Industrial Machinery Cyber Security
Why Has This Changed?
The safety landscape in machinery is always evolving, but the rapid advancement of artificial intelligence has fundamentally changed the cyber security landscape. AI has significantly lowered the barrier to entry for cyber attacks, enabling individuals with little or no specialist knowledge to generate malicious code, identify vulnerabilities, produce convincing phishing campaigns and automate attacks that previously required experienced cyber security professionals.
Previously, malware attacks and cyber risks mostly targeted data. However, with the drive for new technology in industry to keep production flexible, costs under control and remain competitive, we have introduced more and more digital elements into our machines—elements that are prime targets for malicious intent.
The Human Factor
Thoughts on how to protect against this, in line with our normal machinery safety methodology, have also raised another question: what about non-malicious intent? Does an operator or technician fully understand the technology that they are working with, which may, unbeknown to them, be at the bleeding edge of technological progress?
It may be the same type of machine they have worked on for years, but a newer model with USB ports, Safety PLCs, PROFINET connecting all of the components, remote access and intelligent diagnostics. Do they know what threats may have transferred onto a maintenance laptop before it is plugged into the machine? Do they know that their easy way into the system may be just as easy for an attacker? Do they understand the importance of the safety application within the Safety PLC, that it has been validated by an expert, and that it should not be altered without proper assessment?
Insider Threats
This also leads to the issue of disgruntled employees. Although malicious in nature, how much skill would they really need to bring down an operational plant? A USB Killer device can be purchased for as little as £20 and has the potential to damage hundreds of thousands of pounds' worth of equipment. A programmable "BadUSB" device can automatically execute code as soon as it is connected, potentially introducing malware into a machine or industrial network. The opportunity for corruption is real.
The Machinery Regulation
The number of threats and attack pathways into industrial machinery is only increasing, which is why the new Machinery Regulation has introduced "Protection Against Corruption" as a significant new Essential Health and Safety Requirement. The new Machinery Regulation comes into effect from the 20th January 2027.
As with the traditional safety of the machine, cyber security is a responsibility shared between both the machine manufacturer and the end user.
Although cyber security has been established within industrial control systems for many years, its application to individual machinery is still evolving.
The Cyber Resilience Act
The next legislation to consider is the Cyber Resilience Act (CRA) that is currently voluntary but becomes mandatory in December 2027.
This more than just the safety of the machine but commercial interests as well. it covers:
Secure-by-design & secure-by-default - products must be delivered without known exploitable vulnerabilities
Life-cycle support & Free updates - manufacturers must establish a defined technical support period during which security patches are provided free of charge. Issued security updates must remain available for download for at least 10 years or the remainder of the support period.
Supply chain diligence & SBOM - manufacturers must perform due diligence on third-party and open-source software components and track dependencies via a machine-readable Software Bill of Materials (SBOM)
Mandatory active exploitation reporting - Actively exploited vulnerabilities and severe security incidents must be reported to national CSIRTs and ENISA via a central EU reporting platform
This marks a huge shift in technological responsibilities and has a significant cross over with the Machinery Regulation. So much in fact, that following the map below covers the requirements in prEN 50742 option B in the process.
The Standards
The tools being developed to support this include a range of standards:
prEN 50742 – Cyber security requirements supporting the Machinery Regulation.
prEN 40000 -1 - This is a new series that supports conformity to the CRA. It has taken directly from parts of the IEC 62443 series and as such can be mapped across to this standard. prEN 40000-1 gives the requirements for process and policy, IEC 62443 provides the technical detail.
IEC TS 63074:2023 – Guidance for machine builders on applying the relevant parts of the IEC 62443 series where cyber security threats could affect the functional safety of safety-related control systems.
ISO/TR 22100-4 – Guidance on integrating cyber security into machinery risk assessment alongside EN ISO 12100.
IEC 62443 series – Industrial Automation and Control Systems Security.
These standards provide guidance on how to apply the IEC 62443 series to machinery.
Effectively, the requirement for the Machinery Regulation is to use prEN 50742 to conduct a risk assessment and carry out mitigation. one option being to use parts of IEC 62443.
The requirement for the CRA is to use prEN 40000-1 to build your process and policy, conduct a cyber security risk assessment in accordance with IEC 62443-3-2 and utilize the technical requirements within IEC 62443-3-3 to demonstrate the Security Level that your machinery can achieve.
These assessments also provide the engineering basis for selecting appropriate cyber security technologies and system architecture.
Other standards from the IEC 62443 series are used to conform, this is a overview to show what is required.
Approach To Conformity
We offer both options, conduct a prEN 50742 assessment that will cover the Machinery Regulation for this year.
Alternatively we can carry out a full CRA readiness plan, including helping you prepare public policy, internal process, carrying out the full cyber security risk assessment and mitigation.
Wherever you are in the journey, we can help support you!
Ongoing Responsibilities
There are also ongoing requirements to provide support when new vulnerabilities are identified within your machinery.
For example, if the manufacturer of a Safety PLC identifies a new vulnerability, you should assess the impact on your machinery, inform customers who operate the affected machines and provide guidance, mitigation measures or software updates where appropriate.
This is a new and demanding requirement being placed upon machinery builders and system integrator, and it will not always be straightforward to navigate.
How We Can Help
We are here to help, whether that is delivering a standalone cyber security risk assessment for your machinery, integrating cyber security into a complete machinery conformity assessment, or supporting you with the corrective actions identified throughout the assessment process.