they damages  NIST - Framework for Improving Critical Infrastructure Cybersecurity V1.1 guarantee and are able to prove (accidental)

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

that the patch has been tested  Failures /  The Cavalry - Hippocratic Oath for Connected Medical Devices and will not have any negative Malfunctions

consequences on the device or if the Third Party assumes the

liability for the update according to an applicable agreement.

In addition, require Third Parties to report any executed actions

related to the patching process and inform about them in

advance. Update procedures shall be documented, known and

controlled by the organisation.

 GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint Software/Firmware TM-31: For control systems  Nefarious activity Ecosystems updates which cannot be updated (e.g. / Abuse  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices legacy systems), apply  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework compensating measures, such as Interception /  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines network segmentation, micro Hijacking  NIST - Framework for Improving Critical Infrastructure Cybersecurity V1.1 segmentation, system relocation  Physical attack  NIST - NIST SP 800-52 r1: Guidelines for the Selection, Configuration, and Use of Transport Layer Security or additional real-time  Unintentional (TLS) Implementations monitoring tools. damages Perform risk analysis to (accidental)

determine if it is possible and  Failures / sufficient to improve security of Malfunctions

existing system or if the  Outages replacement of the system is  Legal

necessary.  Disaster

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service Access Control TM-32: Segregate remote access, Ecosystems i.e. develop a set of rules for  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint control of the remote / Abuse Ecosystems communication. Limit remote

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

access only to the required  Eavesdropping /  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program systems and monitor it. Ensure Interception /  IEC - IEC 62443-3-3:2013 System security requirements and security levels full traceability and Hijacking  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices accountability of the users.  Unintentional  International Telecommunications Union - Security capabilities supporting safety of the Internet of things damages  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 (accidental)  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security  Failures / management systems -- Requirements Malfunctions  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for information security controls  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks  OWASP (Open Web Application Security Project) - IoT Security Guidance  VDMA - Smart Manufacturing General security and privacy principles to ensure a Trusted IoT environment

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Access Control TM-33: Ensure minimal level of  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things authentication security for the  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service IIoT devices and systems. In a Ecosystems segmented network/system,  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint ensure that authorisation only / Abuse Ecosystems allows for access to a certain  Eavesdropping /  Huawei - IoT Security White Paper 2017 segment and no other parts of Interception /  IEC - IEC 62443-3-3:2013 System security requirements and security levels the system. Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework  Unintentional  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use damages  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 (accidental)  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for information security controls  OWASP (Open Web Application Security Project) - IoT Security Guidance

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 VDC - Industry 4.0: Secure by design

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Access Control TM-34: As an IIoT solutions  ENISA - Baseline Security Recommendations for IoT vendor, implement multi-factor  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service authentication capability (e.g. Ecosystems Apple Touch ID, security tokens).  Nefarious activity  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint / Abuse As a user of such solutions, Ecosystems  Eavesdropping / utilise multi-factor system  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Interception / authentication.  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Hijacking  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Access Control TM-35: Change default  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things passwords and usernames  ENISA - Baseline Security Recommendations for IoT during commissioning/first use.  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service Use strong passwords aligned to Ecosystems internal password complexity  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint policy and require setting of a Ecosystems new password after a defined period. Device manufacturers  Nefarious activity  IEC - IEC 62443-3-3:2013 System security requirements and security levels

and cloud services providers / Abuse  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

should give these options to  Eavesdropping /  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

users. Interception /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

Hijacking information security controls Have in mind that passwords for  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations industrial control systems should  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security not be too complex to ensure  OWASP (Open Web Application Security Project) - IoT Security Guidance immediate access when needed.  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns When complex passwords are

used, organisations should

ensure that the frequency of

password change is not too high.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

Ensure that secure passwords

recovery mechanisms are in

place.

 ENISA - Baseline Security Recommendations for IoT Access Control TM-36: Apply the least privilege  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service principle when setting user Ecosystems privileges. Ensure that in an  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint environment with multiple users, Ecosystems roles are properly segregated  Nefarious activity  Huawei - IoT Security White Paper 2017 and approved by the right / Abuse  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program person. Eavesdropping /   IEC - IEC 62443-3-3:2013 System security requirements and security levels Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Hijacking  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for  Physical attack information security controls  Unintentional  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations damages  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security (accidental)  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

 GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service Access Control TM-37: Avoid using shared Ecosystems accounts for access to IIoT  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint devices and systems. Create Ecosystems individual accounts for every  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program user whenever possible, as this  Physical attack  IEC - IEC 62443-3-3:2013 System security requirements and security levels will enable tracking of the  Unintentional  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security performed actions to a specific damages management systems -- Requirements person. If shared accounts are (accidental)  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for used, change passwords information security controls periodically (e.g. every 90 days) and in case of personnel changes  VDMA - Industrie 4.0 Security Guidelines Recommendations for actions

within a shared account group

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

(e.g. when an employee leaves).

Also, consider deployment of

additional compensating

controls (e.g. segregation of

duties, real-time monitoring

tools such as industrial IDS).

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Access Control TM-38: Implement in the device  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service and/or use an account lockout Ecosystems functionality that activates after  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint the number of failed login Ecosystems attempts exceeds the value of a  IEC - IEC 62443-3-3:2013 System security requirements and security levels set parameter. This also applies  Nefarious activity  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 to cloud and mobile interfaces. / Abuse  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations Develop a policy to specify  OWASP (Open Web Application Security Project) - IoT Security Guidance

details such as the number of

allowed attempts and time of

the lockout.

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Access Control TM-39: In case of extensive and  Nefarious activity  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things diversified networks with a large / Abuse  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program number of devices, adopt the  Eavesdropping /  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for Privilege Access Management Interception / information security controls (PAM) solution to manage Hijacking  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations elevated privileges (i.e.  Physical attack

administrator privileges) in an  Unintentional

orderly manner. damages

(accidental)

 Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance Access Control TM-40: Within access control,  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things include physical access to  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program buildings, areas, rooms and  Physical attack  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework cabinets locations (e.g. by means  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use of walls, fences,

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

electronic/mechanical locks and  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines casings). Periodically revise  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

access rights (especially to management systems -- Requirements critical areas), limit physical  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for

access only to the required information security controls minimum and segregate it based  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

on roles in the company. Ensure  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security that the departure of an NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile  employee or change of a role  NIST - NISTIR 8200: Interagency Report on Status of International Cybersecurity Standardization for the within the company is followed Internet of Things (IoT) by a prompt change/termination  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy of physical access (e.g. physical Risks access system can be connected to the HR system).

Consider implementing tracking

and alarm systems for

supporting physical security.

 BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy Networks, TM-41: Ensure security of Recommendations protocols and communications channels  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things encryption related to IIoT solutions. Encrypt  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service communications in case of Ecosystems important data (e.g.  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint configuration, personal data, Ecosystems data for control purposes),  Eavesdropping /  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network where it is possible to do so Interception / Operators without affecting safety, Hijacking  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework availability and performance.  International Telecommunications Union - Security capabilities supporting safety of the Internet of things

 IoT Alliance Australia - Internet of Things Security Guidelines v1.2

 IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

 NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 ENISA - Baseline Security Recommendations for IoT Networks, TM-42: Segment industrial plants  Huawei - IoT Security White Paper 2017 protocols and networks based on a pre-defined  IEC - IEC 62443-1-1:2009 Terminology, concepts and models encryption zoning model (e.g. into Office  IEC - IEC 62443-3-3:2013 System security requirements and security levels Layer, Manufacturing Layer and  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Control Layer according to the  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 Purdue Model).  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security Ensure that direct traffic management systems -- Requirements between Office and Control LNS - Putting Industrial Cyber Security at the top of the CEO agenda  layers is prohibited - these  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security networks should always  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy communicate with each other Risks through a De-Militarised Zone  SANS Institute - Building the New Network Security Architecture for the Future (DMZ) with a 0-Trust rule. Traffic  Nefarious activity  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns between each of the zones / Abuse  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor should always be controlled by a  Eavesdropping /

firewall. Interception /

Hijacking Locate shared infrastructure

services which serve Manufacturing and Control

networks (e.g. DC, DNS, NTP, Backup server, AV server, Jump

Server) obtaining or providing data to the Office in a De-

Militarised Zone (DMZ).

Ensure dedicated network

infrastructure (physical separation) for critical systems in

the Control Layer.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 IEC - IEC 62443-1-1:2009 Terminology, concepts and models Networks, TM-43: Follow micro  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program protocols and segmentation approach that is  IEC - IEC 62443-3-3:2013 System security requirements and security levels encryption based on building within the  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework same network (e.g. IT or OT)  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 small islands of components that  LNS - Putting Industrial Cyber Security at the top of the CEO agenda communicate only inside these islands. Control traffic between  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

different segments using a  SANS Institute - Building the New Network Security Architecture for the Future

firewall. While segmenting the

network, use the principles of least privilege and need-to-

know. This means that only the necessary system-to-system

communication using necessary  Nefarious activity protocols on necessary ports / Abuse should be allowed and the rest  Eavesdropping / should be disabled. In case of an Interception / infection, isolated micro- Hijacking segments prevent it from

spreading further onto the network.

Micro segmentation within

networks can be achieved through:

- using VLANs for each micro segment,

- physical network separation or

- network traffic filtering at

various layers, such as network layer filtering, state-based

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

filtering, port and protocol level filtering, application filtering.

 Homeland Security - Recommended Practice: Improving Industrial Control System Cybersecurity with Networks, TM-44: Isolate safety networks Defense-in-Depth Strategies protocols and from business and control  IEC - IEC 62443-1-1:2009 Terminology, concepts and models encryption networks. If this is not possible  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program due to business requirements, / Abuse  IEC - IEC 62443-3-3:2013 System security requirements and security levels ensure that solutions for  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework network traffic filtering are in Interception /  International Telecommunications Union - Security capabilities supporting safety of the Internet of things place. Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

TM-45: For IIoT solutions

implement proven-in-use protocols (rather than recently

introduced ones) with known security capabilities, based on

standards and technical recommendations.

Choose solutions that use protocols that have been proved

secure or tackle previous security issues (e.g. TLS 1.3) and

avoid protocols with known vulnerabilities (e.g. Telnet, SNMP

v1 or v2).

 BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy Networks, TM-46: Ensure security  Nefarious activity Recommendations protocols and capabilities and interoperability / Abuse  Cloud Security Alliance - Identity and Access Management for the Internet of Things - Summary Guidance encryption between protocols when  Eavesdropping /  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things implementing different protocols Interception /  ENISA - Baseline Security Recommendations for IoT for various devices within the Hijacking

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

same system. One of the  Failures /  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network

example methods to achieve this Malfunctions Operators

is by using dedicated gateways  Outages  Huawei - IoT Security White Paper 2017

that provide translation of  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program

protocols. A gateway can  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework

translate an insecure protocol  IoT Alliance Australia - Internet of Things Security Guidelines v1.2

into a modern, secure protocol  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines

before sending it further, thus  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations reducing the attack surface.  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Networks, TM-47: If possible, limit the  ENISA - Baseline Security Recommendations for IoT protocols and number of protocols  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network encryption implemented within a given  Failures / Operators environment to ensure Malfunctions  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program manageability of the system.  Outages  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Also, disable all unused default  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns network services.

 BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy Networks, TM-48: Ensure a secure Recommendations protocols and environment for key exchange  Eavesdropping /  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things encryption and key management while Interception /  IEC - IEC 62443-3-3:2013 System security requirements and security levels avoiding sharing cryptographic Hijacking  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations keys across multiple devices.  Physical attack  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns  Outages  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

 BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy Networks, TM-49: Ensure the proper and Recommendations protocols and effective use of cryptography to  Eavesdropping /  Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things encryption protect the confidentiality, Interception /  GSMA (Global System for Mobile Communications) - GSMA CLP.12 IoT Security Guidelines for IoT Service authenticity and/or integrity of Hijacking Ecosystems data and information (including

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

control messages), in transit and  GSMA (Global System for Mobile Communications) - GSMA CLP.13 IoT Security Guidelines for Endpoint in rest. Ensure the proper Ecosystems selection of standard and strong  GSMA (Global System for Mobile Communications) - GSMA CLP.14 IoT Security Guidelines for Network encryption algorithms and strong Operators keys and disable insecure  Huawei - IoT Security White Paper 2017 protocols. Verify the robustness  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines of the implementation.  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for information security controls  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  OWASP (Open Web Application Security Project) - IoT Security Guidance

 AT&T Cybersecurity Insights - Exploring IoT Security Volume 2 Networks, TM-50: Implement passive  BITAG (Broadband Internet Technical Advisory Group) - Internet of Things (IoT) Security and Privacy protocols and monitoring solution in the IT and Recommendations encryption OT environments to create  Cloud Security Alliance - Future Proofing the connected world industrial network traffic  EC Alliance for Internet of Things Innovation (AIOTI) - AIOTI Digitisation of Industry Policy baseline and monitor anomalies Recommendations and adherence to the baseline.  EuroSMART (the voice of the Smart Security Industry) - Internet Of Trust Security And Privacy In The Deploy the monitoring solution Connected World on the Access Layer to capture  Federal Office for Information Security (BSI) - Protection Profile for the Gateway of a Smart Metering relevant internal traffic.  Nefarious activity System (Smart Meter Gateway PP), Certification-ID: BSI-CC-PP-0073 / Abuse  GSMA (Global System for Mobile Communications) - GSMA CLP.11 IoT Security Guidelines Overview  Eavesdropping / Document Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Hijacking  Infineon - Hardware Security for Smart Grid End Point Devices  International Telecommunications Union - Unleashing the potential of the Internet of Things  Internet Engineering Task Force (IETF) - Best Current Practices for Securing Internet of Things (IoT) Devices  Internet Engineering Task Force (IETF) - IETF RFC 7452 Architectural Considerations in Smart Object Networking  Internet Research Task force (IRTF) - State-of-the-Art and Challenges for the Internet of Things Security  IOT-A (Internet of Things Architecture)  ISACA - Performing a Security Risk Assessment

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security

management systems -- Requirements #A10. Cryptography

 ISO - ISO/IEC 27031:2011 Information technology -- Security techniques -- Guidelines for information and

communication technology readiness for business continuity 7.4.3  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

