Enisa Industry Iot

# Req Nr Description Security Domain Threats Reference Author
1 GP-TM-59 Create and apply a comprehensive backup plan, including provisions for periodic testing, tailored to different types of assets. Perform backups before updates and other important changes to the system. For some assets, backups should be made regularly with the frequency depending on the asset type. When making a backup, verify whether it will work properly (perform a test of the backup). To do so, you may check hash or use a dedicated application. Configuration Management Failures / Malfunctions Outages Disasters NIST NIST ISO IEC NIST ISO IEC View
2 GP-TM-58 Harden IIoT solutions and include this in the change management policy. Ensure that all unused network ports, protocols and unnecessary functionalities of the devices are disabled and that test/debug features are locked. Hardening should include, where applicable, operation system, software, firmware and application. In addition, perform periodic checks of critical samples at least annually and in case of a major change to the system. Configuration Management Eavesdropping / Interception / Hijacking Physical attacks Failures / Malfunctions Siemens OWASP (Open Web Application Security Project) NIST OpenAI and others ENISA Cloud Security Alliance Symantec IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) NIST IIC (Industrial Internet Consortium) View
3 GP-TM-57 Develop a dedicated procedure for impact analysis. Before implementation of change in the system, perform an analysis to determine the criticality of the considered change. Test changes to the configuration that may exert an impact on operations and precede them with risk analysis. Configuration Management Unintentional damages (accidental) NIST IIC (Industrial Internet Consortium) NIST ISO ISA IEC View
4 GP-TM-56 Implement and document changes in configuration according to a change management policy developed by the organisation based on risk analysis. This policy should include responsibility (i.e. system owner, approvers, etc.) and security aspects. The business owners of assets should accept it. Configuration Management Unintentional damages (accidental) IIC (Industrial Internet Consortium) NIST NIST IIC (Industrial Internet Consortium) ISO NIST ISO IEC IEC SANS Institute NIST View
5 GP-TM-55 Implement a mechanism and supporting tools that allow for configuration management. This mechanism should enable tracking of changes and recreation of the state of the system from before the change. Configuration Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Siemens IIC (Industrial Internet Consortium) NIST NIST ISO NIST IEC ISA IEC View
6 GP-TM-54 Establish baseline security configurations tailored to different types of assets. Within these baselines include, among others, information about system components (e.g. required software that is installed with version numbers and patch information on operating systems, whitelists of applications, required ports, protocols, functions and set parameters), network topology, logical placement within the system architecture, etc. In addition, establish procedures for reviewing and creating new baselines, as organisational information systems change over time. Configuration Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) NIST NIST NIST IEC Huawei IEC NIST View
7 GP-TM-53 Monitor the availability of the IIoT devices in real time, where technically feasible. Monitoring and auditing Nefarious Activity / Abuse Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Disasters IEC Smart Card Alliance ETSI (European Telecommunications Standards Institute) NIST NIST IoT Alliance Australia IIC (Industrial Internet Consortium) View
8 GP-TM-52 Perform periodic reviews of access control privileges and asset configurations at least annually and in case of a major change in the system. Monitoring and auditing Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions NIST OWASP (Open Web Application Security Project) NIST NIST ENISA IIC (Industrial Internet Consortium) ISO NIST ISO Huawei NIST View
9 GP-TM-51 Collect security logs (i.e. change logs, fault logs, performance logs) to enable analysis of events. To the extent possible, event logs should include user IDs, system activities, dates, times and details of key events (e.g. log-on and log-off times), use of privileges, etc. Ensure that the logs are filtered, correlated and analysed in real-time using a dedicated tool, e.g. a SIEM class solutions, for example within a Security Operation Centre (SOC). If it is not technically feasible, review logs manually on a regular basis. Take further actions based on risk analysis. Also, ensure that logs are accessible through a commonly accepted interface and stored for a defined period. Monitoring and auditing Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions IEC IIC (Industrial Internet Consortium) VDC IEC SANS Institute Siemens IIC (Industrial Internet Consortium) OWASP (Open Web Application Security Project) NIST ENISA Cloud Security Alliance IoT Security Foundation NIST View
10 GP-TM-50 Implement passive monitoring solution in the IT and OT environments to create industrial network traffic baseline and monitor anomalies and adherence to the baseline. Deploy the monitoring solution on the Access Layer to capture relevant internal traffic. Monitoring and auditing Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Cloud Security Alliance Symantec Federal Office for Information Security (BSI) Siemens Symantec IIC (Industrial Internet Consortium) LNS NIST Huawei NIST IEC SANS Institute NIST View
11 GP-TM-49 Ensure the proper and effective use of cryptography to protect the confidentiality, authenticity and/or integrity of data and information (including control messages), in transit and in rest. Ensure the proper selection of standard and strong encryption algorithms and strong keys and disable insecure protocols. Verify the robustness of the implementation. Networks, protocols and encryption Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking AT&T Cybersecurity Insights BITAG (Broadband Internet Technical Advisory Group) Cloud Security Alliance EC Alliance for Internet of Things Innovation (AIOTI) EuroSMART (the voice of the Smart Security Industry) Federal Office for Information Security (BSI) GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) Infineon International Telecommunications Union Internet Engineering Task Force (IETF) Internet Engineering Task Force (IETF) Internet Research Task force (IRTF) IOT-A (Internet of Things Architecture) ISACA ISO ISO NIST NIST NIST NIST oneM2M OWASP (Open Web Application Security Project) Software Assurance Forum for Excellence in Code (SAFECode) - NPO Symantec Trusted Computing Group (TCG) View
12 GP-TM-48 Ensure a secure environment for key exchange and key management while avoiding sharing cryptographic keys across multiple devices. Networks, protocols and encryption Eavesdropping / Interception / Hijacking OWASP (Open Web Application Security Project) BITAG (Broadband Internet Technical Advisory Group) Cloud Security Alliance NIST IoT Security Foundation ISO Huawei GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
13 GP-TM-47 If possible, limit the number of protocols implemented within a given environment to ensure manageability of the system. Also, disable all unused default network services. Networks, protocols and encryption Eavesdropping / Interception / Hijacking Physical attacks Outages Siemens Cloud Security Alliance BITAG (Broadband Internet Technical Advisory Group) NIST IEC SANS Institute View
14 GP-TM-46 Ensure security capabilities and interoperability between protocols when implementing different protocols for various devices within the same system. One of the example methods to achieve this is by using dedicated gateways that provide translation of protocols. A gateway can translate an insecure protocol into a modern, secure protocol before sending it further, thus reducing the attack surface. Networks, protocols and encryption Failures / Malfunctions Outages Cloud Security Alliance ENISA IIC (Industrial Internet Consortium) IEC GSMA (Global System for Mobile Communications) SANS Institute View
