Why Cybersecurity Belongs Inside Your Industrial Control Panel

WEBVTT
00:00:00.640 --> 00:00:09.199
Welcome to Eco Ask Why, a podcast that dives into industrial manufacturing topics and spotlights the heroes that keep America running.
00:00:09.359 --> 00:00:16.399
I'm your host, Chris Granger, and on this podcast, we do not cover the latest features and benefits on products that come to market.
00:00:16.640 --> 00:00:28.079
Instead, we focus on advice and insight from the top minds of industry because people and ideas will be how America remains number one in manufacturing in the world.
00:00:32.159 --> 00:00:33.840
Welcome to Eco Ask Why.
00:00:33.920 --> 00:00:35.280
I'm your host, Chris Granger.
00:00:35.359 --> 00:00:41.200
Looking forward to spending some time with you today, and we're going to continue our look into industrial control panels.
00:00:41.520 --> 00:00:50.560
And right now, what we're going to focus on is how you can protect the connected operations that we find in our industrial facilities these way these days.
00:00:50.640 --> 00:00:50.960
Okay.
00:00:51.280 --> 00:01:00.960
Now, there's a simple way to understand the risk, and we're going to try to break this down to help you just encourage you as you grow in your understanding of industrial control panels.
00:01:01.119 --> 00:01:11.760
And if you start thinking about industrial cybersecurity, one way that I found useful is start thinking about the security system of your modern home.
00:01:11.920 --> 00:01:14.959
And sometimes they're called modern modern smart homes, right?
00:01:15.359 --> 00:01:20.959
And before that, go back to your old fashioned house, like when you maybe when you grew up.
00:01:21.599 --> 00:01:24.000
Security there meant just locking the front door.
00:01:24.239 --> 00:01:25.040
Maybe that was it.
00:01:25.280 --> 00:01:27.680
Like the house wasn't connected, right?
00:01:27.760 --> 00:01:35.680
You didn't have uh the threats that we have these days, it seems like, where you have these these big physical, more obvious threats.
00:01:35.840 --> 00:01:43.680
But in a smart home now, uh you have locks, you have lights, you have cameras, thermostats, alarms, everything's connected, right?
00:01:43.760 --> 00:01:45.040
It's all connected through the internet.
00:01:45.359 --> 00:01:50.000
And security becomes a layered concern that we need to be understanding, right?
00:01:50.079 --> 00:01:51.280
And it's continuous, right?
00:01:51.920 --> 00:01:58.640
Secure, your house is secure when you're there, and when you're not there, there's lights, there's there's cameras, there's all sorts of things happening.
00:01:58.799 --> 00:02:01.920
Uh physical lock, we recognize it's no longer enough, right?
00:02:02.000 --> 00:02:03.200
We we want more.
00:02:03.519 --> 00:02:21.520
Uh, and in that case, you need firewalls, you need you need credentials, you need to have the right network and the segmentation setup, and that constant monitoring to make sure that the systems designed to improve convenience uh uh don't just go down and next thing you know, you got an open door for intruders, right?
00:02:21.599 --> 00:02:22.400
We don't want that.
00:02:22.560 --> 00:02:24.800
So in modern manufacturing, it's the same way.
00:02:24.960 --> 00:02:26.240
It's the exact same way.
00:02:26.479 --> 00:02:34.879
Factories have become more connected, and industrial control panels now function like this smart uh home hub within a plant, okay?
00:02:35.120 --> 00:02:42.159
And we understand we need to think through the point where physical operations right now is meeting digital access, right?
00:02:42.800 --> 00:02:43.919
This is come together.
00:02:44.080 --> 00:02:51.680
And just like that smart home, if you don't have that hub intentionally secure, that connectivity can be exposed.
00:02:51.759 --> 00:02:52.800
And we don't want that, right?
00:02:52.879 --> 00:02:56.240
So again, electrical equipment company, we're all about helping you in these areas.