 NIST - Framework for Improving Critical Infrastructure Cybersecurity V1.1

 NIST - NIST SP 800 30r1 - Guide for Conducting Risk Assessments

 NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

- SC-13 Cryptographic Protection  oneM2M - Standards for M2M and the Internet of Things

 OWASP (Open Web Application Security Project) - Guide to Cryptography

 Software Assurance Forum for Excellence in Code (SAFECode) - NPO - Call it the Internet of Connected

Things: The IoT Security Conundrum  Symantec - Internet Security Threat Report (ISTR) Volume 22

 Trusted Computing Group (TCG) - Guidance for Securing IoT Using TCG Technology Reference Document

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Monitoring and TM-51: Collect security logs (i.e.  Federal Office for Information Security (BSI) - BSI-Standards 100-1 - Information Security Management auditing change logs, fault logs, Systems (ISMS) performance logs) to enable  Nefarious activity  Huawei - IoT Security White Paper 2017 analysis of events. To the extent / Abuse  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program possible, event logs should  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework include user IDs, system Interception /  LNS - Putting Industrial Cyber Security at the top of the CEO agenda activities, dates, times and details of key events (e.g. log-on Hijacking  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

and log-off times), use of  Physical attack  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

privileges, etc.  Unintentional  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

damages Risks Ensure that the logs are filtered, (accidental)  SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns correlated and analysed in real-  Failures /  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor time using a dedicated tool, e.g. Malfunctions  Symantec - An Internet of Things Reference Architecture a SIEM class solutions, for  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for example within a Security the Manufacturing of the Future Operation Centre (SOC). If it is

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

not technically feasible, review logs manually on a regular basis. Take further actions based on risk analysis.

Also, ensure that logs are accessible through a commonly accepted interface and stored for a defined period.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Monitoring and TM-52: Perform periodic reviews  ENISA - Baseline Security Recommendations for IoT auditing of access control privileges and  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program asset configurations at least / Abuse  IEC - IEC 62443-3-3:2013 System security requirements and security levels annually and in case of a major  Eavesdropping /  IIC (Industrial Internet Consortium) - IIC Endpoint Security Best Practices change in the system. Interception /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Hijacking  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines  Physical attack  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Unintentional  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy damages Risks (accidental)  OWASP (Open Web Application Security Project) - IoT Security Guidance  Failures /  SANS Institute - An Abbreviated History of Automation & Industrial Controls Systems and Cybersecurity Malfunctions  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor  VDC - Industry 4.0: Secure by design

 ENISA - Baseline Security Recommendations for IoT Monitoring and TM-53: Monitor the availability  Nefarious activity  Huawei - IoT Security White Paper 2017 auditing of the IIoT devices in real time, / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework where technically feasible.  Eavesdropping /  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security Interception / management systems -- Requirements Hijacking  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for  Physical attack information security controls  Unintentional  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations damages  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security (accidental)  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 Failures /  NIST - NISTIR 8200: Interagency Report on Status of International Cybersecurity Standardization for the

Malfunctions Internet of Things (IoT)

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

 OWASP (Open Web Application Security Project) - IoT Security Guidance

 ETSI (European Telecommunications Standards Institute) - ETSI GR QSC 004 V1.1.1 (2017-03) Quantum Monitoring and TM-54: Establish baseline Safe Cryptography; Quantum-Safe threat assessment auditing security configurations tailored  IEC - IEC 62443-3-3:2013 System security requirements and security levels to different types of assets.  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Within these baselines include,  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 among others, information  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security about system components (e.g.  Nefarious activity  NIST - NISTIR 8200: Interagency Report on Status of International Cybersecurity Standardization for the required software that is / Abuse installed with version numbers Internet of Things (IoT)  Physical attack  Smart Card Alliance - Embedded HW Security for IoT Applications and patch information on  Unintentional operating systems, whitelists of damages applications, required ports, (accidental) protocols, functions and set  Failures / parameters), network topology, Malfunctions logical placement within the  Outages system architecture, etc.  Disaster

In addition, establish procedures

for reviewing and creating new

baselines, as organisational

information systems change over

time.

 Huawei - IoT Security White Paper 2017 Configuration TM-55: Implement a mechanism  Nefarious activity  IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Management and supporting tools that allow / Abuse  IEC - IEC 62443-3-3:2013 System security requirements and security levels for configuration management.  Eavesdropping /  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework This mechanism should enable Interception / NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations  tracking of changes and Hijacking  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security  Physical attack  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

recreation of the state of the  Unintentional  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

system from before the change. damages Risks

(accidental)

 Failures /

Malfunctions

 Outages

 Legal

 Disaster

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Configuration TM-56: Implement and  Nefarious activity  IEC - IEC 62443-3-3:2013 System security requirements and security levels Management document changes in / Abuse  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework configuration according to a  Eavesdropping /  ISA - ANSI/ISA-95 Part 1: Models and Terminology change management policy Interception /  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security developed by the organisation Hijacking management systems -- Requirements based on risk analysis. This policy  Physical attack  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations should include responsibility (i.e.  Unintentional system owner, approvers, etc.)  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security damages and security aspects. The  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile (accidental) business owners of assets should  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor  Failures / accept it. Malfunctions

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Configuration TM-57: Develop a dedicated  IEC - IEC 62443-3-3:2013 System security requirements and security levels Management procedure for impact analysis.  IIC (Industrial Internet Consortium) - Accompanying the Industrial Internet of Things Volume G1: Before implementation of Reference architecture change in the system, perform  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework an analysis to determine the  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security criticality of the considered  Unintentional management systems -- Requirements change. Test changes to the damages ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for configuration that may exert an  (accidental) information security controls impact on operations and precede them with risk analysis.  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations

 NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

 NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile

 NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy

Risks

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

 SANS Institute - The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Configuration TM-58: Harden IIoT solutions  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework Management and include this in the change  ISA - ANSI/ISA-95 Part 1: Models and Terminology management policy. Ensure that  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security all unused network ports, management systems -- Requirements protocols and unnecessary  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations functionalities of the devices are disabled and that test/debug  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security

features are locked. Hardening  Unintentional

should include, where damages

applicable, operation system, (accidental)

software, firmware and

application. In addition, perform

periodic checks of critical

samples at least annually and in

case of a major change to the

system.

 Cloud Security Alliance - Security Guidance for Early Adopters of the Internet of Things Configuration TM-59: Create and apply a  ENISA - Baseline Security Recommendations for IoT Management comprehensive backup plan,  IIC (Industrial Internet Consortium) - Industrial Internet of Things Volume G4: Security Framework including provisions for periodic  IIC (Industrial Internet Consortium) - IoT Security Maturity Model: Description and Intended Use testing, tailored to different  IoT Alliance Australia - Internet of Things Security Guidelines v1.2 types of assets. Perform backups  Eavesdropping /  IoT Security Foundation - Connected Consumer Products. Best Practice Guidelines before updates and other Interception / important changes to the  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security Hijacking system. For some assets,  NIST - Draft NISTIR 8228: Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy  Physical attack backups should be made Risks  Failures / regularly with the frequency  OpenAI and others - The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation Malfunctions depending on the asset type.  OWASP (Open Web Application Security Project) - IoT Security Guidance

When making a backup, verify  Siemens - Industrial Security: Applying IoT Security Controls on the Industrial Plant Floor

whether it will work properly  Symantec - Smarter Security for Manufacturing in The Industry 4.0 Era: Industry 4.0 Cyber Resilience for

(perform a test of the backup). the Manufacturing of the Future

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

SECURITY THREAT DOMAIN MEASURE/GOOD REFERENCE GROUPS PRACTICE

To do so, you may check hash or

use a dedicated application.