15 GP-TM-45 For IIoT solutions implement proven-in-use protocols (rather than recently introduced ones) with known security capabilities, based on standards and technical recommendations. Choose solutions that use protocols that have been proved secure or tackle previous security issues (e.g. TLS 1.3) and avoid protocols with known vulnerabilities (e.g. Telnet, SNMP v1 or v2). Networks, protocols and encryption Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions Outages OWASP (Open Web Application Security Project) GSMA (Global System for Mobile Communications) BITAG (Broadband Internet Technical Advisory Group) NIST ENISA Cloud Security Alliance IoT Alliance Australia IIC (Industrial Internet Consortium) Huawei Cloud Security Alliance IoT Security Foundation NIST IEC NIST View
16 GP-TM-44 Isolate safety networks from business and control networks. If this is not possible due to business requirements, ensure that solutions for network traffic filtering are in place. Networks, protocols and encryption Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Homeland Security IEC IEC IEC IIC (Industrial Internet Consortium) International Telecommunications Union NIST NIST View
17 GP-TM-43 Follow micro segmentation approach that is based on building within the same network (e.g. IT or OT) small islands of components that communicate only inside these islands. Control traffic between different segments using a firewall. While segmenting the network, use the principles of least privilege and need-to-know. This means that only the necessary system-to-system communication using necessary protocols on necessary ports should be allowed and the rest should be disabled. In case of an infection, isolated micro-segments prevent it from spreading further onto the network. Micro segmentation within networks can be achieved through: - using VLANs for each micro segment, - physical network separation or - network traffic filtering at various layers, such as network layer filtering, state-based filtering, port and protocol level filtering, application filtering. Networks, protocols and encryption Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking NIST IoT Alliance Australia IIC (Industrial Internet Consortium) LNS IEC SANS Institute IEC IEC View
18 GP-TM-42 Segment industrial plants networks based on a pre-defined zoning model (e.g. into Office Layer, Manufacturing Layer and Control Layer according to the Purdue Model). Ensure that direct traffic between Office and Control layers is prohibited - these networks should always communicate with each other through a De-Militarised Zone (DMZ) with a 0-Trust rule. Traffic between each of the zones should always be controlled by a firewall. Locate shared infrastructure services which serve Manufacturing and Control networks (e.g. DC, DNS, NTP, Backup server, AV server, Jump Server) obtaining or providing data to the Office in a De-Militarised Zone (DMZ). Ensure dedicated network infrastructure (physical separation) for critical systems in the Control Layer. Networks, protocols and encryption Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Siemens NIST ENISA IoT Alliance Australia IIC (Industrial Internet Consortium) LNS ISO IEC Huawei SANS Institute IEC SANS Institute NIST View
19 GP-TM-41 Ensure security of communications channels related to IIoT solutions. Encrypt communications in case of important data (e.g. configuration, personal data, data for control purposes), where it is possible to do so without affecting safety, availability and performance. Networks, protocols and encryption Eavesdropping / Interception / Hijacking OWASP (Open Web Application Security Project) BITAG (Broadband Internet Technical Advisory Group) Cloud Security Alliance GSMA (Global System for Mobile Communications) NIST OpenAI and others IoT Alliance Australia International Telecommunications Union IoT Security Foundation IIC (Industrial Internet Consortium) NIST GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
20 GP-TM-40 Within access control, include physical access to buildings, areas, rooms and cabinets locations (e.g. by means of walls, fences, electronic/mechanical locks and casings). Periodically revise access rights (especially to critical areas), limit physical access only to the required minimum and segregate it based on roles in the company. Ensure that the departure of an employee or change of a role within the company is followed by a prompt change/termination of physical access (e.g. physical access system can be connected to the HR system). Consider implementing tracking and alarm systems for supporting physical security. Access Control Physical attacks Cloud Security Alliance IIC (Industrial Internet Consortium) NIST NIST NIST Cloud Security Alliance IoT Security Foundation ISO NIST ISO IEC IIC (Industrial Internet Consortium) NIST View
21 GP-TM-39 In case of extensive and diversified networks with a large number of devices, adopt the Privilege Access Management (PAM) solution to manage elevated privileges (i.e. administrator privileges) in an orderly manner. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Cloud Security Alliance Cloud Security Alliance NIST ISO IEC View
22 GP-TM-38 Implement in the device and/or use an account lockout functionality that activates after the number of failed login attempts exceeds the value of a set parameter. This also applies to cloud and mobile interfaces. Develop a policy to specify details such as the number of allowed attempts and time of the lockout. Access Control Nefarious Activity / Abuse OWASP (Open Web Application Security Project) Cloud Security Alliance IoT Alliance Australia NIST IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
23 GP-TM-37 Avoid using shared accounts for access to IIoT devices and systems. Create individual accounts for every user whenever possible, as this will enable tracking of the performed actions to a specific person. If shared accounts are used, change passwords periodically (e.g. every 90 days) and in case of personnel changes within a shared account group (e.g. when an employee leaves). Also, consider deployment of additional compensating controls (e.g. segregation of duties, real-time monitoring tools such as industrial IDS). Access Control Physical attacks Unintentional damages (accidental) VDMA ISO ISO IEC IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
24 GP-TM-36 Apply the least privilege principle when setting user privileges. Ensure that in an environment with multiple users, roles are properly segregated and approved by the right person. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Siemens IIC (Industrial Internet Consortium) OWASP (Open Web Application Security Project) NIST ENISA NIST ISO IEC Huawei IEC NIST GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
25 GP-TM-35 Change default passwords and usernames during commissioning/first use. Use strong passwords aligned to internal password complexity policy and require setting of a new password after a defined period. Device manufacturers and cloud services providers should give these options to users. Have in mind that passwords for industrial control systems should not be too complex to ensure immediate access when needed. When complex passwords are used, organisations should ensure that the frequency of password change is not too high. Ensure that secure passwords recovery mechanisms are in place. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks OWASP (Open Web Application Security Project) ENISA Cloud Security Alliance Cloud Security Alliance IoT Alliance Australia IoT Security Foundation NIST ISO IEC NIST SANS Institute GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
26 GP-TM-34 As an IIoT solutions vendor, implement multi-factor authentication capability (e.g. Apple Touch ID, security tokens). As a user of such solutions, utilise multi-factor system authentication. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks OWASP (Open Web Application Security Project) OpenAI and others ENISA Cloud Security Alliance IoT Security Foundation IIC (Industrial Internet Consortium) NIST IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
27 GP-TM-33 Ensure minimal level of authentication security for the IIoT devices and systems. In a segmented network/system, ensure that authorisation only allows for access to a certain segment and no other parts of the system. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) OWASP (Open Web Application Security Project) Cloud Security Alliance Cloud Security Alliance IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) VDC ISO IEC Huawei GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) View