00:02:56.400 --> 00:03:09.039
So if you have some um applications that you would like for us to dig into, we have the resources, we have the experts that can come do that diagnosis and help help you understand at least what your risk points are.
00:03:09.120 --> 00:03:10.719
Okay, so connect with us.
00:03:10.800 --> 00:03:11.439
That's a big thing.
00:03:11.520 --> 00:03:17.520
Connect with us and let us have a conversation because you need to know when connectivity becomes an operational risk.
00:03:17.840 --> 00:03:22.960
Because manufacturing, again, in the middle of a digital transformation, so many things are happening.
00:03:23.120 --> 00:03:29.280
Industrial control panels are increasingly housing Ethernet switches, uh, routers, firewalls.
00:03:29.360 --> 00:03:38.080
You got these modems, you have remote access gateways that connect to PLCs and HMIs and drives and safety systems, all this stuff, right?
00:03:38.800 --> 00:03:49.840
And this is good, but it also enables, you know, real-time productivity, remote diagnostics, predictive maintenance, data-driven optimization.
00:03:50.080 --> 00:04:05.039
And here's the deal: it also removes so much of the old safety net of isolation because think about how old the OT systems they used to be really built and designed around their security through up security, right?
00:04:05.199 --> 00:04:06.800
Systems weren't connected, right?
00:04:06.879 --> 00:04:07.680
They weren't reachable.
00:04:07.759 --> 00:04:11.520
So if that system went down, it just affected that part of the plant, right?
00:04:11.680 --> 00:04:12.639
Not anymore, right?
00:04:12.719 --> 00:04:13.520
No longer anymore.
00:04:13.680 --> 00:04:14.560
Everything is connected.
00:04:14.639 --> 00:04:21.199
Control networks are accessible sometimes intentionally, sometimes unintentionally, and you have this IT infrastructure you got to think about.
00:04:21.360 --> 00:04:30.000
And the result is cybersecurity failures now directly translate into safety incidents or to downtime and the scrap or lost revenue.
00:04:30.160 --> 00:04:31.360
It's a big deal.
00:04:31.519 --> 00:04:37.040
So we need to take some steps to design the secure panels from the start.
00:04:37.199 --> 00:04:39.120
This is what we're going to try to help you with, okay?
00:04:39.279 --> 00:04:44.879
And as we start thinking about this, what are the real risks inside these connected control panels?
00:04:45.040 --> 00:04:47.120
Just need to know what some of those real risks are.
00:04:47.360 --> 00:04:50.639
And it's because this is not just some theory, okay?
00:04:50.879 --> 00:04:54.000
This is operational, this is functional to your plant.
00:04:54.639 --> 00:05:02.319
One of the first big risks is unauthorized access because control panels often provide direct pathways to critical assets.
00:05:02.399 --> 00:05:09.839
Just think about what these control panels are touching again, a the PLC, the HMI, your motion systems, your safety systems.
00:05:10.000 --> 00:05:24.319
And if you don't have proper segmentation or authentic or being authenticated, um, or maybe you don't even have that physical protection in place, access can be gained by external hackers or internal users operating outside of their role.
00:05:24.480 --> 00:05:28.480
Okay, so look, this isn't just an IT breach, guys.
00:05:28.959 --> 00:05:30.319
Don't think about it that way.
00:05:30.480 --> 00:05:32.639
It's someone standing at the controls, right?
00:05:32.720 --> 00:05:33.839
You have to be careful.
00:05:34.079 --> 00:05:36.800
Now, you also have data integrity and process control.
00:05:36.959 --> 00:05:39.920
So manufacturing decisions depend on trusted data.
00:05:40.160 --> 00:05:51.519
So if a sensor uh values or set points of control uh the logic are altered, even in the slightest, the system may operate, but performance can go down.
00:05:51.920 --> 00:05:56.720
And that bad data, when you make those changes, right, that bad data can result in poor quality.