 IEC - IEC 62443-2-1:2010 Establishing an industrial automation and control system security program Configuration TM-01: Verify the integrity of the  IEC - IEC 62443-3-3:2013 System security requirements and security levels Management software before starting to run  ISO - ISO/IEC 27001:2013 Information technology -- Security techniques -- Information security it. Verify the root of trust and management systems -- Requirements secure boot mechanisms. Ensure  ISO - ISO/IEC 27002:2013 Information technology -- Security techniques -- Code of practice for that the software comes from a information security controls reliable source (signed by the  Failures /  NIST - NIST SP 800 53r4: Security and Privacy Controls for Federal Information Systems and Organizations vendor) and that it is obtained in Malfunctions  NIST - NIST SP 800 82r2: Guide to Industrial Control Systems (ICS) Security a secure manner, e.g.  Outages  NIST - NISTIR 8183: Cybersecurity Framework Manufacturing Profile downloaded via an encrypted  Disaster connection.

Software signing and/or

checksum control should be in

place to ensure that the

software is legitimate.

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

Annex C: Security standards and references reviewed

AUTHOR TITLE REFERENCE

1. EU Initiatives EC Alliance for Internet of Things AIOTI Digitisation of Industry Policy https://aioti-space.org/wp-content/uploads/2017/03/AIOTI-Digitisation-of-Ind-policy- Innovation (AIOTI) Recommendations doc-Nov-2016.pdf ECSO (European Cyber Security INDUSTRY 4.0 AND ICS SECTOR REPORT Cyber http://www.ecs-org.eu/documents/uploads/industry-40-and-ics-sector-report- Organization) security for the industry 4.0 and ICS sector 032018.pdf ENISA Baseline Security Recommendations for IoT https://www.enisa.europa.eu/publications/baseline-security-recommendations-for-iot European Parliament and Council of The General Data Protection Regulation (GDPR) (EU) https://eur-lex.europa.eu/legalthe European Union 2016/679 content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG IOT-A (Internet of Things IOT-A (Internet of Things Architecture) http://cordis.europa.eu/project/rcn/95713_en.html Architecture) http://www.meet-iot.eu/iot-a-deliverables.html 2. US Government Initiatives Homeland Security Strategic Principles for Securing the Internet of https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_t Homeland Security Recommended Practice: Improving Industrial https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS- Control System Cybersecurity with Defense-in- CERT_Defense_in_Depth_2016_S508C.pdf Depth Strategies NIST NISTIR 8183: Cybersecurity Framework https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8183.pdf Manufacturing Profile

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

NIST Draft NISTIR 8228: Considerations for Managing https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8228-draft.pdf Internet of Things (IoT) Cybersecurity and Privacy Risks

NIST NIST SP 800 82r2: Guide to Industrial Control https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf Systems (ICS) Security

NIST NIST SP 800 53r4: Security and Privacy Controls for https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf Federal Information Systems and Organizations

NIST NIST.SP 1500-202 - Framework for Cyber-Physical https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1500-202.pdf Systems: Volume 2, Working Group Reports

NIST NIST SP 800 30r1 - Guide for Conducting Risk https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-30r1.pdf Assessments

NIST Best practices in cyber supply chain risk https://www.nist.gov/sites/default/files/documents/itl/csd/NIST_USRP-SmartManumanagement. Smart Manufacturing The Future of Cyber-SCRM-Case-Study.pdf Manufacturing and Value Chain Competitiveness

NIST NIST SP 800-52 r1: Guidelines for the Selection, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf Configuration, and Use of Transport Layer Security (TLS) Implementations

NIST Cybersecurity for Smart Manufacturing https://www.nist.gov/sites/default/files/documents/2016/12/05/cybersecurity_for_smar t_manufacturing.pdf

NIST Framework for Cyber-Physical Systems: Volume 1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1500-201.pdf Overview

NIST Framework for Improving Critical Infrastructure https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf Cybersecurity V1.1

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

NIST NIST Advanced Manufacturing Series 300-1 https://nvlpubs.nist.gov/nistpubs/ams/NIST.AMS.300-1.pdf Reference Architecture for Smart Manufacturing Part 1: Functional Models

NIST NIST SP 800-146 Cloud Computing Synopsis and https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-146.pdf Recommendations

NIST NIST SP 800-61r2: Computer Security Incident https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf Handling Guide - Recommendations of the National Institute of Standards and Technology

NIST NISTIR 8200: Interagency Report on Status of https://csrc.nist.gov/publications/detail/nistir/8200/draft International Cybersecurity Standardization for the Internet of Things (IoT)

3. International Organizations/Alliances

http://www.sovereign- Auto ISAC (Automotive Information Automotive Cybersecurity Best Practices - Executive plc.co.uk/sites/default/files/Auto%20ISAC%20Cyber%20Security%20Best%20Practices%2 Sharing and Analysis Center) Summary 0Executive%20Summary.pdf

BITAG (Broadband Internet Technical Internet of Things (IoT) Security and Privacy https://www.bitag.org/documents/BITAG_Report_- Advisory Group) Recommendations _Internet_of_Things_(IoT)_Security_and_Privacy_Recommendations.pdf

Center for Internet Security (CIS) Critical Security Controls https://www.cisecurity.org/wp-content/uploads/2017/03/Poster_Winter2016_CSCs.pdf

Security Guidance for Early Adopters of the Internet https://downloads.cloudsecurityalliance.org/whitepapers/Security_Guidance_for_Early_ Cloud Security Alliance of Things Adopters_of_the_Internet_of_Things.pdf

Identity and Access Management for the Internet of https://downloads.cloudsecurityalliance.org/assets/research/internet-of-things/identity- Cloud Security Alliance Things - Summary Guidance and-access-management-for-the-iot.pdf

https://downloads.cloudsecurityalliance.org/assets/research/internet-of-things/future- Cloud Security Alliance Future Proofing the connected world proofing-the-connected-world.pdf

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

ETSI (European Telecommunications ETSI GR QSC 004 V1.1.1 (2017-03) Quantum Safe http://www.etsi.org/deliver/etsi_gr/QSC/001_099/004/01.01.01_60/gr_QSC004v010101 Standards Institute) Cryptography; Quantum-Safe threat assessment p.pdf

ETSI (European Telecommunications ETSI TR 103 375 SmartM2M; IoT Standards http://www.etsi.org/deliver/etsi_tr/103300_103399/103375/01.01.01_60/tr_103375v01 Standards Institute) landscape and future evolutions 0101p.pdf

ETSI (European Telecommunications ETSI TR 118 518 V2.0.0 (2016-09) oneM2M; https://www.etsi.org/deliver/etsi_tr/118500_118599/118518/02.00.00_60/tr_118518v0 Standards Institute) Industrial Domain Enablement 20000p.pdf

