Industrial Cybersecurity: What Are the Risks and How Can They Be Assessed?
Connecting industrial equipment to IT networks makes it easier to monitor operations, carry out maintenance and use production data, but it also exposes industrial facilities to cyber threats. Risk assessment helps organisations identify appropriate protective measures based on the specific characteristics and constraints of each industrial environment.
induportals-media-publishing.com
Connecting industrial equipment to networks and the Internet introduces cybersecurity risks
Connecting industrial equipment to networks expands an organisation’s attack surface. The convergence of information technology (IT), which encompasses data and business management applications, and operational technology (OT), which monitors and controls physical processes, creates new potential entry points into industrial facilities.
The potential consequences of a cyberattack extend well beyond the theft or disclosure of information. An intrusion can cause production stoppages, changes to process parameters, the manufacture of non-compliant products or damage to equipment. In some circumstances, a compromised system may also affect functions designed to protect personnel or the environment.
Industrial espionage represents another threat, particularly when systems contain confidential information or proprietary manufacturing know-how. Ransomware, meanwhile, can make data or applications inaccessible and disrupt operations. Its potential spread to industrial systems is particularly concerning when corporate IT and production networks are inadequately segregated.
The growing number of connected sensors, actuators and devices associated with the digitalisation of industrial processes further increases these risks. Programmable logic controllers (PLCs), supervisory control software and other computerised components may contain vulnerabilities, even when specifically designed for industrial environments.
However, the consequences depend on the type of facility, its architecture, its functions and the protective measures already in place. Companies must therefore assess risks based on their own equipment and potential attack scenarios, rather than assuming that all connections pose the same level of threat.
Is completely disconnecting industrial equipment from external networks the best way to prevent cyberattacks?
Completely isolating industrial systems, an approach known as an air gap, reduces their exposure to attacks originating from external networks. However, it does not provide absolute protection. Even isolated systems generally require software updates, configuration changes or maintenance work. These activities may involve USB drives, programming terminals or laptops, all of which can potentially introduce malware.
Operational requirements for monitoring, data collection and remote maintenance also make certain network connections necessary. Equipment manufacturers and service providers may use temporary or permanent connections to access industrial equipment. If inadequately controlled, these connections can become entry points into the industrial network or even other corporate systems.
The challenge is therefore not simply whether to connect equipment, but how to control communications between different environments. Remote access must be identified, authenticated, restricted to genuine operational needs and monitored. It can also be disabled when not required. Multi-factor authentication and authentication mechanisms suited to industrial equipment can further strengthen access control.
Separating corporate IT networks from industrial networks remains an important measure, provided it is supported by appropriate traffic filtering and monitoring. A properly controlled network connection may be preferable to occasional data transfers using removable media whose use is not adequately managed.
Physical isolation nevertheless remains a valuable risk reduction measure wherever operational requirements allow. It should be regarded as one element of a broader defence strategy, rather than a substitute for other cybersecurity measures.
Which methods can be used to assess cybersecurity risks in industrial IT systems?
Risk assessment begins by identifying the equipment, software, communications and functions essential to the operation of the facility. This mapping process must cover industrial IT and OT assets, including legacy equipment, maintenance connections and components that may not appear in official inventories.
The next step is to analyse system vulnerabilities and the potential consequences of their exploitation. This involves identifying the threat actors likely to target the facility, their objectives and the capabilities at their disposal.
Systems must be assessed according to their role in the industrial process. A failure affecting a secondary piece of equipment will not necessarily have the same consequences as one involving a PLC controlling a continuously operating production line. The analysis must also consider interactions between IT systems, physical equipment and safety functions.
Risk scenarios should address information confidentiality, equipment availability, the integrity of data and control commands, and potential consequences for people, assets and the environment. The company can then prioritise risks according to their likelihood and severity before defining appropriate risk treatment measures.
Several standards and methodologies can help structure this process. ISO/IEC 27005:2022 provides guidance on managing information security risks. The EBIOS Risk Manager methodology, developed by the French National Cybersecurity Agency (ANSSI) and updated in 2024, enables organisations to develop risk scenarios that take account of their business and technical ecosystems.
For industrial environments, the IEC 62443 series also sets out requirements tailored to industrial automation and control systems. IEC 62443-3-2:2020 specifically addresses risk assessment, the definition of zones and communication conduits, and the establishment of target security levels.
These approaches must be adapted to the characteristics of each facility. Where appropriate, cybersecurity analysis can also be integrated into existing industrial risk studies, particularly Hazard and Operability Studies (HAZOP) or Layers of Protection Analysis (LOPA). However, these methods are not interchangeable: they serve different purposes and must be combined within a coherent assessment framework.
Once risks have been identified and prioritised, companies must define protective measures suited to their facilities. These measures typically encompass internal organisation, access control, network segmentation and industrial system monitoring.
Published by Youssef Belgnaoui, editor at Induportals.
