Hany AbdElHafiz

It took a bit longer than expected, but finally, I've got the ISA/IEC62443 Expert certificate from International Society of Automation (ISA)! Conclusions: - You can always learn something new, and become a better praticioner - Industrial cybersecurity and process safety go hand to hand #FunctionalSafety - Having the correct understanding of the complete picture of a management system implementation is as valuable as being sharp expert in one of it elements - Things done with passion have the best results ;) #IEC62443 #OTCybersecurity #ISA #IEC #ICSCybersecurity #OT #RiskAssessment

126

17 Comments

Audit trails are of critical importance in regulated industries. The audit trail functions as a digital footprint, providing users with the ability to trace the history of each key event in the manufacturing process. In this simplified example, we have an iFIX SCADA which stores its audit trail in a local SQL database. Using HighByte Intelligence Hub and utilizing the SQL CDC (Change Data Capture) feature the audit trail events are published to a semantic hierarchy using MQTT. Once published, other systems can then subscribe to the audit trail in real time. By normalizing and publishing to a UNS architecture, the use of automated review tools can then be deployed reducing the review effort. As always, if any of the above interests you feel free to reach out. #digitalisation #SCADA #AuditTrail #SQL #MQTT #DataOps #UNS #HighByte

73

4 Comments

Guide to Operational Technology (OT) Security You can download this document from the NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY U.S.DEPARTMENT OF COMMERCE Abstract This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment (or manage devices that interact with the physical environment). #otsecurity #cybersec https://lnkd.in/gxJXhG2R

2

The National Institute of Standards and Technology (NIST) has released a range of cybersecurity guidelines related to Internet of Things (IoT) technologies — from device selection and implementation guidance to outlines on what capabilities IoT devices should feature. This guidance includes some of the main capabilities an industrial IoT device should feature, including device identification and configuration, data protection, and software updates. TCG’s Cyber Resilient Technology Work Group (CyRes) has created the concept of a Cyber Resilient Module (CRM), which can be integrated into different architecture components of devices in order to provide protection, detection, and recovery. Read the full article from Automation World here: https://bit.ly/3UzbrQp #IoT #cyberresilience

6

Maintaining Security for Zones and Conduits in IACS Environments: An IEC 62443 & Industry 4.0 Perspective In the domain of Industrial Automation and Control Systems (IACS), the ongoing conversation about security maintenance is significantly shaped by the IEC 62443 standards. These standards recommend a structured approach to network segmentation through the concept of Zones and Conduits, central to the Defense in Depth strategy. This framework mandates that assets—both devices and systems—are grouped into zones with common security requirements, and that conduits, which facilitate connections between these zones, are rigorously controlled to mitigate security risks. However, in practical applications, achieving uniform security levels across connected zones poses challenges. Traditionally, network segmentation is reinforced by strategic network devices like firewall configurations, yet this setup can inadvertently expose entire VLANs from one zone to another, thereby increasing risk. Use of APIs???? With the advent of Industry 4.0 and the integration of Industrial Internet of Things (IIoT) technologies, the potential attack surface for zones and conduits can be effectively minimized. One innovative approach is the utilization of APIs for secure and selective data transfer across the network, thereby negating the need to expose entire networks. For example, a Programmable Logic Controller (PLC) managing a remote compressor might use an API to directly communicate with the work order system, responding to specific operational conditions and states. APIs facilitate the seamless and secure interaction between diverse devices and systems, enhancing operational efficacy and efficiency. Nonetheless, the integration of IIoT technologies such as IoT-enabled controllers, cloud services, MQTT protocols, IoT hubs, and Unified Namespace introduces new threat vectors. To address these, a robust Security Architecture should be implemented alongside comprehensive Threat Modeling and rigorous Security Testing. These measures are critical to identifying potential threats and vulnerabilities early in the system design process and applying the necessary controls to mitigate them. Through adherence to the IEC 62443 standards, IACS environments can achieve a balanced and effective security posture that supports both current operational needs and future technological integrations. International Society of Automation (ISA)ISA SAFETY AND SECURITY DIVISIONSiemens EnergySiemensHoneywellSchneider ElectricSchneider Electric Digital GridKPMG Lower GulfDeloittePwC Middle EastEY Technology SolutionsEYShiv KatariaOT Security HuddleOT SECURITY PROFESSIONALSMicrominder Cyber SecurityMicrosoft AzureHaysShell EnergyHalianDTS Solution - Cyber Security RedefinedMechsoft TechnologiesHitachi EnergyABBCisco Industrial IoTTÜV Rheinland Middle EastexidaWaterfall Security Solutions

