Readying industrial connectivity for cybersecurity requirements

Cyber assaults on industrial operations have resulted in all kinds of mayhem, ranging from minor inconveniences to significant production or data loss, and even physical damage due to kinetic attacks on operating equipment. Unfortunately, due to very long lifecycles, operational technology (OT) cybersecurity provisions for industrial automation have lagged in comparison with developments in commercial and consumer areas of the information technology (IT) world.

One regulatory response aimed at strengthening cybersecurity across digital systems and applicable to both hardware and software products sold into the European Union (EU), is the EU Cyber Resilience Act (CRA). Implementation of the CRA has already started, as it entered into force on December 10, 2024, and manufacturers of all digital products, including legacy, on the EU market are required to report actively exploited vulnerabilities and severe incidents beginning on June 11, 2026. Starting on December 11, 2027, full application of the CRA takes effect for all new digital products placed on the EU market, mandating CE marking, conformity assessment and lifecycle support.

The CRA is designed to strengthen cybersecurity of digital systems throughout their entire lifecycle, from initial design to eventual decommissioning. Notably, the CRA defines what outcomes are required but not how to achieve them. This gap must be addressed through industry standards and best practices, underscoring the vital role of standards organizations.

Even before the CRA, industry has been progressively improving the cybersecurity of OT hardware, software and communications, for example, with the addition of local password storage right on-board instruments. The IT world has had much more experience with handling secure authentication strategies. Fortunately, just like many other IT and commercial-grade technical developments have been adapted for reliable use in demanding industrial-grade OT applications, cybersecurity technologies are following the same path.

FieldComm Group is a standards development organization (SDO) and has actively collaborated with other SDOs for years to establish cybersecure technologies from the industrial communications protocol perspective. Technologies are actively evolving to improve cybersecurity, and FieldComm Group is working to provide the tools and frameworks needed for supporting product suppliers and implementers with CRA compliance.

Identifying cybersecurity needs

The CRA is a wide-ranging initiative generally applying to products with a digital component and connectivity to other devices or networks. It requires secure-by-design development for new products, while a risk-based approach will permit existing products with compensating measures. Consideration for product lifecycle management will provide complete transparency surrounding the features and associated updates. This harmonized approach is intended to make it more straightforward for users to identify and implement appropriate cybersecurity features, resulting in safer and more resilient critical infrastructure, along with modern manufacturing and other digital systems. Products sold into the EU market will need to be CRA-compliant, and there are penalties associated with non-compliance.

One of the most relevant OT cybersecurity standards is IEC 62443, recognized as a global benchmark focused on industrial automation and control systems (IACSs). This standard provides requirements for secure product development, system-level security practices, organizational processes throughout the IACS lifecycle and a structured risk management framework with definition of security levels (SLs). For manufacturers, adopting IEC 62443 practices is a practical way to demonstrate alignment with CRA’s essential requirements (Figure 1).

Cybersecurity challenges for OT applications

Until the past few decades, OT installations were commonly air-gapped systems and largely standalone, a method that provided a degree of cybersecurity protection. However, the ability to interconnect all types of industrial assets together and with IT resources, to improve efficiency, data sharing and decision making, has become a fundamental requirement of modern systems.

Proven IT practices for secure authentication, encryption and layered access management are finding their place in the OT domain to address cybersecurity needs for increasingly connected and networked monitoring and control applications. Because most industrial automation systems integrate a multitude of devices from various manufacturers, often using different communication protocols and even relying on different host systems within a single plant, it is essential that cybersecurity measures are both effective and easy to manage at the enterprise level.

Just as commercial technologies like Ethernet and PCs were successfully adapted for industrial environments, cybersecurity practices originating in IT are now evolving to meet OT’s unique demands for long system lifecycles, uncompromising reliability and seamless interoperability across multi-vendor ecosystems.

Collaboration is central for OT cybersecurity

The Industrial Ethernet Security Harmonization Group (IESHG) was established by FieldComm Group, Profibus & Profinet International (PI), ODVA and the OPC Foundation to address security challenges. Over time, this group has evolved to be called the Industrial Security Harmonization Group (ISHG), hosted by the same four standards organizations but opened to participation from their extended member communities (Figure 2).