28 GP-TM-32 Segregate remote access, i.e. develop a set of rules for control of the remote communication. Limit remote access only to the required systems and monitor it. Ensure full traceability and accountability of the users. Access Control Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) Failures / Malfunctions OWASP (Open Web Application Security Project) VDMA NIST IIC (Industrial Internet Consortium) NIST IoT Alliance Australia International Telecommunications Union NIST ISO ISO IEC IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) NIST View
29 GP-TM-31 For control systems which cannot be updated (e.g. legacy systems), apply compensating measures, such as network segmentation, micro segmentation, system relocation or additional real-time monitoring tools. Perform risk analysis to determine if it is possible and sufficient to improve security of existing system or if the replacement of the system is necessary. Software/Firmware updates Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IoT Security Foundation NIST NIST IIC (Industrial Internet Consortium) IIC (Industrial Internet Consortium) GSMA (Global System for Mobile Communications) View
30 GP-TM-30 Allow Third Parties to perform patching only if they guarantee and are able to prove that the patch has been tested and will not have any negative consequences on the device or if the Third Party assumes the liability for the update according to an applicable agreement. In addition, require Third Parties to report any executed actions related to the patching process and inform about them in advance. Update procedures shall be documented, known and controlled by the organisation. Software/Firmware updates Unintentional damages (accidental) Failures / Malfunctions IoT Security Foundation IoT Security Foundation The Cavalry NIST View
31 GP-TM-29 Perform deployment of patches for the IIoT devices only after proving that no negative consequences exist. Test the patches in a test environment before implementing them in production. If this is not possible, begin with deploying patches only on a segment of a system, ensuring that other zones will continue to operate normally in case a patch exerts any negative impact on a chosen segment. Software/Firmware updates Failures / Malfunctions Homeland Security IoT Security Foundation The Cavalry NIST Cloud Security Alliance IIC (Industrial Internet Consortium) NIST ISO IIC (Industrial Internet Consortium) View
32 GP-TM-28 Execute automatic update procedures only if they are based on the risk analysis and if the devices for which the automatic update can be allowed are identified. Verify the source of the update. Software/Firmware updates Nefarious Activity / Abuse Physical attacks Homeland Security The Cavalry Siemens IIC (Industrial Internet Consortium) NIST Cloud Security Alliance IIC (Industrial Internet Consortium) ISO View
33 GP-TM-27 Verify endpoints' software/firmware authenticity and integrity and ensure tight control over the update. Signing code updates (to be able to authenticate the code before it is loaded) and maintaining the authenticity is advisable. Software/Firmware updates Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Failures / Malfunctions Homeland Security IoT Security Foundation The Cavalry Siemens NIST IIC (Industrial Internet Consortium) OWASP (Open Web Application Security Project) NIST Cloud Security Alliance IoT Alliance Australia ISO GSMA (Global System for Mobile Communications) View
34 GP-TM-26 Anonymise any direct or indirect personal data processed within the company system (e.g. names of system operators and information on their performance), having considered all relevant legal requirements, or properly secure it, e.g. through role-based access control and encryption. Data protection Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Cloud Security Alliance OWASP (Open Web Application Security Project) Cloud Security Alliance IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) Huawei IEC GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) View
35 GP-TM-25 For data of high confidentiality, implement encryption and key management so that the information can be read only by authorised users. In addition, use data loss prevention solutions. Data protection Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) Symantec NIST Cloud Security Alliance IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) ISO IEC Huawei NIST View
36 GP-TM-24 Grant access to certain categories of data to Third Parties with least privilege and need-to-know principles in mind and document this access, i.e. ensure that Third Parties have access only to the necessary data and have minimal privileges, e.g. read only access to data that they should not be alter. Data protection Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) Cloud Security Alliance Cloud Security Alliance IoT Alliance Australia IIC (Industrial Internet Consortium) NIST ISO GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) NIST View
37 GP-TM-23 Categorise data related to the OT system based on risk analysis. Take into account production, device and user information. Defined categories may include for example production schedule data, customer data, R&D data, asset management data, defect and quality data, production line data, etc. For each category, assess the criticality of data and define required security measures that will ensure proper level of security. Recipes for instance are considered critical for manufacturing companies and shall be therefore protected with the most advanced measures, e.g. encryption. Data protection Nefarious Activity / Abuse Cloud Security Alliance NIST Cloud Security Alliance IoT Alliance Australia IoT Security Foundation ISO ISO IEC IIC (Industrial Internet Consortium) View
38 GP-TM-22 Protect data at rest (both in volatile and non-volatile memory), in transit and in use. For data at rest, it can be achieved through role-based access control and requirement of authentication. For critical data, implementation of encryption algorithms is advisable. Take special care not to store any sensitive data on SD cards without proper security measures such as access control lists. In terms of data in transit, it is advisable to ensure that traffic between system components is encrypted, e.g. utilising an SSL/VPN Tunnel or TSL. To protect data in use, implement access control and authentication mechanisms. Data protection Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking NIST IIC (Industrial Internet Consortium) OWASP (Open Web Application Security Project) NIST ENISA Cloud Security Alliance IoT Alliance Australia IIC (Industrial Internet Consortium) IEC Huawei NIST IOActive, Embedi GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) NIST View
39 GP-TM-21 Use positive/whitelist input validation to protect against cross site scripting and command injection, i.e. decode any encoded input and then validate the length, characters, and format on that data before accepting the input. Machine-to-Machine security Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions Siemens NIST ENISA IoT Alliance Australia IEC Huawei IEC GSMA (Global System for Mobile Communications) View
40 GP-TM-20 Use communication protocols that include the functionality to detect if all or part of a message is an unauthorised repeat of an earlier message. Machine-to-Machine security Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking oneM2M NIST NIST IoT Alliance Australia IIC (Industrial Internet Consortium) NIST ISO IEC IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
41 GP-TM-19 Establish a security association with proven and secure cryptographic algorithms between the communicating entities to provide mutual authentication, integrity and confidentiality. Machine-to-Machine security Eavesdropping / Interception / Hijacking oneM2M Symantec NIST Huawei NIST Cloud Security Alliance IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) NIST IIC (Industrial Internet Consortium) View
42 GP-TM-18 Store long-term service-layer keys (other than public keys) in a server-HSM residing in infrastructure equipment. The HSM containing the M2M long-term service keys should be bound to the M2M Device or M2M Gateway, using physical and/or logical means. HSM/server-HSM should not reveal the value of the stored secret keys (other than public keys), even to a management system or to an authorised representative of the M2M System Operator, such as a System Administrator. Machine-to-Machine security Eavesdropping / Interception / Hijacking Infineon oneM2M IIC (Industrial Internet Consortium) IoT Security Foundation IIC (Industrial Internet Consortium) IEC GSMA (Global System for Mobile Communications) View
