After having determined that manufacturing companies that network their machines and systems are particularly at risk from security vulnerabilities and attacks on their information technology (IT) infrastructure, research organisation the Fraunhofer Institute for Production Technology (IPT) wants to further develop the cross-industry Production Security Readiness Check in a research project to be undertaken with small and medium-sized enterprises (SMEs).

Interested companies that would like to thoroughly check their production IT with regard to protection and security can participate in the project, the institute says.

SMEs that want to exploit the potential of Industry 4.0 often find themselves caught between the benefits of flexible networking of their production facilities and the risk of falling victim to cyber-attacks, the institute notes.

Networking proprietary hardware and software systems from different manufacturers can create considerable attack surfaces and security gaps.

The latest White Paper from Fraunhofer IPT confirms that neither SMEs nor large companies are adequately protected from potential dangers, such as sabotage, data theft or espionage. 

Further, while large companies can hire their own IT security experts, in small companies, this task is often left to IT support as one of numerous others, which can only limit the damage if the worst comes to the worst.

The researchers want to combine a Web-based questionnaire with automated network analysis tools that compare the current situation in the companies with a reference model. The reference model takes into account the requirements and recommendations of the applicable standards, guidelines and laws, as well as well-known examples of success from the corporate organisation.

A user-friendly questionnaire guides users through the process even without extensive prior knowledge and takes into account both industry and company size.

As a result, the user then receives a detailed assessment of the company's current security level. The system also suggests suitable measures in the form of a priority list and recommends suitable security solutions in each case, the institute says.

Determining how SMEs can identify and select effective security measures without high financial and organisational outlay will be clarified by a research project that Fraunhofer IPT together with the Fraunhofer Institute for Communication, Information Processing and Ergonomics wants to pursue, with the aim to enable the project partners to recognise their own IT security level and implement the necessary protective measures in a targeted manner.

"We are looking forward to companies that want to participate in the further development either as users or also as enablers. Users can, for example, contribute requirements and use cases to the project and help shape the tool's recommendations for task areas such as threat and vulnerability management, identity and access management, or information exchange and communication," says Fraunhofer IPT production security readiness check project manager Alexander Kreppein.

"Companies that can offer IT security solutions for production or software for quality or compliance management can participate in the project as enablers."

At the end of the project, Fraunhofer IPT and Fraunhofer FKIE will make the developed concepts and the prototype of the developed application available to the participating companies in full and at no additional cost.

The project is scheduled to run from March 2022 to March 2024.