EuroSMART (the voice of the Smart Internet Of Trust Security And Privacy In The http://www.eurosmart.com/news-publications/99-policy-papers/245-eurosmart- Security Industry) Connected World internet-of-trust-security-and-privacy-in-the-connected-world.html

Federal Office for Information Security BSI-Standards 100-4 - Business Continuity https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/BSIStandards/sta (BSI) Management ndard_100-4_e_pdf.pdf?__blob=publicationFile&v=1

Federal Office for Information Security BSI-Standards 100-1 - Information Security https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/BSIStandards/sta (BSI) Management Systems (ISMS) ndard_100-1_e_pdf.pdf?__blob=publicationFile&v=1

Federal Office for Information Security Protection Profile for the Gateway of a Smart https://www.commoncriteriaportal.org/files/ppfiles/pp0073b_pdf.pdf (BSI) Metering System (Smart Meter Gateway PP), Certification-ID: BSI-CC-PP-0073

GSMA GSMA CLP.11 IoT Security Guidelines Overview https://www.gsma.com/iot/wp-content/uploads/2016/02/CLP.11-v1.1.pdf Document

GSMA GSMA CLP.12 IoT Security Guidelines for IoT Service https://www.gsma.com/iot/wp-content/uploads/2016/02/CLP.12-v1.0.pdf Ecosystems

GSMA GSMA CLP.13 IoT Security Guidelines for Endpoint https://www.gsma.com/iot/wp-content/uploads/2016/02/CLP.13-v1.0.pdf Ecosystems

GSMA GSMA CLP.14 IoT Security Guidelines for Network https://www.gsma.com/iot/wp-content/uploads/2017/10/CLP.14-v2.0.pdf Operators

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

IEC IEC 62443-1-1:2009 Terminology, concepts and https://webstore.iec.ch/publication/7029 models IEC IEC 62443-2-1:2010 Establishing an industrial https://webstore.iec.ch/publication/7030 automation and control system security program IEC IEC 62443-3-3:2013 System security requirements https://webstore.iec.ch/publication/7033 and security levels IEC IEC 62443-4-1:2013 Secure product development https://webstore.iec.ch/publication/33615 lifecycle requirements IEEE Internet of Things (IoT) Security Best Practices https://internetinitiative.ieee.org/images/files/resources/white_papers/internet_of_thin gs_feb2017.pdf IEEE IEEE Std 802.1X-2010 - Port-Based Network Access http://moodle.eece.cu.edu.eg/pluginfile.php/1799/mod_folder/content/1/802.1X- Control 2010.pdf?forcedownload=1 IIC (Industrial Internet Consortium) IIC Endpoint Security Best Practices https://www.iiconsortium.org/pdf/Endpoint_Security_Best_Practices_Final_Mar_2018.p df IIC (Industrial Internet Consortium) Accompanying the Industrial Internet of Things https://www.iiconsortium.org/IIC_PUB_G1_V1.80_2017-01-31.pdf Volume G1: Reference architecture IIC (Industrial Internet Consortium) Industrial Internet of Things Volume G4: Security https://www.iiconsortium.org/pdf/IIC_PUB_G4_V1.00_PB.pdf Framework IIC (Industrial Internet Consortium) IoT Security Maturity Model: Description and https://www.iiconsortium.org/pdf/SMM_Description_and_Intended_Use_2018-04- Intended Use 09.pdf International Telecommunications Security capabilities supporting safety of the https://www.itu.int/rec/T-REC-Y.4806/en Union Internet of things

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

International Telecommunications Unleashing the potential of the Internet of Things https://www.itu.int/en/publications/Documents/tsb/2016-InternetOfThings/index.html Union Internet Engineering Task Force (IETF) Best Current Practices for Securing Internet of https://www.ietf.org/proceedings/56/ Things (IoT) Devices Internet Engineering Task Force (IETF) IETF RFC 7452 Architectural Considerations in Smart https://tools.ietf.org/html/rfc7452 Object Networking Internet Research Task force (IRTF) State-of-the-Art and Challenges for the Internet of https://tools.ietf.org/pdf/draft-irtf-t2trg-iot-seccons-04.pdf Things Security IoT Alliance Australia Internet of Things Security Guidelines v1.2 http://www.iot.org.au/wp/wp-content/uploads/2016/12/IoTAA-Security-Guideline- V1.2.pdf IoT Security Foundation Connected Consumer Products. Best Practice https://iotsecurityfoundation.org/wp-content/uploads/2016/12/Connected-Consumer- Guidelines Products.pdf IoT Security Foundation Security Challenges on the Way Towards Smart https://www.iotsecurityfoundation.org/security-challenges-on-the-way-towards-smart- Manufacturing manufacturing/ IoT Security Foundation Establishing Principles for IoT Security https://iotsecurityfoundation.org/wp-content/uploads/2015/09/IoTSF-Establishing- Principles-for-IoT-Security-Download.pdf ISA ANSI/ISA-95 Part 1: Models and Terminology https://www.isa.org/store/ansi/isa-950001-2010-iec-62264-1-mod-enterprise-controlsystem-integration-part-1-models-and-terminology/116636 oneM2M - Standards for M2M and the TR 0008 Security V2.0.0 - Security. Technical Report http://www.onem2m.org/images/files/deliverables/Release2/TR-0008-Security- Internet of Things V2_0_0.pdf Online Trust Alliance IoT trust framework 2.5 https://otalliance.org/system/files/files/initiative/documents/iot_trust_framework6- 22.pdf

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

OWASP (Open Web Application Guide to Cryptography https://www.owasp.org/index.php/Guide_to_Cryptography Security Project) OWASP (Open Web Application IoT Security Guidance https://www.owasp.org/index.php/IoT_Security_Guidance Security Project) OWASP (Open Web Application Mobile Top 10 2016 https://www.owasp.org/index.php/Mobile_Top_10_2016-Top_10 Security Project) SANS Institute An Abbreviated History of Automation & Industrial https://ics.sans.org/media/An-Abbreviated-History-of-Automation-and-ICS- Controls Systems and Cybersecurity Cybersecurity.pdf SANS Institute Building the New Network Security Architecture for https://www.sans.org/reading-room/whitepapers/cloud/building-network-securitythe Future architecture-future-38255 SANS Institute The 2018 SANS Industrial IoT Security Survey: https://www.sans.org/reading-room/whitepapers/analyst/2018-industrial-iot-security- Shaping IIoT Security Concerns survey-shaping-iiot-security-concerns-38505 SANS Institute Vulnerability Management: Tools, Challenges and https://www.sans.org/reading-room/whitepapers/threats/vulnerability-management- Best Practices tools-challenges-practices-1267 Smart Card Alliance Embedded HW Security for IoT Applications https://www.securetechalliance.org/downloads/Embedded-HW-Security-for-IoT-WP- FINAL-December-2016.pdf Software Assurance Forum for Call it the Internet of Connected Things: The IoT http://www.safecode.org/call-it-the-internet-of-connected-things-the-iot-security- Excellence in Code (SAFECode) - NPO Security Conundrum conundrum/ Trusted Computing Group (TCG) Guidance for Securing IoT Using TCG Technology https://trustedcomputinggroup.org/guidance-securing-iot-using-tcg-technology- Reference Document reference-document/ World Economic Forum Industrial Internet of Things: Unleashing the http://www3.weforum.org/docs/WEFUSA_IndustrialInternet_Report2015.pdf Potential of Connected Products and Services 4. Other references

