The Cyber Resilience Act introduces new requirements for connected digital products. Herbert Koebel, Senior Expoer R&D Software at Leuze, addresses these requirements through systematic threat analysis, secure sensor architectures, authenticated access and security updates throughout the planned product lifecycle.
Cybersecurity for connected industrial systems.
This is particularly important for industrial automation: In many industrial environments, legacy systems operate alongside modern digital systems. As machinery and control systems usually remain in use for many years, vulnerabilities can persist for a long time. At the same time, as connectivity increases, so does the attack surface. Even minor security vulnerabilities can result in production downtime or the loss of sensitive operational data. This is exactly where the CRA comes in: It is designed to ensure the security of devices with digital components – including many Leuze sensors – during development, operation, and throughout the entire product lifecycle. An important factor here is the ability to receive updates. The CRA requires that security updates be technically feasible and that manufacturers make them available as needed. Users thus benefit from products that are developed, operated, and supported in accordance with the latest security standards.
How manufacturers implement the requirements.
Leuze began integrating the CRA’s requirements into its development and production processes at an early stage. The company’s many years of expertise in the field of safety – that is, workplace safety and personal protection – facilitated its expansion into security processes that ensure the protection of systems and networks against external attack scenarios. Both fields require comparable strategies and processes. The cornerstones of implementation are:
- Security by design – digital products are developed in accordance with cybersecurity’s current state of the art. In the context of sensors, this specifically means that their architecture has been enhanced for security and includes, among other things, secure boot and file systems: Upon startup, the loaded software is validated and verified using security features on the device hardware. Data on the sensors is protected against tampering, and the system architecture enables encrypted data transmission over the sensors’ communication channels.
- Security by default – the factory settings are designed to be cyber-secure by default, and all optional interfaces are disabled. Every user access must be authenticated. Sensors can be reset to factory settings at any time, and customer-specific data can be deleted.
- Update capability – digital products in operation can be updated to the latest security standards. Where appropriate, updates are enabled via the process interface. If an update fails, the system reverts to the previous secure state.
Cyber Resilience Act: Security as an integral part of Leuze sensors.
How the CRA Is changing product development: Security considerations are incorporated into every phase of the development process for new sensors. This includes:
- Systematic threat analysis: Leuze creates a risk matrix that examines and evaluates potential attack scenarios.
- Minimizing attack surfaces: Strict security requirements are integrated right from the product development stage.
- Providing security updates: Leuze defines lifecycles for the entire service life of its sensors. These lifecycles determine the duration of support and govern product succession. Leuze ensures that customers receive regular updates throughout the products’ planned service life. These updates ensure functionality and address identified vulnerabilities. In addition, mechanisms are being developed to enable the simultaneous updating of all Leuze products within a system.
- Documentation: Comprehensive documentation is created for each product to help customers use them safely.
- Vulnerability management and reporting: Leuze has established processes to identify and manage vulnerabilities and ensure rapid reporting in the event of an emergency within the timeframes specified in the CRA.
Supporting CRA implementation.
As a partner for secure sensor solutions, Leuze guides product users through the transition period until the CRA is fully implemented. The sensor manufacturer provides information on the requirements and shares best-practice approaches. Customers receive guidance on their questions regarding the CRA – from selecting suitable products to ensuring their safe integration into existing systems. Information services include:
- Customized consultation: Experts are on hand to assist customers in evaluating their systems and components.
- Application recommendations: Leuze provides specific guidance on how to operate sensors and control systems safely.
- Documentation support: Customers receive assistance in preparing the necessary technical documentation.
- Information on reporting procedures: Leuze explains how to report security incidents and what steps to take in the event of an emergency.
@LeuzeUK @LeuzeUSA @EU_Commission @mepaxIntPR #EUR_Lex
