3 misconceptions
about industrial security
Steffen Zimmermann's expertise on security in your company
Ransomware, cyberattacks and security standards are unpleasant topics that are often put on the back burner for more important tasks. But if you don’t take an in-depth look at industrial security, you put your company at risk. To help you get started, we spoke with expert Steffen Zimmermann in a podcast and summarized everything you need to know here.
Content
- Misconception 1: "Industrial security is a topic for people in the IT department."
- Misconception 2: "All you need for industrial security is the right hardware and software."
- Misconception 3: "The company is safe."
- What measures are necessary for industrial security?
- 3 tips from Steffen Zimmermann
- Where can I find help on Industrial Security?
Who is Steffen Zimmermann?
- Steffen Zimmermann heads the VDMA's competence center for industrial security.
- He has been accompanying developments in the field of industrial security for 20 years.
- Steffen Zimmermann primarily supports machine and plant builders and policymakers in security issues.
When are companies safe? 3 misconceptions:
Why is industrial security so important and why are companies still not paying enough attention to it? This is mainly due to the widespread but unfortunately wrong image of industrial security:
Misconception 1: "Industrial security is a topic for people in the IT department."
According to Steffen Zimmermann, anyone who does not view cyber security as a management issue is acting with gross negligence. Not only because attacks are becoming more frequent, but also because more and more customers expect fully answered security questionnaires. If the IT security law of the EU or the regulation in Germany is disregarded, the management and not the IT employees are liable. It is therefore no longer sufficient for only IT specialists to deal with the company’s security.
Misconception 2: "All you need for industrial security is the right hardware and software."
You can't buy security.
That’s how Steffen Zimmermann puts it, because technology alone can never be the only solution. For the interaction between people and technology to work, management must invest in more than just technology:
- Products must be securely developed and updateable by the suppliers. Companies should therefore know which partners they can rely on.
- In the event of an attack, a company must be able to rely on the help of the authorities. Therefore, it is important to to build good communication between the authorities and the company in advance.
- Employees are the decisive factor in establishing industrial security. The threat can only be contained through basic training and regular reminders of the measures to be taken. This is because the majority of cyberattacks happen due to a lack of awareness on the part of employees. Phishing emails are clicked, unauthorized USB sticks are used, people work in public - these examples sound almost ridiculous, but they happen far too often and have devastating consequences. Make an investment in your employees and thus in your safety at the same time!
Misconception 3: "The company is safe."
The only sure thing about industrial security is that no matter what is done and bought, it never fully protects against attacks. Industrial security is an ongoing process that can never be completed because technologies and attack methods evolve. Those who feel absolutely safe and do not revise their measures risk greater damage than those who expect an attack and continuously adapt to technological changes.
What measures are necessary for industrial security?
To ensure that you are in a position to take the right measures and entrust employees with the task of looking after the company’s safety on an ongoing basis, four steps are important:
Step 1: Define what you need to protect.
To do this, it is best to start at the top with trade secrets and business processes. The data to be protected can be divided into three areas:
- IT security: everything that concerns the office
- OT security: your own production environment
- Product security: digitally networked products
Step 2: Familiarize yourself with the topic.
You will find many tools, standards and checklists for cyber security online, many of which are even freely available. Take advantage of what’s on offer and work your way through in small steps – then you’re sure to be on the right track!
Step 3: Don't forget: Everyone had to once start.
Some of your colleagues may already be further along in the process, while others, like you, are still at the very beginning. A good opportunity to share experiences and learn from each other is the blended learning training with Dr. Pierre Kobes, the founding father of the IEC 62443 standard.
Step 4: The last and most important step: Don't stop and keep adapting to new developments and standards!
3 Tips from Steffen Zimmermann
If you want to achieve the greatest possible industrial security, you should always be able to answer "yes" to 3 questions:
- Does my backup work?
- Do I have someone who can support me offline in an emergency?
- Have I done everything necessary to ensure that my employees feel well prepared?
Where can I find help on Industrial Security?
- The IT-Grundschutz compendium offers you a good introduction to the topic.
- BSI offers many free tools that can help you.
- SMEs benefit above all from the ISIS12 management system.
- One of the largest and most important standards in IT security is ISO 27001.
- For the topics of safe plant operation and safe product development, ISA/IEC 62443 is very interesting.
Find our more about out Industrial Security Training.
