If companies want to realize the potential of Industry 4.0, cybersecurity and cyber resilience can’t be an afterthought. With industrial cybersecurity still being years behind general IT security, ample organizations and vendors step up efforts to address the challenges.
To advance cybersecurity readiness and awareness in manufacturing and critical infrastructure facilities and processes, the International Society of Automation (ISA) has created the Global Cybersecurity Alliance (GCA).
The founding members are Schneider Electric, Rockwell Automation, Honeywell, Johnson Controls, Claroty, and Nozomi Networks. Schneider Electric initiated the discussions to start an ISA-led global, open, and industry-wide alliance for reasons mentioned below. The International Society of Automation included the other founding members who collaborated to define the goals of the Global Cybersecurity Alliance. Collaboration is also the name of the game at the Alliance, which calls itself a collaborative forum to advance cybersecurity awareness, education, readiness, and knowledge sharing.
Acceleration and expansion of standards join education and advocacy efforts
At the occasion of the announcement of the founding members in July 2019, the Global Cybersecurity Alliance invited more end users, asset owners, automation and control systems providers, system integrators, IT infrastructure providers, and other stakeholders to join the ISA-led Alliance.
Among the additional members, we note identity access management specialist WALLIX, industrial network security company Bayshore Networks, blockchain-protected industrial operations security expert Xage security, and Chinese industrial security player Winicssec Technologies, to mention a few.
The objectives of the Global Cybersecurity Alliance include the acceleration and expansion of standards, certification, education programs, advocacy efforts, and thought leadership. The human and organizational challenges in OT and ICS cybersecurity show that education and advocacy are needed at the level of the individual organization indeed although the education and advocacy focus of the GCA is much broader than that.
Nevertheless, people are key. The ISA Global Cybersecurity Alliance addresses the three aspects of industrial cybersecurity: people, process and technology and developing a skilled and cyber-aware workforce is one of the five objectives of the ISA Global Cybersecurity Alliance (see below).
The Global Cybersecurity Alliance and ISA/IEC 62443 cybersecurity series of standards
The work of the Alliance is founded on the ISA/IEC 62443 cybersecurity series of standards, the consensus-based automation, and control systems cybersecurity standards, which the GCA also aims to extend. Application guides will be developed to assist specific industry verticals in applying the standards.
Schneider Electric started the discussions with ISA as part of its response to the Triton cyberattack early 2018, as Andrew Kling, Industry Automation Product Security Officer & Sr. Director of System Architecture at Schneider Electric, writes in a blog on the launch of the Alliance and why the company behind the EcoXpert channel program where critical power infrastructure, facilities and buildings are omnipresent, from healthcare facilities to industries such as oil & gas or the utility industry overall, to name a few, started the whole initiative (disclaimer: EcoXpert is a partner).
Kling: “Everyone, especially our customers, is affected by an expanding cyber-landscape. New attacks, emerging threats, geopolitical stresses, regulatory pressures, even risk management strategies, such as cybersecurity insurance policies, are creating unique cyber challenges. We need to work together to confront and overcome them”.
Klaus Jaeckle, Chief Product Security Officer at Schneider Electric, emphasized the need for such a collaborative approach at the occasion of the announcement of the Global Cybersecurity Alliance.
Jaeckle: “Over the last few years, global industry has recognized that taking on increasingly dangerous cyber risks can’t be limited to a single company, segment, or region. However, until now, there has been limited ability to respond as a unified whole to these worldwide threats. But by establishing an open, collaborative, and transparent body, with a focus on strengthening people, processes, and technology, we can drive true cultural change.”
Blake Moret, CEO of another founding member, Rockwell Automation, reminds us that cybersecurity is vital for digital transformation.
Moret adds: “It’s critical not only for the protection of information and intellectual property, but also for the protection of physical assets, the environment, and worker safety.”
You can listen to the comments of Klaus Jaeckle and Blake Moret on this page where also Jason Christman (Johnson Controls), Matthew Bohne (Honeywell Building Technologies), Dave Weinstein (Claroty) and Andrea Carcano (Nozomi) share their thoughts.
Joining the Global Cybersecurity Alliance
End-user companies, industrial security specialists, automation providers, system integrators, and all those other previously mentioned stakeholders can join the Global Cybersecurity Alliance to help it realize its objectives of a safer and more secure industrial ecosystem.
As Mary Ramsey, ISA Executive Director puts it: “Through the proliferation of standards and compliance programs, we will strengthen our global cyberculture and transform the way industry identifies and manages cybersecurity threats and vulnerabilities to their operations.”
In a comment on the launch of the open, collaborative platform, ARC Advisory Group Vice President of Research, Larry O’Brien, said ARC applauded the new effort to increase the security of industrial facilities. O’Brien: “Standards and frameworks are valuable, but end users also need the resources to take the guidance provided by standards and put it into practice in real-world plant and OT environments.”
The ANSI/ISA 62443 series of automation and control systems cybersecurity standards, developed by the International Society of Automation, define requirements and procedures for implementing electronically secure automation and industrial control systems and security practices and assessing electronic security performance. The standards approach the cybersecurity challenge holistically, bridging the gap between operations and information technology (OT and IT).
All images and trademarks property of their respective mentioned owners. Images for illustration purposes only.