00:05:56.800 --> 00:06:02.720
Maybe your OEE goes down, maybe you're starting to wear your equipment more and more, or you're creating some unsafe operating conditions.
00:06:02.879 --> 00:06:10.319
So an OT, that that integrity matters more than confidentiality because the physical outcomes depend on it, right?
00:06:10.560 --> 00:06:25.600
Now, system disruption and physical consequences are also areas of concern because unlike traditional IT system, OT cyber incidents don't just disrupt screens and files, they stop lines, right?
00:06:25.920 --> 00:06:31.759
Equipment stops moving and it can damage equipment and it can create all sorts of safety hazard.
00:06:31.839 --> 00:06:40.480
So a compromised panel can shut down production for sure, but it could cause uncontrolled behavior in your machinery.
00:06:40.639 --> 00:06:43.680
And downtime isn't always the worst case scenario.
00:06:44.000 --> 00:06:48.959
Loss of control is like if you lose control of your equipment, that is a big deal.
00:06:49.120 --> 00:07:04.560
And this is again why I'm not trying to paint like a doomsday picture here, but we're trying to help you see that industrial control panels are the front line, they are non no longer can be viewed viewed as passive enclosures, they are architectural decision points.
00:07:04.720 --> 00:07:05.439
Think about that.
00:07:05.600 --> 00:07:07.279
Architectural decision points.
00:07:07.439 --> 00:07:12.079
What gets installed in the panel uh and how it's designed determines so much.
00:07:12.240 --> 00:07:25.839
It determines about your network segmentation, it determines about your physical uh uh access limitations, it were it determines your upgrade and patching feasibility, it determines what your long-term cybersecurity posture is going to be.
00:07:26.000 --> 00:07:31.759
So again, effective OT security starts with that intentional panel design.
00:07:31.839 --> 00:07:32.079
Right?
00:07:32.160 --> 00:07:34.959
We're not just adding on fixes, we're not just patching stuff.
00:07:35.120 --> 00:07:37.600
And so much of that comes down to layered, right?
00:07:37.680 --> 00:07:39.600
There's a layered security by design.
00:07:39.759 --> 00:07:43.199
Just like your smartphone and separates guest Wi-Fi.
00:07:43.279 --> 00:07:44.000
Think about that.
00:07:44.399 --> 00:07:52.879
Your guest Wi-Fi from like your security cameras, industrial systems must segment control networks and from enterprise and external uh access paths, right?
00:07:52.959 --> 00:07:57.360
So think about this is including your industrial firewalls, your manned switches.
00:07:57.439 --> 00:08:00.399
Uh, it's this includes secured remote access methods.
00:08:00.480 --> 00:08:03.040
So you're being very defined on what that looks like.
00:08:03.279 --> 00:08:13.120
This is this is setting up encrypted encrypted communications where it's where it makes sense, and then having physical separation of critical systems, like physically having that separation there.
00:08:13.199 --> 00:08:15.439
Okay, so all things to think about.
00:08:15.519 --> 00:08:19.040
Uh you want to be very clear as well on defined authority and oversight.
00:08:19.120 --> 00:08:32.720
So as systems become more autonomous, clear boundaries are essential, and control architectures uh must must really be clear on what decisions automation can make versus when does human intervention need to come in?
00:08:32.799 --> 00:08:34.559
And what does an override look like?
00:08:34.720 --> 00:08:38.240
And if it override happens, how is it logged and how is it audited?
00:08:38.320 --> 00:08:46.080
Okay, so all these things start running together because uh security is is as much about the governance as much it is about the technology.
00:08:46.240 --> 00:08:48.399
You have to have the processes in place.
00:08:48.879 --> 00:08:54.960
So as we think about this, the life cycle support, and and and this is not just a one-time deal.
00:08:55.120 --> 00:09:04.320
This is not when you think cyber cybersecurity, it isn't a commissioning activity, it's ongoing life cycle responsibilities.
00:09:04.639 --> 00:09:10.639
Panels they these days have to be designed with with the ability for updates and patching.