43 GP-TM-17 Define important parameters for business continuity of your company, such as the recovery time objective (RTO), recovery point objective (RPO), maximum tolerable outage (MTO) and minimum business continuity objective (MBCO). Business continuity and recovery Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Federal Office for Information Security (BSI) NIST NIST Center for Internet Security (CIS) NIST NIST IEC View
44 GP-TM-16 In business continuity and recovery plans, include Third Parties aspects. Appropriate Third Party management and control over its involvement is essential for ensuring company's continuity of operations. Business continuity and recovery Unintentional damages (accidental) Failures / Malfunctions Federal Office for Information Security (BSI) NIST NIST The Cavalry NIST ISO View
45 GP-TM-15 Consider contingency planning preceded by a risk analysis. Define contingency plans and test them executing controlled exercises. Regularly review the plan (at least annually and in case of a major change) and adjust it appropriately. While preparing a contingency plan, consider both major disasters and smaller scale events caused by cyber incidents, which may disrupt normal operation of the company. Define responsible persons for every stage of the plan and establish a reporting process. Keep in mind that the plan needs to be simple and ensure employees' awareness through adequate training. Business continuity and recovery Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Federal Office for Information Security (BSI) NIST NIST ETSI (European Telecommunications Standards Institute) NIST IIC (Industrial Internet Consortium) ISO NIST ISO Huawei IEC View
46 GP-TM-14 Develop written procedures on how to return to the normal – well-defined – state of operation. Before establishing these procedures, perform threat and risk assessment and tailor the procedures to the assessment's results. Within the procedures, define roles and responsibilities for particular required actions. Distribute copies of the incident response plan to active incident response personnel. Business continuity and recovery Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters SANS Institute Cloud Security Alliance Auto ISAC (Automotive Information Sharing and Analysis Center) NIST NIST NIST ISO IEC View
47 GP-TM-13 Define critical business and technological processes and determine to what extent they influence business continuity. Business continuity and recovery Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Federal Office for Information Security (BSI) NIST NIST Homeland Security NIST Cloud Security Alliance Symantec IIC (Industrial Internet Consortium) NIST IEC View
48 GP-TM-12 Focus on ensuring the resilience of Industry 4.0 systems by creating a business continuity plan (BCP) and disaster recovery plan (DRP). Ensure continuity of the systems operation even in the event of security incidents. Perform periodic testing of the plans and adapt them according to lessons learnt from tests and actual security incidents. Business continuity and recovery Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Federal Office for Information Security (BSI) NIST NIST IIC (Industrial Internet Consortium) NIST IoT Alliance Australia ISO NIST IEC IIC (Industrial Internet Consortium) View
49 GP-TM-11 To mitigate the risk related to cloud attacks, adopt a zero-knowledge security approach. It means that providers of services should store and manage data without access to encryption keys. Protect all the data within the cloud and data in transfer. Ideally, all data should be encrypted. Application and interfaces should be secured as well. Cloud Security Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Cloud Security Alliance Cloud Security Alliance IIC (Industrial Internet Consortium) Cloud Security Alliance Online Trust Alliance GSMA (Global System for Mobile Communications) View
50 GP-TM-10 Locate critical systems and applications within the private or at least hybrid deployment models. If you consider utilisation of a public cloud, precede this decision with risk analysis. Cloud security Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions IIC (Industrial Internet Consortium) Online Trust Alliance SANS Institute NIST ECSO (European Cyber Security Organization) View
51 GP-TM-09 In cloud-based application and centralised systems, avoid single points of failure. Cloud security Failures / Malfunctions Outages Cloud Security Alliance IIC (Industrial Internet Consortium) Cloud Security Alliance GSMA (Global System for Mobile Communications) SANS Institute View
52 GP-TM-08 Include security and availability aspects in agreements with cloud security providers. Responsibilities for cloud security aspects shall be clearly defined and allocated to particular parties or persons. Availability of service shall be measurable and defined through specified parameters. Cloud security Eavesdropping / Interception / Hijacking Outages Legal Federal Office for Information Security (BSI) GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) Online Trust Alliance View
53 GP-TM-07 Base your decisions regarding the choice of the type of cloud on a business and privacy impact assessment, i.e. a type of quantitative risk assessments, taking also into consideration laws and regulations applicable to cloud service provider’s country and points of presence. Risk based approach to assess the criticality is of great importance. Cloud security Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) Failures / Malfunctions Legal Cloud Security Alliance Cloud Security Alliance Cloud Security Alliance Online Trust Alliance GSMA (Global System for Mobile Communications) IoT Alliance Australia View
54 GP-TM-06 Monitor the production data at rest and in transit to identify potential unauthorised data modification. Trust and Integrity Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Siemens IEC Huawei NIST NIST NIST GSMA (Global System for Mobile Communications) View
55 GP-TM-05 Ensure production data integrity through utilisation of appropriate cryptographic mechanisms and key storage tailored to processing capabilities of the implemented solutions. Trust and Integrity Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Symantec IEC Huawei NIST NIST NIST GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
56 GP-TM-04 Implement application whitelists, i.e. lists of applications that are allowed to run in the industrial control environment and mechanisms that prevent all other applications from running. Such lists shall be provided by vendor or defined in consultation with the vendor and reviewed at least annually and in case of implementation of a change to the system. On the whitelists, all unnecessary applications and applications with known vulnerabilities shall be avoided, as they contain backdoors to the system that can be used by attackers. Trust and Integrity Management Unintentional damages (accidental) Failures / Malfunctions Outages Cloud Security Alliance IEC IEC IIC (Industrial Internet Consortium) IoT Alliance Australia NIST NIST Symantec View
57 GP-TM-03 Define data exchange channels between IIoT devices and ensure that the system owner accepts them. Choose only secure channels whenever possible and implement whitelists. When sending sensitive data on mobile devices, do not use insecure channels such as SMS, MMS or notifications. Trust and Integrity Management Eavesdropping / Interception / Hijacking IIC (Industrial Internet Consortium) IIC (Industrial Internet Consortium) NIST Huawei NIST IEC SANS Institute OWASP (Open Web Application Security Project) GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
58 GP-TM-02 Authorise all IIoT devices within the OT network utilising the appropriate methods, e.g. digital certificates/PKI. Trust and Integrity Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking IIC (Industrial Internet Consortium) NIST NIST IIC (Industrial Internet Consortium) IoT Alliance Australia International Telecommunications Union IoT Security Foundation IIC (Industrial Internet Consortium) VDC Huawei IEC IEC NIST GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
59 GP-TM-01 Verify the integrity of the software before starting to run it. Verify the root of trust and secure boot mechanisms. Ensure that the software comes from a reliable source (signed by the vendor) and that it is obtained in a secure manner, e.g. downloaded via an encrypted connection. Software signing and/or checksum control should be in place to ensure that the software is legitimate. Trust and Integrity Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks IIC (Industrial Internet Consortium) NIST IIC (Industrial Internet Consortium) ENISA IoT Alliance Australia IoT Security Foundation IIC (Industrial Internet Consortium) VDC NIST Huawei IEC GSMA (Global System for Mobile Communications) GSMA (Global System for Mobile Communications) View