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

AT&T Cybersecurity Insights Exploring IoT Security Volume 2 https://www.business.att.com/cybersecurity/docs/exploringiotsecurity.pdf

Elsevier Avoiding the internet of insecure industrial things https://www.sciencedirect.com/science/article/pii/S0267364917303217

Huawei IoT Security White Paper 2017 https://www.huawei.com/minisite/iot/img/hw_iot_secutity_white_paper_2017_en_v2.p df

Infineon Hardware-based solutions secure machine identities https://www.infineon.com/dgdl/Infineon-IoT+Security+in+Smart+Factories-ART-v01_00in smart factories EN.pdf?fileId=5546d46254e133b40154e22c8a7d0251

Infineon Hardware Security for Smart Grid End Point Devices https://www.nrel.gov/esif/assets/pdfs/hardware_security_smart_grid.pdf

ISACA Performing a Security Risk Assessment https://www.isaca.org/journal/archives/2010/volume-1/pages/performing-a-securityrisk-assessment1.aspx

ISO ISO/IEC 27001:2013 Information technology -- https://www.iso.org/standard/54534.html Security techniques -- Information security management systems -- Requirements

ISO ISO/IEC 27002:2013 Information technology -- https://www.iso.org/standard/54533.html Security techniques -- Code of practice for information security controls

ISO ISO/IEC 27031:2011 Information technology -- https://www.iso.org/standard/44374.html Security techniques -- Guidelines for information and communication technology readiness for business continuity

LNS Putting Industrial Cyber Security at the top of the https://www.honeywellprocess.com/en-US/online_campaigns/lns-cyber- CEO agenda report/Pages/Honeywell-LNS- Study_PuttingIndustrialCyberSecurityattheTopCEOAgenda.pdf

MIT Security Analysis of Zigbee https://courses.csail.mit.edu/6.857/2017/project/17.pdf

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

OpenAI and others The Malicious Use of Artificial Intelligence: https://www.eff.org/files/2018/02/20/malicious_ai_report_final.pdf Forecasting, Prevention, and Mitigation

Shaun Bligh-Wall Industry 4.0: Security imperatives for IoT — https://www.henrystewartpublications.com/sites/default/files/Bligh-Wall.pdf converging networks, increasing risks.

Siemens Industrial Security: Applying IoT Security Controls on https://www.industry.usa.siemens.com/automation/us/en/formsdocs/Documents/2016 the Industrial Plant Floor %20MIA- %2023%20Industrial%20Security%20Applying%20IoT%20Security%20Controls%20on%20t he%20Industrial%20Plant%20Floor.pdf

Smart Factory Innovation Forum Managing security, safety and privacy in Smart https://www.pinsentmasons.com/dokument/it-security-in-smart-factories-white-paper- Factories april-2015.pdf

Symantec An Internet of Things Reference Architecture https://www.symantec.com/content/en/us/enterprise/white_papers/iot-securityreference-architecture-wp-en.pdf

Symantec Internet Security Threat Report (ISTR) Volume 22 https://www.symantec.com/security-center/threat-report https://resource.elq.symantec.com/LP=3980?cid=70138000001BjppAAC&mc=202671&ot =wp&tt=sw&inid=symc_threat-report_regular_to_leadgen_form_LP-3980_ISTR22-reportmain

Symantec Smarter Security for Manufacturing in The Industry https://www.symantec.com/content/dam/symantec/docs/solution-briefs/industry-4.0- 4.0 Era: Industry 4.0 Cyber Resilience for the en.pdf Manufacturing of the Future

The Cavalry Hippocratic Oath for Connected Medical Devices https://www.iamthecavalry.org/wp-content/uploads/2016/01/I-Am-The-Cavalry- Hippocratic-Oath-for-Connected-Medical-Devices.pdf

VDC Industry 4.0: Secure by design https://cdn2.hubspot.net/hubfs/582328/whitepapers/VDC%20- %20Industry%204.0%20Secure%20by%20Design%20- %20for%20GrammaTech.pdf?t=1519834251604

Good practices for Security of Internet of Things in the context of Smart Manufacturing

November 2018

AUTHOR TITLE REFERENCE

VDMA Industrie 4.0 Security Guidelines Recommendations http://www.vdmashop.de/refs/Leitf_I40_Security_En_LR_neu.pdf for actions

VDMA Smart Manufacturing General security and privacy http://ec.europa.eu/information_society/newsroom/image/document/2017principles to ensure a Trusted IoT environment 11/smart_manufacturing_to_ensure_a_trusted_iot_environment_by_vdma_0B8285E7- 9C90-7E5C-04DA25B61A5C3FA5_43660.pdf

IOActive, Embedi SCADA And Mobile Security In The Internet Of https://ioactive.com/pdfs/SCADA-and-Mobile-Security-in-the-IoT-Era-Embedi- Things Era FINALab%20(1).pdf

Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018

Annex D: Description of indicative Industry 4.0 security incidents

SECURITY INCIDENT DATE DESCRIPTION The purpose of an SIS is to take immediate action when a critical process goes some other way than planned e.g. if the pressure in a tank rises above a predetermined level, SIS will activate valves to lower the pressure to prevent an explosion. Disturbing this failsafe mechanism can have severe physical consequences, especially in an industrial plant. One of these systems was attacked in 2017 by Triton – an industry-targeted malware Triton malware attack on designed to inflict severe damage. This was the first cyber-attack on a Safety Instrumented November 2017 Safety Instrumented System (SIS) ever recorded. After obtaining remote System (SIS) access to a workstation, attackers infected SIS with malware. Using Zero- Day vulnerability, Triton managed to install itself on SIS, providing attackers with full control. However, once in, the attackers “tripped” and triggered the safety shut down of a process governed by SIS. This alarmed employees, leading to detection of the malware and stopping the attack before it caused any serious damage that would most probably have destroyed 48 49 infrastructure and halted production. Just 6 weeks after WannaCry, a new global cyberattack emerged. Originally targeted at Ukraine – its central bank, government and utilities (such as electrical grids), it managed to disrupt people’s everyday life across the country. Spreading further, NotPetya (also known as ExPetr, often referred to as Petya) infected more than 200,000 computers worldwide and affected mostly industrial companies such as Rosneft, Merck and Maersk. Using an SMB protocol exploit to achieve initial infection it then tried to steal credentials and take control of other machines on the network, including NotPetya - ransomware June 2017 those immune (e.g. patched) to this exploit. This made NotPetya especially created to cause damage dangerous, as even a single vulnerable device could lead to the compromise of the whole network. Soon after the infection, NotPetya proceeded to encrypt files on the computer using an irreversible. This means that once encrypted, all affected files are lost, which makes the virus work like a wiper, deleting important data from the system. Combined with the attackers’ inability to collect ransom, this raised serious speculations whether NotPetya was really ransomware or a cyber-weapon disguised as one. 50 51 52 53 54 See CyberArk (2018) “Anatomy of the Triton malware attack”: https://www.cyberark.com/threat-researchblog/anatomy-triton-malware-attack/ See Sentryo (2018) “Analysis of Triton industrial malware”: https://www.sentryo.net/analysis-triton-malware/ See Kaspersky Lab (2017) “More than 50% of organizations attacked by ExPetr (Petya) cryptolocker are industrial companies”: https://ics-cert.kaspersky.com/alerts/2017/06/29/more-than-50-percent-of-organizations-attacked-byexpetr-petya-cryptolocker-are-industrial-companies/ See The New York Times (2017) “Cyberattack Hits Ukraine Then Spreads Internationally”: https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html See CNet (2018) “US: Russia's NotPetya the most destructive cyberattack ever”: https://www.cnet.com/news/uksaid-russia-is-behind-destructive-2017-cyberattack-in-ukraine/ See TechRepublic (2017) “NotPetya ransomware outbreak cost Merck more than $300M per quarter”: https://www.techrepublic.com/article/notpetya-ransomware-outbreak-cost-merck-more-than-300m-per-quarter/ See The Register (2018) “IT 'heroes' saved Maersk from NotPetya with ten-day reinstallation bliz”: https://www.theregister.co.uk/2018/01/25/after_notpetya_maersk_replaced_everything/ Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 SECURITY INCIDENT DATE DESCRIPTION This enormous, worldwide cyberattack infected more than 230,000 computers across 150 countries and affected manufacturers, banks and governments. Organisations such as Renault and Honda were forced to halt production, FedEx clients experienced delays on deliveries, and the UK’s National Health Service was forced to cancel thousands of appointments. Those are only a few of the confirmed victims of this ransomware, with many more organisations not admitting to having been infected. WannaCry, as this virus is called, using two sophisticated exploits in WannaCry ransomware Microsoft Windows systems managed to spread through the SMB protocol, May 2017 worldwide cyberattack installing itself on a vulnerable machine without any user action (such as opening a malicious e-mail attachment). Once in, it scanned the network for other targets, infecting all of them, repeating the process and spreading the infection further into the system. Fortunately, the attack was slowed down by discovery of a kill-switch – a major flaw in the virus that allowed researchers to “turn off” its spreading functionality, leaving asset owners with a few hours to secure their devices and prepare for another wave of infections. Securing those devices could have been as easy as installing the security updates released by Microsoft a few months earlier. The second cyberattack on the Ukrainian power grid came almost exactly a year after the first one. It shared many similarities with its predecessor but varied in the method used. This time, attackers used a new malware specifically designed to attack electrical grids – Industroyer. It targets widely used communication protocols, providing the attacker with a backdoor to an industrial control system. Once again, attackers opened Industroyer – second circuit breakers stopping power supply and once again they delayed cyberattack on Ukrainian December 17, 2016 recovery by additional means, such as wiping crucial files to make the power grid system unresponsive. As a result, one fifth of Kiev, the capital of Ukraine, was left without electricity for an hour. It is suspected that this attack was a large-scale test, as attackers did not harness the malware’s full potential. As Industroyer can be slightly modified to target other types of critical infrastructure, such as water or gas, it is a major threat to industrial control systems that has been proven to work. 55 56 An alert was issued by ICS-CERT warning of a new bot attack similar to Mirai. Named BrickerBot by its creator, it uses brute force in the telnet to gain BrickerBot – permanent November 2016 – access to a device and then puts it in a permanent denial of service state denial of service botnet December 2017 forcing its owner to reinstall the device or replace it altogether. According to its creator, BrickerBot “bricked” over 10 million devices in about a year. 57 58 See WeLiveSecurity (2017) “Industroyer: Biggest threat to industrial control systems since Stuxnet”: https://www.welivesecurity.com/2017/06/12/industroyer-biggest-threat-industrial-control-systems-since-stuxnet/ See MIT Technology Review (2016) “Ukraine’s Power Grid Gets Hacked Again, a Worrying Sign for Infrastructure Attacks”: https://www.technologyreview.com/s/603262/ukraines-power-grid-gets-hacked-again-a-worrying-sign-forinfrastructure-attacks/ See ICS-CERT (2017) “Alert (ICS-ALERT-17-102-01A) BrickerBot Permanent Denial-of-Service Attack”: https://icscert.us-cert.gov/alerts/ICS-ALERT-17-102-01A See BleepingComputer (2017) “BrickerBot Author Retires Claiming to Have Bricked over 10 Million IoT Devices”: https://www.bleepingcomputer.com/news/security/brickerbot-author-retires-claiming-to-have-bricked-over-10million-iot-devices/ Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 SECURITY INCIDENT DATE DESCRIPTION The botnet made of IoT devices infected by Mirai has been associated with one of the largest Distributed Denial of Service (DDoS) attacks ever performed. The most notable attack was on a DNS service provider called Dyn. By attacking Dyn with up to 100,000 infected devices across the world, the attackers managed to disrupt or even disconnect several popular services, such as Twitter, Netflix or Spotify, at the same time. The way the malware infected so many devices was simply by utilising the most popular and vendor provided passwords to gain access to them. Having “recruited” Mirai – IoT botnets attack October 21, 2016 them, the attackers left the devices almost untouched, seemingly unaffected by malware. With an army at their disposal, the attackers were able to order it to flood selected destinations, such as Dyn, exceeding their bandwidth limits and bringing them down. What is probably the most troubling about Mirai is that its source code is publicly available, providing anyone with a way to build a botnet. Every month a new improved variety of Mirai is discovered. Even though the original Mirai did not specifically target IIoT devices, a version of it that does can surface any day now.59 60 The cyberattack on the power grid in Ukraine was well planned, carefully prepared and flawlessly executed. The attackers’ goal was not only to disturb power supply, but also to delay restoration for as long as possible. It started similarly to many other attacks, namely with phishing emails containing malicious Microsoft Office files with embedded malware. This malware, known as BlackEnergy, allowed the attackers to steal privileged credentials and perform network reconnaissance, finding out all the information about the infected