00:09:10.799 --> 00:09:16.000
They need to have the tons of documentation and traceability to understand what goes who and where and why.
00:09:16.159 --> 00:09:24.080
It needs to have audits and standard compliance, and then ultimately thinking forward about future expansion without creating uh any new exposure.
00:09:24.159 --> 00:09:26.399
Like if you want to add this equipment to the future, that's great.
00:09:26.639 --> 00:09:29.759
Is that gonna be an access point for cybersecurity threat?
00:09:29.919 --> 00:09:31.519
These are what we need to start thinking about.
00:09:31.679 --> 00:09:38.960
And the human factor is such a big deal because most secure systems fail if people can't work with them.
00:09:39.600 --> 00:09:41.519
We're gonna find a way to bypass it, right?
00:09:41.679 --> 00:09:46.080
So operators and maintenance teams interact with this equipment every day.
00:09:46.240 --> 00:09:53.440
So if security controls are unclear or maybe they're it causes too much friction, or they're just they're poorly explained.
00:09:53.600 --> 00:09:54.000
Guess what?
00:09:54.159 --> 00:09:56.240
They will try to find a way around it.
00:09:56.320 --> 00:10:14.960
And that's why OT security has to be tied to training as well, to make sure that the people understand the workflows, to make sure they understand their their access points of what they have access to and what they don't have access to, and and ultimately uh has the safe operation uh design under pressure.
00:10:15.120 --> 00:10:24.159
So the a secure system has to be, guys, has to be one that people understand first and foremost and trust.
00:10:24.399 --> 00:10:30.720
Because if they don't understand it, they don't trust it, they're gonna do all they can to circumvent it, and that's when things happen.
00:10:30.799 --> 00:10:32.720
That is where we have to be super careful.
00:10:33.039 --> 00:10:40.320
So, again, it's all about building secure, resilient systems because connectivity is not the image, is not the enemy here.
00:10:40.559 --> 00:10:44.480
Poorly governed connectivity is that's a big deal.
00:10:44.720 --> 00:10:53.360
And manufacturers out there, if you're treating cybersecurity as a core design principle, not something that's like absolute as an afterthought, and then you're like, oh, yeah, we need to do this.
00:10:53.519 --> 00:10:59.360
But if you think of it as a core principle, you're better positioning yourself, okay, because you're gonna be able to scale much better.
00:10:59.440 --> 00:11:06.879
You're gonna be able to adopt new solutions so much better, and you're gonna be able to protect uptime and safety, which is ultimately what we're all about.
00:11:07.039 --> 00:11:17.279
And we're partnering, electrical equipment company, we're partnering with manufacturing manufacturers right now to design and support secure, resilient industrial control solutions.
00:11:17.519 --> 00:11:22.720
Think about from enclosure design to component selection to network architecture to modernization.
00:11:22.879 --> 00:11:23.840
This is what we do.
00:11:24.000 --> 00:11:28.080
This is how we step in and serve at us at a significantly high level.
00:11:28.320 --> 00:11:32.720
So look, great way to connect with us, go to ecoonline.com.
00:11:33.679 --> 00:11:38.720
There we have opportunities for our labs, and we have labs all throughout our geography.
00:11:38.799 --> 00:11:48.399
So wherever, if you're listening to this podcast and you're within our service area, there is a lab close to you within, I would say, reasonable driving distance.
00:11:48.639 --> 00:11:50.000
Get connected with us.
00:11:50.159 --> 00:11:50.639
Come in.
00:11:50.720 --> 00:11:52.320
Let's have let's let's bring you in.
00:11:52.480 --> 00:11:57.279
Heck, we'll we'll buy you a sandwich, we'll sit down, we'll have a conversation, and let's talk technology.
00:11:57.440 --> 00:11:58.879
Let's talk and see your project.
00:11:58.960 --> 00:12:01.200
Let's talk and see what your applications are.
00:12:01.360 --> 00:12:05.039
And then from in our lab environment, do some testing.
