IT and OT Security Are Different… A Comprehensive Approach Is Essential
Security requirements must be assessed through pre-assessment

As non-face-to-face work becomes widespread during the COVID-19 era and manufacturing companies are eagerly building cutting-edge smart factories for the post-COVID age, e4ds organized an event to examine smart factory trends and the industrial communication networks required to implement them.

e4ds held the '2022 IIoT Innovation DAY' seminar at the '2022 Smart Factory & Automation Industry Exhibition' held at COEX on the 8th.

At this seminar, held to share information on smart factory trends and industrial communication networks for implementing a true digital twin in the post-COVID era, I2 CEO Lee Soon-yeol gave a presentation on the topic of "The Importance and Preparation for Securing Industrial Reliability for Industrial Digital Transformation."

Typical manufacturing site networks are structured hierarchically. They consist of Level 0 (Machines, Equipment), Level 1 (PLC, DCS), Level 2 (SCADA/HMI, EWS, OWS), Level 3 (MES/MOM), and Level 4 (ERP). When a process issue occurred, data had to pass through all of these layers to be updated in the ERP system.

Hierarchies will disappear in the era of the Internet of Things. If AI immediately recognizes a phenomenon, makes a judgment, and takes action, it moves beyond intelligence to achieve autonomy.

There are many challenges remaining before reaching this stage. There is a difference between what is technically feasible and what can be utilized in the industrial field.

CEO Lee stated, “In order to be reliable in industrial settings and commercially utilized, reliability and security must be supported,” adding, “Industrial reliability requires safety, security, resilience, and the protection of personal information and intellectual property; if these are not guaranteed, it is difficult to utilize even the best technology.”

In the case of manufacturing security, both IT and OT security have different characteristics and requirements, necessitating a comprehensive approach. However, excessive security reinforcement may restrict essential functions required in industrial settings. It is crucial to secure security capabilities without interfering with essential functions.

In response to a question regarding the extent to which security should be strengthened cost-effectively—as security measures are directly linked to costs but their effects are not immediately apparent—CEO Lee Soon-yeol replied that the first step is to evaluate the appropriate security level for the company through a preliminary diagnosis. He recommended significantly strengthening security if there is a high probability of a security incident in a particular area and if it occurs would be severe, and lowering the security level in the opposite case.

IEC 62443, an industrial security standard designed to mitigate risks in industrial communication networks, has become a cybersecurity standard across industries. It applies to product and component suppliers, system integrators and suppliers, and asset owners. While Korea presents the standard as a guideline for general manufacturing, it is not yet mandatory. The CEO stated, “We are currently in the guidance phase because mandating it before preparations are complete would hinder economic activity.”