Cyber Resilience Identity Security for the Smart Factory

Related Vendors

CyberArk Software (DACH) GmbH

FAULHABER Drive Systems

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Wuxi InfiMotion Technology Co., Ltd.

With every networked machine, every new sensor and every digital control system, the number of machine identities grows. This is accompanied by considerable security risks.

These security risks can only be mitigated with a holistic approach to identity security. In recent years, most manufacturing companies have increasingly networked their machines and systems and added new sensors and IoT devices. The benefits are obvious and range from higher production quality and lower costs to fewer malfunctions and failures. Digitalization and AI also help to optimize supply chains and shorten delivery times. However, the increasing digitalization of manufacturing also has its downsides, as cyber criminals are finding new points of attack to paralyze systems for cyber extortion or steal valuable intellectual property such as design data and process technology.

One of the biggest weaknesses of Industry 4.0 and the smart factory are the many machine identities. They are the basis for

• the communication of the control systems with the machines and systems,
• data exchange with MES and ERP systems,
• data collection with countless new sensors and
• the analysis of data with AI applications in the data center or the cloud.

Depending on the company, this can quickly add up to tens of thousands or even hundreds of thousands of identities - their number has long since significantly exceeded that of human identities. According to Cyberark's 2025 State of Machine Identity Security Report, most manufacturing companies now have up to five times as many machine identities as human identities, with six percent having more than a hundred times as many. And there is no end to this growth in sight: three quarters of manufacturing companies expect the number of machine identities to increase further over the next twelve months.

In addition, companies are not only networking their production facilities more closely, but their products are also increasingly connected to other devices or the cloud.

Such networked products are particularly interesting for cyber criminals: if they can compromise the identity of the associated cloud service or the identity used to sign software updates, all connected devices are open to them. They are able to manipulate updates and siphon off data - a danger that also threatens production environments that are connected to the cloud or equipped with many IoT devices. Just one compromised identity can put an entire company at risk.

Identity Diversity Overwhelms Companies

In addition to the sheer mass of machine identities, it is above all their diversity that makes management so challenging for manufacturing companies. These include API keys, tokens for service accounts, SSH keys and SSH certificates, JSON web tokens as well as keys and certificates for the certification of software and code.

Administration is carried out via various management systems and sometimes simple Excel lists in which responsibilities and process data are noted. Consistent guidelines for identity security can hardly be implemented in such environments - especially as there are many shortcuts and workarounds to reduce the effort involved in the largely manual processes. For the sake of simplicity, secrets are permanently stored in applications and devices or certificates with extremely long validity periods are issued.

All of this is extremely risky: hard-coded secrets are easy prey for cyber criminals and, as they are never replaced, give them permanent access to applications and devices. Particularly in production facilities that are largely isolated, intruders then have a free hand and the damage is difficult to repair remotely.

The situation is similar with certificates, which are rarely renewed. They can be misused for a very long time after being compromised and are also a kind of ticking time bomb within the production environment.

After all, employees generally lack an overview of when which certificates expire - and those who have installed them may no longer even be companies.

It is therefore hardly surprising that 57% of manufacturing companies have experienced certificate-related outages in the past twelve months, according to the Cyberark report. Almost a third also had to deal with security incidents that could be traced back to compromised identities - and in many cases even led to the loss of existing (14%) and potential customers (27%).

Visibility Is the Top Priority

If manufacturing companies want to better protect machine identities and thus their infrastructures, they must first establish visibility across all locations - because ultimately they can only secure what they know.

Network monitoring and active scans for devices and identities not only provide an inventory, but also help to detect new machine identities or changes to existing identities. Building on this, classic risk management is required to assess threats to identities, the probability of occurrence and the impact of a compromise in order to set priorities and define suitable protective measures.

Here it is particularly important to pay attention to which systems and applications need to be accessible from outside the company network and which are located in the cloud. They are particularly at risk and should be secured as a matter of priority.

The next step is to clarify responsibilities: Who creates and manages secrets and certificates? Who defines guidelines, such as how long keys must be and how regularly they are exchanged? Who is responsible for enforcing the guidelines and implementing best practices in administration?

Only once such questions have been answered should processes for managing identities, secrets and certificates be set up. Modern management solutions bundle these processes in a central location and ensure complete automation so that employees do not have to deal with the manual issuing, renewal or deletion of certificates, for example. Due to the large number of certificates, this would hardly be possible anyway and would only slow down the tightly synchronized processes in production.

In short: Human employees should not have to deal with machine identities and be responsible for their lifecycle when these identities can be managed much faster and more reliably using automation.

With intelligent authorization controls, companies ensure that each identity is correctly authenticated and only has access to the resources it is allowed to access. When assigning authorizations, companies should also implement the principle of least privilege, i.e. only assign the minimum necessary authorizations. In many cases, such as with particularly vulnerable identities in the cloud, it may even make sense to assign no authorizations at all (zero standing privileges) and only assign privileges to the identities concerned on a session basis when required.

Replacing Old Ways of Thinking

Many modern solutions for managing identities, secrets and certificates are now available as software as a service (SaaS) in the cloud. Companies should not turn a blind eye to these solutions simply because they adhere to old ways of thinking and try to isolate their production sites and keep them largely offline. This is because they often only have access to outdated technologies and security systems that hinder innovation and do not offer comprehensive transparency - especially not across all locations.

In addition, identity or encryption policies developed ten or 20 years ago are no longer suitable for today's IT environments and cyber threats. This gives companies the opportunity to introduce new innovative solutions and policies that were unimaginable when Y2K was their biggest challenge.

In addition, manufacturing companies will have to deal with the issue of quantum computing in the medium term, as powerful quantum computers pose a huge threat to the traditional encryption and signature processes on which identity security is currently based.

For critical systems in particular, companies should therefore draw up a timetable for the introduction of quantum-safe algorithms and protocols - established security providers and their partners can provide support. Creating visibility and driving automation are important first steps to prepare for the post-quantum era.

Kevin Bocek is Senior Vice President of Innovation at Cyberark