Software, Security and the IIoT

Much has been written in this space and elsewhere about the productivity benefits of Industry 4.0 and the security challenges inherent with Internet-based data acquisition and control of industrial IoT systems. That sentiment was echoed again in a recent article published by TechTarget, Critical IIoT Security Risks Cloud IoT’s Expansion into Industry​​​​​​​. The article noted the emergence of integrated industrial controllers that operate and monitor the modern plants and manufacturing equipment and their evolution to networked devices using Internet technology and protocols – both cloud-based and on premise – that form the basis for the advances made in the Industry 4.0 environment. The article went on further to point out the most significant security risks characteristic of this new class of IIoT systems:

• Data security: In the past, security for industrial control systems was implemented mainly by limiting physical access to the hardware and software that drive the systems. With IIoT, those protections are eliminated, and nefarious actors have access to a wide attack surface in which to tamper with equipment or steal private data and Intellectual Property.
• Network security: Because IIoT encompasses the most critical infrastructure sectors, such as electrical power grids, transportation control centers, and telecommunications, damage and disruption by malicious actors can occur on a large scale.
• Nation-state risks: IIoT systems are also attractive targets for nation-state actors capable of exploiting the many vulnerable entry points in these connected environments.
• Supply chain risks: Many of the parts needed to build IIoT devices are sourced from outside of the United States, and there is no guarantee that these components haven't already been compromised by the time they are incorporated into the finished device.

In the IIoT, software is the key enabler for configuring, managing, and monitoring the required functions and applications of Internet enabled devices used in manufacturing operations. Software can also provide a competitive advantage and market differentiator. As such, not only should proprietary software be protected against theft (illicit copying), reverse engineering, and counterfeiting, but also against malicious tampering, manipulation, and even sabotage that might not just damage equipment, but also put human lives at risk. Creative software license management can also help reduce production costs and empower producers to launch new business models and expand their portfolios with minimal effort.

In our white paper, CodeMeter in the Automation Industry, we discuss the integration of Wibu-Systems’ CodeMeter protection, licensing, and security technology to safeguard machinery and industrial control systems and enable new business opportunities by orchestrating a vast array of licensing models, like pay-per-use, subscription, features on demand, and others. For example, effective license management solutions can control access and usage rights for certain functions or limit access to specific times. Features-on-demand license models can cater to individual demands of the customer while allowing the machine producer to keep their basic machine portfolio down to a manageable range of models.

Security at the foundation of the machine or plant engineering process extends to controls and development environments, hardware, runtime environments and operating systems, and the programming language and applications. The integration of protection technology can prevent the copying of machine designs or the illicit transfer of essential know-how to competitors. The negligible additional investment can thus prevent potential damages and monetary losses to the company. Protection against reverse engineering stops the illicit copying of their designs and helps protect both market share and brand image. Even the operators and users of the machines will benefit: Built-in integrity protection prevents sabotage and manipulation of the software. The system can also be used for scenarios in which production runs need to be limited to specific orders. The plant operator can offer to limit batch sizes in this manner as an additional service for the client, e.g. protecting against illicit ‘third shift’ production of luxury goods