36

6 Comments

🔒 Introducing ISCS – Industrial Security Consulting Service from Pilz 🔒 Ensure comprehensive machinery safety with robust Industrial Security measures, protecting against cyber-attacks, operator misuse, and manipulation. Compliance with Machinery Regulation for CE is essential, but how do you gauge the risk and effects on health, safety, and productivity? This is where our Industrial Security Consulting Service (ISCS) comes in: 🔍 Risk Analysis: We identify security vulnerabilities in your machinery, assess hazards and likelihood of occurrence, and propose appropriate solutions. 🛡️ Security Enhancement: Our four-step service increases Cyber Security, ensures normative and legal compliance, and helps mitigate security incidents. 🌟 Benefits to You: • Identify potential risks and vulnerabilities • Strengthen defenses against cyber attacks • Boost employee safety, cyber security, and machine availability • Verify correct implementation of risk-reducing measures • Ensure machinery protection per Industrial Security requirements • Integral to the EC Declaration of Conformity Stay ahead with continuous re-evaluation of your Industrial Security status to counteract evolving cyber threats. Secure your machinery and safeguard your operations with Pilz ISCS. #IndustrialSecurity #CyberSecurity #MachinerySafety #Pilz #AutomationExperts #SafetyConsulting #Pilz #SpiritofSafety #SafetywithPilz #PilzIndia

18

📣CISA Announces CVE Enrichment Project ‘Vulnrichment’ CISA’s Vulnrichment project is adding important information to CVE records to help improve vulnerability management processes. The US cybersecurity agency CISA on Wednesday announced a new project that aims to add important information to CVE records in an effort to help organizations improve their vulnerability management processes. The project is named Vulnrichment and its goal is the enrichment of public CVE records with Common Platform Enumeration (CPE), Common Vulnerability Scoring System (CVSS), Common Weakness Enumeration (CWE), and Known Exploited Vulnerabilities (KEV) data. https://lnkd.in/eGjzydGd

2

𝗥𝗘𝗕𝗢𝗧𝗡𝗜𝗫 𝗥𝗕-𝗘𝗻𝗴𝗶𝗻𝗲 𝗦𝗼𝘂𝗿𝗰𝗲 𝗖𝗼𝗱𝗲 We release of the source code for the RB-Engine. Our strategy adheres to ISO-certified standards such as NIS2, the European AI Act, and the cybersecurity law to ensure the highest levels of security and quality. This is an important step in supporting AI and IT applications across various sectors, including industrial disturbance operations, energy providers, logistics, governments and heavy industry. This release also contributes to certification in compliance with the AI Act, enabling the traceability of high-risk AI applications. 𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗗𝗲𝘁𝗮𝗶𝗹𝘀 Compilation Time: 4-6 hours on a Jetson in 5-10 watt mode 𝗥𝘂𝗻𝘁𝗶𝗺𝗲 𝗖𝗼𝗺𝗽𝗿𝗲𝘀𝘀𝗶𝗼𝗻: Approximately 45 minutes to 0.023 gigabytes 𝗧𝗼𝘁𝗮𝗹 𝗹𝗶𝗻𝗲𝘀 𝗼𝗳 𝗰𝗼𝗱𝗲: 6.3 million lines in 14 languages, compiled into a single runtime file 𝐑𝐮𝐧𝐭𝐢𝐦𝐞 𝐑𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭𝐬 No Docker required No Kubernetes required No installation necessary Static binary 𝗢𝗽𝘁𝗶𝗺𝗶𝘇𝗮𝘁𝗶𝗼𝗻 Optimized for ARM64 platforms, especially NVIDIA Jetson 𝗞𝗲𝘆 𝗖𝗵𝗮𝗻𝗴𝗲𝘀 Full hardware engine support Encrypted script runtime Packaging of source code into a single file Compression of engine and firmware files Support for TypeScript, Common JS, Python, Go, C, and C++ 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻 The RB-Engine uses AES encryption in ECB mode with PKCS7 padding to ensure secure decryption of its content. In the hardware version, authentication chips from Microchip are used, along with hardware-based SHA256 hashes with e-prom fuse. This means that the customer sets the keys, and the hardware security is then fused, making reconstruction not impossible, but very hard. All crypto chips come with free key slots from the factory. 𝗛𝗮𝗿𝗱𝘄𝗮𝗿𝗲 𝗦𝗶𝗴𝗻𝗮𝘁𝘂𝗿𝗲𝘀 The RB-Engine supports hardware signatures, meaning that not only the hardware but also the AI models, carrier board, and GPU are linked and signed with unique IDs. This ensures a secure and traceable connection of all components. In the coming weeks, we will present our first applications from recycling and government that are already using the RB-Engine. For more information and to access the source code, visit our GitHub link in the first comment.