60 GP-PS-24 Regarding the Risk Management process, adopt two different approaches at the same time: - Top-down to follow a holistic approach with a well-defined strategy on how to address an organisation’s security issues taking into account its business needs. This will help address cybersecurity from an organisation-wide perspective through uniform policies, procedures and practices. - Bottom-up to provide a very granular and detailed view on the company’s situation also from the perspective of people and assets. It will make it possible to distinguish the differences between departments, personnel roles, specific processes etc. and make the organisation-wide programme adapted to particular needs specific to smaller parts of the organisation. Combine these two approaches to establish a security plan tailored to the organisation as a whole and to its specific lower level aspects. Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) SANS Institute Cloud Security Alliance IoT Alliance Australia VDC IEC View
61 GP-PS-23 From an organisational perspective, monitor selected threats and determine their impact on systems by performing risk analysis. Control threats detected through the threat intelligence process. Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Auto ISAC (Automotive Information Sharing and Analysis Center) NIST Symantec GSMA (Global System for Mobile Communications) NIST Cloud Security Alliance International Telecommunications Union IIC (Industrial Internet Consortium) Huawei NIST IIC (Industrial Internet Consortium) View
62 GP-PS-22 To be informed on the potential attack types and sources and new vulnerabilities which are relevant to your company’s field of operation, consider incorporating threat intelligence process within the threat management approach. Rely on various sources of threat information, such as vendor's feed, specialised entities, other companies' sites and open source. Details of threat intelligence programs should be tailored to a company’s individual needs and may vary from very basic methods, such as following cyber security news, to very advanced with the utilisation of special tools and aforementioned sources, especially in large companies. Before implementation, plan in advance how the received data will be handled, who the responsible persons will be and what the company's goals are in terms of this programme. Incorporate information sharing with trusted industry partners, ISACs (Information Sharing and Analysis Centres) and CERTs (Computer Emergency Readiness Teams). Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Symantec GSMA (Global System for Mobile Communications) NIST Cloud Security Alliance IoT Alliance Australia ISO NIST Huawei IEC IIC (Industrial Internet Consortium) View
63 GP-PS-21 Perform risk analysis which includes cybersecurity aspects at least annually. Also, integrate it with other processes, such as change management, incident handling and vulnerability management in order to ensure that risk analysis is performed: - in case of introducing a new system or a significant change to an existing system, - in the event of a critical security incident, - in case of critical vulnerabilities detection, - ad-hoc at the owners' request or in case of an exceptional situation. The risk assessment should cover technical and procedural testing of effectiveness of the security policies and process. Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) NIST NIST SANS Institute LNS NIST IEC IIC (Industrial Internet Consortium) GSMA (Global System for Mobile Communications) View
64 GP-PS-20 Establish risk and threat management process according to the individual needs and security requirements of your company. It should consist of security risk assessment to identify critical security assets and threat modelling to identify security risks and mitigations.D23 Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) NIST Auto ISAC (Automotive Information Sharing and Analysis Center) IEC NIST IIC (Industrial Internet Consortium) NIST Symantec IoT Alliance Australia LNS IEC IIC (Industrial Internet Consortium) View
65 GP-PS-19 For critical infrastructures in manufacturing environments, establish a number of risk management areas completely aligned with the corporate, safety, environmental, etc. sides. Assess and characterise threats, vulnerabilities and protection measures against those risk management areas. Based on that, in case of OT and Critical Infrastructures, build a specific impact-driven risk management approach. Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) NIST NIST NIST Homeland Security NIST ISO IIC (Industrial Internet Consortium) View
66 GP-PS-18 Adopt an approach to risk management dedicated to Industry 4.0 and Smart Manufacturing. The approach to risk management can be qualitative or quantitative. Consider new parameters, threats and attack scenarios and cover all interdependencies between cyber-physical scenarios, cyber-physical environmental and safety during the assessment phase. Risk and Threat Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) NIST SANS Institute NIST Symantec NIST Cloud Security Alliance NIST Huawei IIC (Industrial Internet Consortium) View
67 GP-PS-17 Avoid the usage of removable devices and disable USB ports (or technically restrict use of removable media on USB ports) if there is no accepted business requirement. At least scan the removable media devices using malware detection software with up-to-date definitions if they need to be connected to the environment. Asset Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) NIST IIC (Industrial Internet Consortium) NIST Siemens NIST LNS ISO IEC IEC GSMA (Global System for Mobile Communications) NIST View
68 GP-PS-16 Deploy a new device into the system only according to an established, accepted and communicated change management process. Do not allow for any changes unless designated approvals are received. Approved changes should be documented and the relevant documentation updated. Emergency changes may be carried out based on verbal approval from the Change Management Committee Head and the system owner. However, post emergency, the standard procedure for documenting change and risk analysis should be applied. Asset Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) NIST IIC (Industrial Internet Consortium) Siemens NIST NIST LNS ISO ISO IEC IIC (Industrial Internet Consortium) NIST View
69 GP-PS-15 Consider secure administration of assets, e.g. utilise secure/encrypted methods for administration of IoT devices (e.g. HTTPS, SSH) and associated key management. Management of the infrastructure and security devices should occur via a dedicated management network. Asset Management Nefarious Activity / Abuse Cloud Security Alliance IoT Alliance Australia IoT Security Foundation NIST IEC BITAG (Broadband Internet Technical Advisory Group) GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) NIST View
70 GP-PS-14 Use a centralised asset inventory for the overall computerised environment inside a manufacturing plant. While implementing change to a system, update the inventory. Store the latest version of software after implementation and after every change. Periodic reviews, e.g. annually, are also recommended. It is also advisable to use security tools that enable configuration management and change detection. Asset Management Nefarious Activity / Abuse Physical attacks Unintentional damages (accidental) IIC (Industrial Internet Consortium) Cloud Security Alliance SANS Institute Cloud Security Alliance NIST IEC View
71 GP-PS-13 In complex industrial environments with legacy system asset discovery, use passive monitoring devices instead of active monitoring solutions. It is advisable to utilise passive automatic tools whenever it is feasible, as they do not disrupt systems operation. Utilisation of active monitoring devices can cause adverse effects on the OT environment and disrupt the production process. If you consider implementation of active monitoring tools, precede it with a testing phase in a laboratory/testing environment to verify whether it will exert an adverse impact on the system, i.e. whether it will considerably increase the network load. Asset Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking IIC (Industrial Internet Consortium) Cloud Security Alliance IEC Huawei IEC NIST View
