- May 20, 2016
By Bill Lydon, Editor, Automation.com
Mike Bastian, Global Controls Manager at Ford, shared the motivations behind their cybersecurity strategy, as well as defined 7 systems which are essential for reliable operations and keeping production running smoothly.
By Bill Lydon, Editor, Automation.com
Industry 4.0 and the Internet of Things (IoT) have been revolutionizing industries across the board, but flaws in a company’s cybersecurity strategy can wipe out any technological gains in a hurry. Mike Bastian, Global Controls Manager of Ford Powertrain discussed his company’s cyber security strategy and deployment at the Automotive Manufacturing Summit. As their go-to person, Bastian describes that it was not a position which he sought. “They were looking for somebody to hang this brick on and they found me,” he chuckled. Bastian has extensive experience including positions in manufacturing, vehicle operations, decentralized engineering, and advanced technology development and he realized, that at the end of the day, the computers inside the equipment are part of the control system and this had to be an integral part of the control strategy. The challenging part of his mandate, in Bastian’s eyes, was going to be securing the industrial controls environment, both for the present and the future, in order to standardize the automation solutions for Ford Motor Company’s Powertrain Manufacturing Solutions.
The Automotive Manufacturing Summit was part of the Manufacturing in America 2016, the annual two-day event, hosted by Siemens and Electro-Matic Products, which featured 50 vendor exhibits and nearly 100 technical seminars focused on automation and controls.
Bastian described how Ford’s manufacturing technology journey started in late 2013. They realized early on that cyber security was essential to protect the increasingly large amount of technology deployed in automation and control systems, and that the idea of an air gap between industrial automation and IT was just not practical in today’s world. New initiatives including Industry 4.0 and IoT would require cyber security, in the controls environment, be understood and addressed.
One of the first tasks required was developing an inventory of installed, processor-based systems, systems which included hardware, operating system, software, and networking. This became a large task and the first attempt to have plants fill in spreadsheets for 72 global facilities yielded low results. Learning that they needed to use well defined standard fields, and provide clear descriptions of information required, they applied those lessons and redid the activity. The required information included computer operating system with version, IP address, network(s) connected, password protection, antivirus protection and impact of a computer crash. As Bastian emphasized, a large ongoing problem with intelligent control systems is the churn of operating system versions and types including PC and PLC. By applying the collected data, the team was able to conduct a risk assessment, and classify every PC to determine the amount of risk to production, quality, and other impacts, if it failed. This activity took a year to accomplish, but defined the scope of issues. This enabled the team to create a plan for every computer and processor-based control.
Bastian emphasized that people must first recognize that to be effective, IT cyber security policy must apply. “We fought that idea for many years” he reflected, sharing the story of how the auditors within Ford applied IT policy to industrial control systems and uncovered several infractions and violations. This helped this activity gain momentum for good reasons. At this early stage, as Bastian notes, “they were zooming in on PCs.” Auditors asked questions about common IT practices. ‘What is the virus protection?’ ‘What is the disaster recovery plan?’ They asked about sustainability plans and found that, in most cases, it had not even been addressed. Bastian noted the large scope of the issue, with plants typically having 400 to 600 PCs incorporated into the industrial control systems. IT manufacturing engineering and controls needed to be speaking from the same point of view and policies had to encompass everything that used processors and software. They made it an extension of IT policy and insisted on transparency, both for future audits and so it made sense to controls engineers.
Another issue they found was that there was no consistency in PC systems, since they were bought by various groups in the organization or delivered as part of packaged solutions for different equipment (e.g. machine control, vision systems, etc.) Over time, this snowballed into a significant challenge and nobody owned the problem. They realized that they needed to align the computer policies to encompass all computers including IT, manufacturing systems, and industrial automation. As Bastian noted, “You have to recognize that some of the IT policy makes a lot of sense and does apply to the industrial environment.” The Global controls team took over the standardization of PC deployments and software. The efforts of the global control team “has been painful, but the end result put us in a much better place,” said Bastian. The team developed a comprehensive, 150-page IT policy manual, which Ford named the Information Security Policy (ISP).
Ford defined a computer standard for control and automation, which was essentially the same configuration as the IT group standard, but which specified a standard software template, standard disaster recovery package, and standard virus malware protection suite. In the past, there was no policy and various groups were using a wide range of computer configurations. If a system does not meet our criteria the computer must be replaced. This was designed to prevent system vulnerabilities from having a direct impact on the bottom line by preventing plants from delivering on their production commitments. Enforcement required that deviations not be allowed anywhere, including with second and third tier suppliers. Asked how he was enforcing these standards, Bastian replied somewhat jokingly, “the way I enforce our standards is by penalty of death.”
Bastian defined the seven systems that are essential for reliable operations to keep production running.
Disaster RecoveryDisaster recovery includes PC software, PLCs programs and other controls and automation with processors. “If that asset fails you have to be able recover quickly to maintain production.”
Change ControlThere must be a discipline, process, and systems to manage hardware and software changes that include change approvals and genealogy. Every time a change is made it has to be backed up for effective disaster recovery.
Line of SightFord’s “Line of Sight” policy does not allow external access to automation and control internal networks.
Virus & Malware ProtectionVirus and malware protection is essential. Most of the computers that had been deployed in the past did not have this protection and they identified documented cases where viruses on computers created production losses.
Access ControlIT access control policies need to be in place including encryption, change frequency, and password governance.
End of LifeA technology lifecycle plan for obsolescence is essential.
Technology ManagementTechnology standards are required for consistent configuration control.
Based on these tenets, they created the policy and procedures for manufacturing engineering, and defined one supply base for the purchase of computers, in order to ensure consistency.
Mike Bastian believes Ford Powertrain has a solid foundation for the continued implementation of Industry 4.0 and IoT technologies. This includes the deployment of intelligent devices, autonomous manufacturing, smart sensors, cyber physical systems, IP65 Decentralized Hardware, Mobility, RFID, self-optimizing systems, and scalable cloud-based big data. He emphasized that this will require a significant increase in the deployment of technology, including computers, smart devices, and software, which will need to be treated as protected assets. In order to maintain a competitive position as a manufacturer, it is a requirement to have secure systems, that produce and communicate larger volumes of information, for backend and business systems.
Did you enjoy this great article?
Check out our free e-newsletters to read more great articles..Subscribe