system. Then, after as much as 6 months, Cyberattack on a power attackers remotely seized control over a SCADA system, opening multiple December 23, 2015 grid in Ukraine electricity breakers and leaving about 230 thousand people without electricity. At the same time, they took a number of steps to prolong the effect. One, every infected computer’s hard drive was wiped. Two, uninterruptible power supply (UPS) was compromised resulting in service outages. Three, they “blew the bridges” by uploading malicious firmware to gateway devices, making remote recovery impossible. These side-attacks successfully delayed recovery, leaving people without electricity for up to 6 hours. This attack and the helplessness of the defence served as a wake-up call to a lot of manufacturers.61 Kemuri Water Company (KWC) is an alias for an anonymous water company which experienced a security breach in its water treatment plant in 2015. Due to major security flaws such as the usage of outdated operating Cyberattack on Kemuri systems or storing all data on a single “ancient” server (IBM AS/400 from Water Company’s water 2015 1988), attackers exploiting vulnerability in an online payments system treatment plant gained access to all of KWC’s customers’ data and their ICS. Then, by manipulating PLCs, attackers changed the amount of chemicals used, influencing the tap water’s properties. Luckily, this change was harmless as it is supposed that the attackers’ main goal was to obtain sensitive See Sentryo (2016) “The ‘mirai’ iot botnet, a publically available turn-key threat”: https://www.sentryo.net/themirai-iot-botnet-a-publically-available-turn-key-threat-2/ See Xage Security (2016) “Mirai and IIoT Security”: https://xage.com/press/mirai-and-iiot-security/ See SANS ICS (2016) “Analysis of the Cyber Attack on the Ukrainian Power Grid Defense Use Case”: https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 SECURITY INCIDENT DATE DESCRIPTION customer data and not disturb the water treatment process. Had their goals been different, it would have posed a serious threat to the public. This attack, as many others, started with a phishing email opened by a reckless employee. Once in the corporate network, attackers, using an unknown technique, moved into the plant network and seized control of German steel mill attack 2014 multiple ICS components (including PLCs, HMIs and alarm systems). Then, manipulating individual systems and causing their failure, attackers disrupted the safe shutdown of a blast furnace, which resulted in serious physical damage to the system. In 2014 it was reported that a number of European and US power facilities were infected with a new malware created by a group known as Dragonfly. The malware targeting ICSs consisted of two Remote Access Trojans (RATs) which allowed the attacker to upload, download and execute files from the Havex / Dragonfly – a infected computer. Its main mission was to collect data and information Remote Access Trojan 2014 about the infected system but with persistent backdoor access it could targeted on SCADA, PLC easily transform into something more malicious. What is even more and DCS systems interesting is how this malware infected its victims. Besides phishing emails and watering hole attacks, it also hacked some ICS vendors software downloads and planted RATs in them thereby even infecting somewhat cautious targets. This attack started with a Saudi Aramco employee from the IT team opening a malicious phishing email providing a point of entry for the attacker. Once inside, attackers dropped a virus later known as Shamoon. It immediately started spreading across Saudi Aramco’s entire IT network, infecting at least Shamoon virus - 35,000 computers. Then, at a carefully selected date – Saudi Arabia’s Cyberattack on Saudi August 15, 2012 national holiday – the virus began to wipe all the data on the infected Arabian Oil Company computers replacing it with the image of a burning American Flag. After (Saudi Aramco) that, it proceeded to overwrite the computers’ Master Boot Record making it unusable. Even though the attack affected only the IT network, leaving separate ICS completely functional, it had a huge impact on other business processes, such as loading gasoline trucks.65 Duqu is “nearly identical to Stuxnet, but with a completely different purpose” according to Symantec. It targets Microsoft Windows, just like Stuxnet, and uses Microsoft Word to execute code in kernel mode. Once Duqu – Stuxnet evolved 2011 the machine is infected, Duqu’s purpose is not to destroy it, but rather gather information useful in future attacks. Other than recording keystrokes and system information, according to McAfee, Duqu steals digital certificates that may be used to make future viruses appear more legitimate. Although there was no code related to industrial control See Sentryo (2017) “The Sentryo Files: Industries Vs. Cyberattacks Episode 5: A Water Treatment Plant Under Attack”: https://www.sentryo.net/sentryo-files-attack-water-treatment-plant/ See SANS ICS (2014) “German Steel Mill Cyber Attack”: https://ics.sans.org/media/ICS-CPPE-case-Study-2-German- Steelworks_Facility.pdf See Belden (2014) “How Dragonfly Hackers and RAT Malware Threaten ICS Security”: https://www.belden.com/blog/industrial-security/how-dragonfly-hackers-and-rat-malware-threaten-ics-security See CNNMoney (2015) “The inside story of the biggest hack in history”: https://money.cnn.com/2015/08/05/technology/aramco-hack/index.html Good practices for Security of Internet of Things in the context of Smart Manufacturing November 2018 SECURITY INCIDENT DATE DESCRIPTION systems found in analyses, the information gathered by Duqu might enable future attacks on Industrial Internet of Things. Cyberattack on a SCADA This attack started with utility’s SCADA software vendor being hacked and system of an American a list of usernames and passwords to customer systems being stolen. Water and Utility Vendors allowing them access to customers’ systems for support purposes November 8, 2011 company causing sometimes maintain these lists. Once the attacker had these credentials, destruction of one of the he could access the pump’s controlling system and issue commands leading pumps to its destruction.67 In 2010, it was reported that power thieves exploiting vulnerability in smart meters caused PREPA (Puerto Rico Electric Power Authority) to incur costs Cyberattacks on Smart of 400 million dollars a year. Only a few things were required to carry out 2010 Meters this attack, namely optical probes, freely available software and physical access to the meter. Because of its simplicity, many smart meters recordings were modified resulting in such an enormous loss. In 2010 workers at the Natanz nuclear facility realised that a strange number of uranium enriching centrifuges were breaking. After inspection, it was found that the Stuxnet worm that targets programmable logic controllers (PLCs) infected their computer systems. It is believed that it was introduced into the system by a USB drive, from where it targeted Stuxnet worm attack on Microsoft Windows and Siemens Step7 software exploiting their Natanz nuclear 2010 vulnerabilities to gain access to PLCs, modifying the codes and giving enrichment lab in Iran unexpected commands to the PLC while returning unsuspicious feedback. In this incident, the attackers made centrifuges spin fast enough to tear themselves apart while giving no warning to operators. Although no official report was released, it is estimated that Stuxnet ruined almost one fifth of Iran’s nuclear centrifuges. Auto manufacturer DaimlerChrysler underwent a cyberattack in 2005 caused by a Zotob worm – a virus that spreads online and exploits the Disruption of multiple vulnerabilities of Windows’ Plug and Play service. Despite the separation of DaimlerChrysler’s car August 16, 2005 OT and IT networks with a firewall, due to the lack of patching of Windows manufacturing plants by a 2000 servers, the worm spread across the plants and stopped the operation Zotob worm of 13 DaimlerChrysler’s sites for over an hour. This resulted in huge financial losses totalling 14 million dollars . See Symantec (2011) “W32.Duqu The precursor to the next Stuxnet”: https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precu rsor_to_the_next_stuxnet.pdf See Computerworld (2011) “Apparent cyberattack destroys pump at Ill. water utility”: https://www.computerworld.com/article/2497351/cybercrime-hacking/apparent-cyberattack-destroys-pump-at-ill-water-utility.html See KrebsOnSecurity (2012) “FBI: Smart Meter Hacks Likely to Spread”: https://krebsonsecurity.com/2012/04/fbismart-meter-hacks-likely-to-spread/ See Michael Holloway (2015) “Stuxnet Worm Attack on Iranian Nuclear Facilities”: http://large.stanford.edu/courses/2015/ph241/holloway1/ See Sentryo (2017) “The Sentryo Files: Industries Vs. Cyberattacks Episode 9: Cyberattack On A Car Manufacturing Plant”: https://www.sentryo.net/the-sentryo-files-daimlerchrysler-cyberattack/

ENISA

European Union Agency for Network and Information Security 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

Heraklion Office

Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece Catalogue Number: TP-04-18-940-EN-N 1 Vasilissis Sofias Str, Maroussi 151 24, Attiki, ISBN: 978-92-9204-261-5 DOI: 10.2824/851384 Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu