Cybersecurity diagnosis workshop in an industrial automation environment at Basque Industry 4.0

The Basque Country’s flagship Industry 4.0 event, Basque Industry 4.0, has run this year a cybersecurity day, viewed as an essential Industry 4.0-enabling technology within the new level of organization and control running through the whole value chain of the industrial sector, from technical and operational specs to the order, production, delivery, support, maintenance and final recycling, taking in all stakeholders along the way.

During the congress José Valiente, Director and Communications and Coordination Manager of Spain’s Industrial Cybersecurity Center (Centro de Ciberseguridad Industrial: CCI), and Javier Zubieta, Marketing and Communications Manager of GMV’s Secure e-Solutions sector, ran a workshop based on a practical case, designed to obtain precise knowledge of the cybersecurity state in an industrial facility, doing so by identifying the weak points and coming to a proper understanding of the cyber-risks posed to the facility in question. Both experts proposed a series of actions to be taken onboard for organizations to improve their cybersecurity. The special requirements of environments of this type also have to be factored into the equation, guaranteeing at all moments the proper working of the systems involved and the production process, according to the particular specifications of each case.

The workshop, structured to apply a cybersecurity diagnosis in an industrial environment, was keenly received and actively participated in. In the first part Valiente introduced the various industrial processes and the risks posed by industrial automation. Zubieta then explained the methodology for a complete cybersecurity diagnosis, analyzing each one of the component phases: preparation, fieldwork, drawing up the report and presenting the results.

The professionals running services of this type have to be experts in unearthing and dealing with vulnerabilities, as applied in traditional IT and systems of all types, then of course factoring in the special idiosyncrasies of industrial environments. Technical capabilities apart, however, other skills are equally crucial here, like communication. Compiling of the necessary information involves holding many interviews of a varied range of persons, who may not always be cooperative. The professionals must therefore be capable of explaining things simply, without technical overkill and with total transparency about why certain information is needed and what is to be done with it. The overarching aim, after all, is to optimize an industrial plant’s production by minimizing cybersecurity risks.