72 GP-PS-12 Ensure that your company has a consistent and up-to-date asset inventory. This inventory should include, among others, IP addresses, physical location, host, current firmware / OS version, used communication protocols, etc. The asset inventory should also include gathered known vulnerabilities related to particular assets. Clearly define and communicate the responsibility for maintaining an up-to-date asset inventory to the system owner/administrator. Asset Management Eavesdropping / Interception / Hijacking Physical attacks Failures / Malfunctions NIST Cloud Security Alliance Cloud Security Alliance SANS Institute NIST NIST ISO ISO IEC IEC SANS Institute NIST View
73 GP-PS-11 Utilise tools supporting asset management (i.e. automatic asset discovery). Asset management systems should be solid and robust. Choose asset management tools that are able dynamically to discover, identify and enumerate assets specific to the organisation and industrial environment (including those using proprietary protocols). Asset Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions NIST IIC (Industrial Internet Consortium) Cloud Security Alliance Cloud Security Alliance World Economic Forum NIST IEC View
74 GP-PS-10 Separate data that can be used to identify an individual from other information and ensure its security (for storing and retrieving information, communication services, cryptography, etc.). Any personal data transferred within the IIoT environment shall be encrypted in the traffic. Privacy by design Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Legal Cloud Security Alliance ETSI (European Telecommunications Standards Institute) IoT Security Foundation IoT Alliance Australia IIC (Industrial Internet Consortium) Huawei GSMA (Global System for Mobile Communications) View
75 GP-PS-09 Conduct a Privacy Impact Analysis (PIA) for the data that will be processed by the device. It may be integrated with the overall risk management process. Privacy by design Nefarious Activity / Abuse Legal Cloud Security Alliance World Economic Forum ENISA IoT Alliance Australia IIC (Industrial Internet Consortium) NIST GSMA (Global System for Mobile Communications) View
76 GP-PS-08 Establish the physical location of data stored by the organisation and define between which organisations data will be transferred. Restrict access to collected personal data only to authorised individuals. Periodically revise access rights and terminate them as soon as possible after an employee's change of position/leaving company. Privacy by design Nefarious Activity / Abuse Physical attacks Legal Cloud Security Alliance ETSI (European Telecommunications Standards Institute) ISA OWASP (Open Web Application Security Project) NIST Cloud Security Alliance IIC (Industrial Internet Consortium) IEC NIST GSMA (Global System for Mobile Communications) View
77 GP-PS-07 Define the scope of the data that will be processed by the device as well as the objective of this processing during the design phase. Ensure that only a minimal amount of personal data is collected by the device. Avoid collecting sensitive data. If you are a user of an IIoT system, do not provide any personal or sensitive information if it is not necessary. Privacy by design Nefarious Activity / Abuse Legal Cloud Security Alliance IoT Security Foundation VDC OWASP (Open Web Application Security Project) Cloud Security Alliance IoT Security Foundation LNS NIST ISA GSMA (Global System for Mobile Communications) View
78 GP-PS-06 Address privacy-related issues based on applicable local and international regulations, such as The General Data Protection Regulation (GDPR). A compliance function in the organisation should ensure that all new systems comply with regulatory requirements. This involves having written requirements in technical specifications during tendering/procurement process. Organisations should also take into account accountability aspect of privacy protection and implement measures that will enable them to demonstrate their relevant actions and their effectiveness. Privacy by design Legal European Parliament and Council of the European Union Cloud Security Alliance IEEE World Economic Forum Cloud Security Alliance IoT Security Foundation IIC (Industrial Internet Consortium) NIST ISO Huawei IEC GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) View
79 GP-PS-05 In each design document include a chapter addressing security of all information and control systems in industrial environment. The functional and/or technical specification should at least include information on security measures used, including but not limited to: a) system architecture b) access control c) interfaces and communication security d) policy enforcement e) mobile security f) cloud security g) backup/disaster recovery Security by design Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Cloud Security Alliance Auto ISAC (Automotive Information Sharing and Analysis Center) ETSI (European Telecommunications Standards Institute) IoT Security Foundation NIST ISA GSMA (Global System for Mobile Communications) View
80 GP-PS-04 Perform risk and threat analysis involving cybersecurity experts from the very early stages of the design process of the device to find out which security features will be necessary. The analysis should include possible and tailored use cases that the device may encounter. It is recommended to develop threat modelling for the IIoT systems and attack trees to consider resilience to various attack scenarios. Cybersecurity experts should be involved in the process to provide insights on threats and risks that the control systems are facing based on the experience and knowledge of current threat and risk landscape. Security by design Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Cloud Security Alliance Auto ISAC (Automotive Information Sharing and Analysis Center) NIST IIC (Industrial Internet Consortium) NIST Symantec IoT Alliance Australia ISO Huawei GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) View
81 GP-PS-03 Equip, as deemed appropriate after a security and safety assessment, even the most basic connected devices of very limited processing capabilities (e.g. actuators, converters) with identification and authentication features and ensure compatibility with IAM class solutions. This especially applies to protection against unauthorised re-calibration or re-configuration, e.g. of measuring devices, through: a) principle of least privilege for accessing device configuration and calibration engineering tools b) authorisation and authentication for engineers accessing engineering tools c) strong physical security for L0/L1 devices d) disabling of vulnerable wireless protocols e) disabling of test/debug features Security by design Nefarious Activity / Abuse Physical attacks Unintentional damages (accidental) Cloud Security Alliance VDC Symantec Auto ISAC (Automotive Information Sharing and Analysis Center) Cloud Security Alliance IIC (Industrial Internet Consortium) Huawei GSMA (Global System for Mobile Communications) NIST View
82 GP-PS-02 Address cybersecurity through embedded features of endpoints rather than only on the network level, if it is possible considering constraints such as limited computing power. Embed cybersecurity in automation systems by introducing fail-safe and fail-secure mechanisms from design. Security by design Nefarious Activity / Abuse Failures / Malfunctions Cloud Security Alliance VDC Auto ISAC (Automotive Information Sharing and Analysis Center) OpenAI and others IIC (Industrial Internet Consortium) Symantec IoT Alliance Australia IIC (Industrial Internet Consortium) Huawei GSMA (Global System for Mobile Communications) View
83 GP-PS-01 Treat IoT cybersecurity as a cycle - not as an end-to-end process. Take into consideration cybersecurity aspects in any activity of the development of the solution from the very beginning. Adopt security by design approach both from the devices as well as from the infrastructure perspective. In a "Security by design" concept, this relates to Continuous Security Improvement cycles at every step of a smart manufacturing system development lifecycle (Secure SDLC), that is analysis, design, implementation, testing, operations & maintenance. Security by design Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Cloud Security Alliance VDC Auto ISAC (Automotive Information Sharing and Analysis Center) NIST IIC (Industrial Internet Consortium) OWASP (Open Web Application Security Project) NIST OpenAI and others ENISA IEC GSMA (Global System for Mobile Communications) View
