Industrial Revolution 3.0

They say history repeats itself and that holds true with revolutionary development. The malware industry has advanced so much that antique ideas are relevant again.

They say history repeats itself and that holds true with revolutionary development. Take, for instance, a modern class of malware such as Rootkit or Bootkit. They are concealing their presence in infected systems – invisible viruses of sorts. But in the late 20th century such viruses already existed, and the principle of their work was similar to those used in the modern rootkits and bootkits. The malware industry has advanced so much that antique ideas are relevant again.

But when the scientific and technological revolutions occur, many old principles fade away for good –  they don’t answer to the new demands. Those that failed to attune are falling off the market irreversibly. James Hargreaves invented the Spinning Jenny, a multi-spindled spinning frame. If you were still on the spinning wheel, your performance would be six times slower than modern methods, your cloth more expensive and much worse quality, and your clients wouldn’t need you anymore after experiencing the new quality.

The latest invention to spur a new industrial revolution is the Intenet. While the Internet itself had been invented long ago, only quite recently has it become a part of production processes. It immediately gave birth to a new phenomenon – “Enterprise 4.0”, an enterprise which uses cloud technologies, big data, etc., to improve its performance and output.

For those who well know how the traditional industry works, Enterprise 4.0 may be a hard thing to understand. Take any complex unit – a machine tool, an elevator, or a major pipeline valve. These are sophisticated devices that should remain working 24/7, throughout the year. In order to ensure it, regular servicing is required, with planned termination periods.

But that’s not the optimal approach with new technologies available. Routine maintenance may be conducted too early, the device might continue to work for an extra six months, or it could go out of commission a week ahead of the planned maintenance. Things happen. But what if the unit can report its status itself when it needs to be serviced or terminated?

That’s where Internet and Big Data can help. Let’s retrofit the units with transducers, connect them to the Web, and allow them to deliver the data on the units’ status to the analysis center. Based on practical experience and the data gathered from other units, it is decided whether maintenance is required.

We can stop the unit only when it is necessary and the overall performance of the unit is improved simply because it is now connected to the Web!

Some manufacturers do it that way: equip their hardware with the necessary transducers and controllers for performance improvement. But they forget that a revolution has occurred and times are different. One does not simply hook a pre-Internet unit to the Web without consequences.

Quite recently all industrial equipment – hardware, connectivity protocols, etc. – were designed with safety in mind. If it is safely designed, it means that as long as safety procedures are maintained there won’t be any failures, and neither people nor ecology will fall victim.

Enterprise 4.0 acquired a new safety dimension – an information security. But the engineers who follow the “pre-Revolution” age design principles often overlook this. And the consequences may be (and sometimes are) pretty dire.

Within the new generation of enterprise, computers fully laden with digital data aren’t the only things plugged into the web – so are the devices controlling the “real” production processes – oil delivery, car assembly, steel smelting, electricity production, etc. It’s not difficult to imagine the consequences of a successful cyberattack on them.

How to avoid this? In the next few articles we’ll cover various aspects of securing the data of industrial objects and, specifically, the critical infrastructure. But the most important and foremost thing for the industrial equipment manufacturers is to acknowledge that the new devices should be designed in a novel way, keeping in mind not only functional safety, but information security as well. It would be prohibitively expensive, complicated, or even flat-out impossible to retrofit an industrial unit with additional security tools if it is designed without taking the modern environment and operating conditions into account.

Imagine there is a vulnerability discovered in a controller for a CNC machine-tool, or a powerplant switch-yard. How long would it take to fix it? Probably quite some time since the operating organization reasonably assumes it doesn’t work with websites; it has serious equipment inaccessible by the hackers. And the backlash may be disastrous.

Until the manufacturing industry accepts that the Internet is more than just another neat tool, that it is the revolution that brings new opportunities but also new risks, enterprise security will be deteriorating.

The post author is Head of Future Technologies Projects, Future Technologies Projects Development at Kaspersky Lab. 

More information on Kaspersky Lab Critical Infrastructure Protection & Industrial Security is available at https://www.kaspersky.com/industrial-security-cip

Tips
Sign up to receive our headlines in your inbox
  • For all other countries