00:12:05.200 --> 00:12:08.159
Do some throw some things against the wall, see what sticks, right?
00:12:08.480 --> 00:12:20.159
You have a good better feel for this technology, particularly for your industrial control panels, so that when you make the decision to implement it in your plant, you're not just coming off a uh a YouTube video.
00:12:20.320 --> 00:12:22.240
You have real-world experience.
00:12:22.320 --> 00:12:31.519
And that's what we're trying to provide you at Electrical Equipment Company, is the opportunity to get those to get those reps before you actually bring it into the facility.
00:12:31.679 --> 00:12:32.879
And that's a big deal.
00:12:32.960 --> 00:12:38.559
And that is why we made the investment in these labs, and we highly encourage you to check them out and come see us.
00:12:38.720 --> 00:12:54.159
In fact, in this podcast, there is a link to if you're in Virginia or if you're in in the Carolinas, wherever you find yourself, there's a link where you can schedule time directly to come in, visit our labs, and have these conversations because that's where the rubber meets the road.
00:12:54.240 --> 00:12:56.960
And I'll tell you, our team of experts, they are absolutely incredible.
00:12:57.039 --> 00:13:01.759
They're smart, they're brilliant, they're amazing, they're ready to serve, they're ready to help.
00:13:01.840 --> 00:13:03.759
So go check that out in the show notes, okay?
00:13:03.919 --> 00:13:05.759
So that is it on cybersecurity.
00:13:05.840 --> 00:13:06.720
Hopefully, you enjoyed that.
00:13:06.799 --> 00:13:11.440
We're just trying to do these episodes just to give you some insights, some things to think about.
00:13:11.600 --> 00:13:13.360
Hopefully, you're being encouraged by it.
00:13:13.519 --> 00:13:18.080
If you want to uh connect with us again, ecoonline.com or we're on LinkedIn.
00:13:18.240 --> 00:13:22.799
If you check uh search for Electrical Equipment Company on LinkedIn, that's a great way to connect with us there.
00:13:22.879 --> 00:13:24.000
We have a lot of followers there.
00:13:24.080 --> 00:13:28.320
We try to put out information on a regular basis on our LinkedIn profile.
00:13:28.480 --> 00:13:31.039
Uh, and other than that, we'd love to see you at one of our branches.
00:13:31.120 --> 00:13:34.240
So, yeah, if you're in our service area, connect with us, come in.
00:13:34.320 --> 00:13:45.039
Again, look, we'll love to buy you a sandwich and sit down and just talk about what's going on in your industrial facility and see how we can serve and hopefully help you uh through your modernization goals.
00:13:45.120 --> 00:13:45.600
All right.
00:13:45.759 --> 00:13:46.720
So have a great day.
00:13:46.799 --> 00:13:48.000
Thank you so much for listening.
00:13:48.159 --> 00:13:51.279
And um, we just enjoy doing this and sharing this information.
00:13:51.519 --> 00:13:54.399
Hopefully, you're finding value in it and uh share it with others.
00:13:54.559 --> 00:13:57.200
Uh, give us a rating review if you don't mind, that'd be great.
00:13:57.360 --> 00:14:01.919
And at the end of the day, just remember to keep asking why.
00:14:03.200 --> 00:14:05.759
Thank you for listening to Eco Ask Why.
00:14:05.919 --> 00:14:09.519
This show is supported ad-free by Electrical Equipment Company.
00:14:09.759 --> 00:14:16.320
EECO is redefining the expectations of an electrical distributor by placing people and ideas before products.
00:14:16.720 --> 00:14:19.679
Please subscribe and share with your colleagues and friends.
00:14:19.919 --> 00:14:24.159
Also leave comments, feedback, and any new topics that you'd like to hear.
00:14:24.399 --> 00:14:30.799
To learn more or to share your insights, visit ecosy.com dash e-d O.
00:14:31.279 --> 00:14:34.000
A S A S W H Y.