84 GP-OP-27 Clearly define all relevant aspects of the partnership with Third Parties, including security, within the appropriate agreements and contracts (e.g. SLA - service level agreement, NDA - Non-Disclosure Agreements). Sign these agreements and contracts before the start of cooperation. Third Party Management Unintentional damages (accidental) Failures / Malfunctions Legal ECSO (European Cyber Security Organization) Auto ISAC (Automotive Information Sharing and Analysis Center) IEEE NIST Cloud Security Alliance IIC (Industrial Internet Consortium) ISO NIST ISO IEC NIST View
85 GP-OP-26 Prompt suppliers for information on the security of their processes and commitments to the product they deliver, e.g. by preparing a questionnaire for suppliers regarding their security contributions to the items they deliver and select partners taking into account its results. Develop dedicated Security Requirements for Vendors and service providers. Vendors and service providers’ audits should be performed before choosing an IIoT solutions provider and periodically throughout the system’s lifecycle. Third Party Management Unintentional damages (accidental) Failures / Malfunctions ECSO (European Cyber Security Organization) Auto ISAC (Automotive Information Sharing and Analysis Center) IIC (Industrial Internet Consortium) IoT Security Foundation NIST OpenAI and others ENISA Cloud Security Alliance Homeland Security IoT Security Foundation SANS Institute IIC (Industrial Internet Consortium) NIST View
86 GP-OP-25 Do not provide a direct connection for the vendor to a system in a control or production layer. Support security of remote access with network segmentation, VLANS configuration, implemented firewalls and network traffic filtering. Allow only for access to the selected necessary functions and parts of the network (the rule of least privilege should be in place). Third Party Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Unintentional damages (accidental) Failures / Malfunctions ECSO (European Cyber Security Organization) Auto ISAC (Automotive Information Sharing and Analysis Center) IIC (Industrial Internet Consortium) NIST NIST IoT Alliance Australia NIST View
87 GP-OP-24 Strictly control access by Third Parties to a control or production layer, e.g. by physically plugging the RJ45 jack when the vendor has access or through timer systems. In addition, utilise dedicated registry accounts, multifactor authentication and encryption. Grant access to a control or production layer to Third Parties only on-demand, in a specified time window, for a specific purpose, and in a least privileged way. Record and supervise sessions and do not allow for idle sessions. Third Party Management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions ECSO (European Cyber Security Organization) Auto ISAC (Automotive Information Sharing and Analysis Center) OWASP (Open Web Application Security Project) NIST Cloud Security Alliance ISO IIC (Industrial Internet Consortium) NIST View
88 GP-OP-23 To improve awareness, consider communicating with other companies on a sector level including the supply chain - communication with manufacturers, components providers, software providers, service providers and customers is recommended. Also, consider participation in international security infrastructures based on trust formed to enable discussion, cooperation and intelligence sharing across organisations. Examples of such infrastructures already exist and include Plattform Industrie 4.0, Industrial Internet Consortium, Cloud Security Alliance, etc. Training and Awareness Failures / Malfunctions Cloud Security Alliance OpenAI and others World Economic Forum NIST NIST Cloud Security Alliance ISO NIST ISO IEC IIC (Industrial Internet Consortium) View
89 GP-OP-22 Train users of IIoT on the secure usage of their devices. During training sessions, explain to the IIoT users all of the technologies deployed to protect IIoT devices and the ecosystem where the solution is deployed. Training and Awareness Nefarious Activity / Abuse Unintentional damages (accidental) Cloud Security Alliance NIST NIST Cloud Security Alliance ISO IEC View
90 GP-OP-21 Ensure that security trainings are continuous and regular. Update the training programme after new important threats disclosure and adjust them according to the lessons learned from ongoing incident handling and recovery activities. Training and Awareness Nefarious Activity / Abuse Unintentional damages (accidental) IoT Security Foundation NIST World Economic Forum NIST Cloud Security Alliance NIST ISO IEC View
91 GP-OP-20 Provide all newly hired employees with cybersecurity training before starting the job. Provide all users of IIoT solutions with basic security awareness and training materials before they receive authorisation to access the system. Training and Awareness Nefarious Activity / Abuse Unintentional damages (accidental) NIST World Economic Forum NIST NIST ISO IEC View
92 GP-OP-19 Adopt a holistic approach to security training and awareness among employees – ensure that it includes employees on all levels of the organisation, covers new threats introduced to the manufacturing environment by Industry 4.0 new capabilities and is tailored to employees' roles and responsibilities as well as to the different levels of knowledge of the participants. Moreover, ensure that an additional training follows every change in employee responsibilities. Training and Awareness Nefarious Activity / Abuse Unintentional damages (accidental) ECSO (European Cyber Security Organisation) NIST Shaun Bligh-Wall Cloud Security Alliance VDMA Siemens ISO IEC NIST View
93 GP-OP-18 Conduct penetration tests of new IIoT solutions in a controlled environment (e.g. in a lab, testing environment) or before / during commissioning phase (e.g. during FAT or SAT phase). In addition, conduct penetration tests regularly, e.g. once every 2 or 3 years, and after an important update of the system with acceptance of the system owner. Vulnerabilities management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions SANS Institute IEEE NIST NIST OpenAI and others Cloud Security Alliance IoT Alliance Australia LNS Huawei IEC NIST IIC (Industrial Internet Consortium) View
94 GP-OP-17 Establish a comprehensive and well-defined process for disclosure of vulnerabilities. If you are a manufacturer, in case of vulnerability identification, inform users on how to patch the device via dedicated emails or portals. To promote vulnerability disclosure within a company, launch a bug bounty program, i.e. reward people who identify significant security vulnerabilities in the implemented infrastructure or in the final product. Vulnerabilities management Failures / Malfunctions IEEE GSMA (Global System for Mobile Communications) NIST NIST OpenAI and others ENISA Cloud Security Alliance IoT Alliance Australia Homeland Security NIST View
95 GP-OP-16 Establish tight collaboration between the OT and IT department. Do not allow any individual responsible for IT security to implement any cybersecurity policies, including vulnerability management, on the OT side without the full knowledge and cooperation of the plant engineers. Ensure that IT and OT departments share their knowledge about systems operations as well as about threats. Vulnerabilities Management Unintentional damages (accidental) Symantec NIST LNS NIST Huawei SANS Institute IIC (Industrial Internet Consortium) View
96 GP-OP-15 While eliminating security gaps, begin from the most critical vulnerabilities taking into account the criticality of assets and systems. This process may be supported by asset inventory, if the inventory contains data related to assets and systems criticality. Vulnerabilities management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions Outages Cloud Security Alliance Homeland Security NIST NIST NIST OpenAI and others SANS Institute View
97 GP-OP-14 Define a comprehensive vulnerability management process within the organisation that covers utilisation of automatic and manual tools, e.g. passive vulnerability scanners, resulting from risk analysis. In case of active scanners implementation, precede it with a testing phase and require acceptance by the system owner. Have in mind that active scanners in the OT environment may cause adverse effects to the system and disrupt the production process, especially if legacy equipment is used. Vulnerabilities management Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions IIC (Industrial Internet Consortium) Auto ISAC (Automotive Information Sharing and Analysis Center) SANS Institute NIST ISO ISO IEC NIST IIC (Industrial Internet Consortium) NIST View