21

6 Comments

Some thought of the day for SCADA security When discussing the technical risks for SCADA systems within the framework of the IEC 62443 standards, several key areas of vulnerability must be considered. These include, but are not limited to: System Access Control:  - Unauthorized access to SCADA systems can lead to loss of control over processes and potential misuse or sabotage. IEC 62443 emphasizes the importance of robust authentication mechanisms and strict access controls to mitigate this risk. Network Security: - SCADA systems are increasingly interconnected with corporate IT networks and the internet, which exposes them to a wide range of cyber threats. Implementing network segmentation, using firewalls and intrusion detection systems (IDS), and ensuring secure communication protocols are essential strategies under the IEC 62443 standards to shield these systems from unauthorized access and attacks.     Software and Data Integrity: - The integrity of the software running on SCADA systems and the data being processed is critical. Any unauthorized modification could lead to incorrect operational commands being executed, potentially causing physical damage or disruption. Measures like application whitelisting, robust malware protection, and regular integrity checks are advised. Physical Security:  -Ensuring the physical security of SCADA components and the environments in which they operate is fundamental. This includes securing facilities against unauthorized physical access and protecting hardware from tampering. System and Network Resilience: - SCADA systems must be able to resist and recover from cyber attacks. Redundancy, failover capabilities, and regular backups are crucial for maintaining system availability and operational continuity. Patch Management: - Vulnerabilities in software can be exploited by attackers to gain unauthorized access or disrupt system operations. A structured patch management process is vital to apply security patches timely and efficiently, as emphasized in IEC 62443. Incident Response and Recovery: -A well-defined incident response and recovery plan is essential to quickly address security breaches or system failures, minimizing potential damage and restoring system functionality. Awareness and Training: -Personnel involved with SCADA systems need to be aware of potential cybersecurity risks and trained in best practices for securing these systems. This includes regular updates on new threats and continual training on the correct use of security tools and response procedures. These aspects of risk management for SCADA systems are aligned with the requirements and recommendations of the IEC 62443 standards (3-2,3-3), focusing on creating a comprehensive security framework that covers various layers of technical, physical, and administrative controls.

9

A wise advise for OT/ICS Patch Management.

25

Yesterday, Cybersecurity and Infrastructure Security Agency released 4 Industrial Control Systems (ICS) advisories that involved Rockwell Automation, ELECTROLINK S.R.L., Measuresoft and RoboDK. #cybersecurity #icscybersecurity #otcybersecurity #industrialcontrolsystems #operationaltechnology #cybersecurityawareness #criticalinfrastructure #plc #SCADA #criticalinfrastructure #criticalinfrastructureprotection #otsecurity #icssecurity #industrialcybersecurity

4

🚀 “Unlock safety with Pilz! Learn about productive area monitoring, secure AGVS access, and motion monitoring using PNOZmulti 2 and PSENscan. 🌐🔒 We advise machine builders on safeguarding their applications with productive area monitoring as well as implementing a robust security solution to prevent unauthorized access to the AGVS. For freely navigating mobile platforms, Pilz offers a comprehensive safety solution consisting of the safe small controller PNOZmulti 2, safety laser scanners PSENscan, and various signal devices. Machine builders use the motion monitoring function block in the PNOZmulti Configurator to monitor the synchronization of the axes. This program function compares the encoder values of the two axes, enabling conclusions to be drawn about the mobile platform’s direction of movement. With this information, the safe zone switching required in the standards can be implemented dynamically in the PSENscan in up to 70 zones. The zone sets created in the PSENscan Configurator are imported into the navigation computer of the automated guided vehicle system. #TheSpiritOfSafety #safetywithPilz #safeautomationwithPilz #AGVS #AGV #MobileApplications

29

In today's modern factories, a single compromised device can bring your entire operation to a grinding halt. That's why robust Identity and Access Management (IAM) is essential for industrial automation.🏭 Why Choose Pilz Automation UK Identity and Access Management❓ Pilz IAM delivers Safety & Security in one unified system, from securing your machines to empowering employees. Pilz Identification and Access Management (IAM) provides a wide range of package products and software that are tailor-made solutions for the daily challenges of access management. 👷Employee Protection 🪛Liability Protection ⚡Productivity Protection 🌐 Data Protection Ready to Take Control❓ Learn how PILZ IAM can safeguard your industrial automation investment and unlock a new level of operational efficiency. Visit our website to download the PILZ free IAM whitepaper! https://ow.ly/qHXO50RoLkZ #PILZ #iam #IndustrialAutomation #Security #IIoT

17