Device & Application Cybersecurity Services

Syncing manufacturers/system integrators with cybersecurity standards and global best practices

In response to economic pressures, industrial automation and control systems (IACS) are increasingly relying on external networks for manufacturing and automation processes. However, the increased number of transfer routes also exposes networks and systems to even more vulnerabilities. 

Abiding by international cybersecurity standards can allow manufacturers to safely develop and integrate products, as well as allow system integrators to access the IT infrastructures and service processes that they need. With pre-certification and certification experts in cybersecurity testing, our lab technicians can help you abide by the cybersecurity gold standard to ensure that your systems and data remain airtight even against the most lethal threats.  

Today, many national authorities and regulators are bringing security requirements under compliance regime such as European Union's Radio Equipment Directive (RED) which expects IoT devices to meet Basic security requirements before being marked with CE marking and placed in the European Union market. 

NCCS/ComSeC security certification (India)

As part of Mandatory Testing and Certification of Telecommunication Equipment (MTCTE), Indian Telecom Security Assurance Requirements (ITSAR) is a set of security guidelines and standards established by the NCCS. ITSAR ensures the security and integrity of telecom networks in India and is applicable to all telecom service providers in India. Areas covered by ITSAR include network security, data privacy, and lawful interception. 

For full details about the NCCS and the role it plays in cybersecurity, click here.

ETSI EN 303 645 requirements

In 2020, ETSI published the latest ETSI EN 303 645 standard which outlines guidelines and baselines for security standards in IoT device manufacturing and consumer use. The standard applies to all consumer IoT devices that are connected to network infrastructure, including the Internet or home network, as well as their interactions with associated services.

It is important to note, however, that non-consumer IoT devices, such as those primarily intended for use in manufacturing, healthcare or other industrial applications, do not fall under the ETSI EN 303 645. Prime examples include manufacturing, healthcare, and other industrial devices.

13 provisional items of cybersecurity

Concretizing international cybersecurity standards are the 13 cybersecurity provision items that international standards bodies and organizations have agreed to be essential hallmarks of secure cybersecurity systems. While by no means an exhaustive, this list will help organizations establish a solid foundation to combat cybersecurity threats.

1. No universal default passwords
2. Implement a means to manage reports of vulnerabilities
3. Keep software updated
4. Securely store sensitive security parameters
5. Communicate securely
6. Minimize exposed attack surfaces
7. Ensure software integrity
8. Ensure that personal data is secure
9. Make systems resilient to outages
10. Examine system telemetry data
11. Make it easy for users to delete user data
12. Make installation and maintenance of devices easy
13. Validate input data

8 fundamental data protection rights

Accompanying the 13 cybersecurity provision items are eight fundamental data protection rights that cyber defenses must achieve. Because each organization and industrial system is unique, enshrining the outcomes of cybersecurity is essential to ensuring that defenses put in place achieve their intended outcomes even after modifications and customizations are made.

1. Right to information: Users have the right to ask a company for information about what personal data is being processed and why. For example, a user can request a list of processors who are authorized to view their data, which can be helpful for understanding who has access to their information.
2. Right to access: Users are entitled to view their personal data and request copies of it. This can be especially helpful for verifying identity or understanding how a company is using their information.
3. Right to rectification: If a user believes that their personal data is not accurate or up-to-date, they have the right to request that it be modified. This can help ensure that the information being held about them is correct and current.
4. Right to withdraw consent: If a user previously gave consent for a company to use their personal data, but they change their mind, they have the right to withdraw that consent. This means that the company must stop processing their data for that purpose.
5. Right to object: Users can object to the processing of their personal data if they have a specific reason for doing so. This might be related to a legal dispute or other unique circumstance.
6. Right to object to automated processing (decision): If a user feels that a decision made about them based on automated processing is unfair, they can object to it. They can ask for their request to be reviewed manually, so that a human can take a closer look at their situation.
7. Right to be forgotten: This right allows users to ask for their personal data to be deleted, which can be helpful if they no longer have a relationship with the company holding their data. However, it's important to remember that this isn't an absolute right and there may be other legal requirements that the company has to follow.
8. Right for data portability: Users have the right to ask for their personal data to be transferred to another controller or provided back to them in a machine-readable electronic format. This can be helpful if they're switching service providers, for example, or if they just want to have a copy of their data for their own records.