98 GP-OP-13 Detect and investigate promptly every unusual security related event. Require employees, contractors and external companies with access to the IT/OT environment to notify and report about any observed or suspected security weaknesses and anomalies. Incidents handling Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages IIC (Industrial Internet Consortium) Symantec NIST Cloud Security Alliance IEC IEC NIST IIC (Industrial Internet Consortium) View
99 GP-OP-12 Establish a process for incidents handling that consists of identification of affected assets, identification and classification of vulnerabilities, escalation and notification. Make a revision of the process at least annually and as soon as possible in case of a major change, e.g. change in organisational hierarchy, contracts, etc. Update the process with lessons learned from analysing and resolving security incidents. Test the process at least annually and consider different possible incidents. Incidents handling Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IIC (Industrial Internet Consortium) Cloud Security Alliance Auto ISAC (Automotive Information Sharing and Analysis Center) NIST NIST ENISA Cloud Security Alliance Symantec NIST ISO IEC IIC (Industrial Internet Consortium) View
100 GP-OP-11 Consider creation of OT Cybersecurity Operations Centre (SOC) consisting of specialists with clear roles, responsibilities and IT, OT and cybersecurity competences to support cybersecurity incidents. Divide them into specific lines of support with appropriate roles and responsibilities. Incidents handling Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Symantec IIC (Industrial Internet Consortium) LNS NIST IEC NIST View
101 GP-OP-10 Define cyber incidents relevant for your organisation based on the company's area and range of operation. Classify these incidents according to applicable standards, e.g. by grouping them based on utilisation of a common attack vector (removable media, email, website, etc.) or according to their impact (on organisation's operation, on data, etc.). Incidents handling Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters IEC IEC NIST NIST Symantec NIST Cloud Security Alliance IoT Alliance Australia International Telecommunications Union NIST IIC (Industrial Internet Consortium) View
102 GP-OP-09 Integrate compliance enforcement controls to the established Security Architecture and ensure that all products meet the requirements defined within it. IT Security architecture Failures / Malfunctions Unintentional damages (accidental) Legal Disasters Homeland Security IEC IIC (Industrial Internet Consortium) IIC (Industrial Internet Consortium) ISA LNS IIC (Industrial Internet Consortium) SANS Institute View
103 GP-OP-08 Within the Security Architecture, allocate and distribute clear roles and responsibilities for security between IT, Engineering/Automation and Operations departments. Clearly define and communicate roles for both OT systems and security processes. Appoint a Governance Body with a clear mandate and defined decision-making process. IT Security architecture Nefarious Activity / Abuse Unintentional damages (accidental) Failures / Malfunctions IIC (Industrial Internet Consortium) SANS Institute IIC (Industrial Internet Consortium) ISO ISO ISA IEC IIC (Industrial Internet Consortium) View
104 GP-OP-07 While defining security architecture, ensure that it comprises all relevant security aspects – from organisational to physical implementation issues. The Security Architecture should consist of (but not be limited to) the following domains: - Security Policy & Design Principles - Security Governance & Operating Model (Organisation) - Security Network Blueprint (Zoning model) - Security Technical Requirements - Security Services design - Security Procedures IT Security architecture Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters Homeland Security Huawei IEC IEC IIC (Industrial Internet Consortium) IIC (Industrial Internet Consortium) ISA LNS VDC View
105 GP-OP-06 To ensure security in a computerised ecosystem, adopt a holistic architectural-based approach and develop a risk-aligned security architecture based on business requirements. IT Security architecture Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions Outages Legal Disasters LNS Homeland Security IIC (Industrial Internet Consortium) VDC IEC ISA Huawei IEC GSMA (Global System for Mobile Communications) View
106 GP-OP-05 During the handover phase of the project implementation process, properly build and transfer all cybersecurity documentation, processes and procedures. Within the documentation, include a list of system and service accounts, security logs, response plans, confirmation of all software and firmware versions, up-to-date network diagrams, system architecture, risk register and security limitations. Processes should comprise maintenance routines, anti-virus deployment and assurance, patching processes and accounts' management and authentication processes. Procedures should include firewalls baseline configurations, management and monitoring, change control and fall-over testing. Endpoints lifecycle Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Failures / Malfunctions Legal NIST NIST IIC (Industrial Internet Consortium) ISO NIST NIST View
107 GP-OP-04 Conduct cybersecurity acceptance tests against technical specification during different validation activities or stages of the product lifecycle, e.g. FAT, SAT and penetration testing before go-live. Endpoints lifecycle Failures / Malfunctions Outages Disasters IIC (Industrial Internet Consortium) IoT Security Foundation NIST Elsevier ISO NIST ISO IEC IEC View
108 GP-OP-03 Consider security aspects during whole procurement process defining security measures and requirements tailored to particular devices/solutions. The security subject matter expert shall participate during offers revision. During the IIoT procurement process prepare IIoT Technical Requirements Specification document in which you will define preferred technologies and minimum cybersecurity requirements including product support and security support lifecycle aspects. Endpoints lifecycle Failures / Malfunctions Outages Disasters IIC (Industrial Internet Consortium) IoT Security Foundation NIST NIST OWASP (Open Web Application Security Project) NIST Cloud Security Alliance NIST ISO IEC GSMA (Global System for Mobile Communications) View
109 GP-OP-02 Take into account security considerations throughout the whole supply chain. Monitor software, hardware and its components throughout the supply chain to detect and prevent unauthorised changes, e.g. introduction of malware to the software. Create unique device identity and maintain it over the lifecycle of the device. Integrity may be verified based on roots of trust, digital signatures and embedded identifiers. Ensure that the integrity of the manufactured device can be measured and attested. Endpoints lifecycle Nefarious Activity / Abuse Eavesdropping / Interception / Hijacking Physical attacks Unintentional damages (accidental) Failures / Malfunctions IIC (Industrial Internet Consortium) IoT Security Foundation NIST Elsevier BITAG (Broadband Internet Technical Advisory Group) NIST OpenAI and others Cloud Security Alliance Symantec IoT Alliance Australia NIST GSMA (Global System for Mobile Communications) IIC (Industrial Internet Consortium) View
110 GP-OP-01 Focus on the security of software and hardware during every stage of the endpoint lifecycle. At the ordering stage, provide the vendor with defined security requirements, including the security capability level of individual components. For IIoT devices perform local commissioning before using the device. During the exploitation phase, ensure security of the maintenance procedures. At the decommissioning stage of the device's lifecycle, remove critical data from the device and remove the device from production in a controlled manner. Endpoints lifecycle Failures / Malfunctions Legal World Economic Forum Huawei VDMA Smart Factory Innovation Forum NIST NIST Cloud Security Alliance IoT Alliance Australia IIC (Industrial Internet Consortium) LNS ISO MIT IEC IEC NIST GSMA (Global System for Mobile Communications) View
Records : 110 of 110 | Page : of 1 | Limit