Industrial cybersecurity has become a critical issue for all stakeholders in the sector.
The rise in connected systems, the convergence of IT and OT environments, and the digitization of production sites are profoundly transforming industrial architectures.
In this context, European regulatory requirements are becoming stricter and demand a more comprehensive approach to cybersecurity.
During a technical workshop focused on cybersecurity challenges in industrial environments held at the Technifutur Competence Center, B2C Engineering was invited to speak on regulations governing systems and machinery.
This was an opportunity to reiterate the importance of securing production systems.
Background in the Industrial Sector
1. Industrial environments that are increasingly at risk
Industrial sites now rely on hybrid architectures:
- Connected PLCs
- SCADA and monitoring systems
- Interconnected production infrastructures
- Remote access for maintenance
- Growing integration of IIoT solutions
This transformation improves operational performance but also increases the attack surface for cyber threats.
ENISA’s analyses confirm that industrial environments are among the most critical targets, due to their direct impact on production continuity and facility security.
2. IT/OT Convergence: A Structural Change
The traditional separation between IT and OT no longer exists in most modern architectures.
Data now flows continuously between production systems and information systems, with growing needs for monitoring and remote access.
This convergence brings operational benefits, but it also introduces new risks:
- An increase in entry points
- More complex network architectures
- Greater exposure to ransomware-type attacks
- Dependence on external interconnections
Cybersecurity must therefore be approached holistically, rather than in isolated silos.
3. Safety and Cybersecurity: A Convergence That Has Become Critical
Historically, safety and cybersecurity were based on two distinct approaches. Today, they have become inseparable.
A cyberattack can directly impact a production system and have physical consequences for the facilities. Conversely, certain design flaws can create exploitable vulnerabilities.
This convergence requires an integrated approach starting from the design phase of industrial systems.
The IEC 62443 standard is now the international benchmark for structuring cybersecurity in industrial automation and control systems.
Two Standards to Strengthen the Industrial Cybersecurity Framework
NIS2: A Strengthened Regulatory Framework for Manufacturers
The NIS2 Directive marks a major turning point in European cybersecurity regulation. It requires:
- Structured cybersecurity risk management
- Appropriate technical and organizational measures
- Mandatory reporting of significant incidents
- Enhanced accountability for senior management
Its impact is particularly significant for industrial environments, where production continuity is critical.
Official source: Commission européenne
Cyber Resilience Act: Cybersecurity by Design
The Cyber Resilience Act (CRA) introduces a foundational approach: security becomes a design requirement for digital products. Manufacturers must now:
- Integrate cybersecurity from the design phase onward (security by design)
- Manage vulnerabilities throughout the product lifecycle
- Ensure products are kept up to date
- Document associated risks
This development directly impacts machine manufacturers, system integrators, and industrial operators.
Official source: Commission européenne
Field Report: Cybersecurity Workshop in an Industrial Environment
As part of its OT cybersecurity activities, our team was invited to speak at a technical workshop focused on industrial cybersecurity regulations. This presentation addressed several key issues:
- Vulnerabilities related to connected devices
- Examples of cyberattacks and responses to threats
- Regulatory requirements and associated responsibilities
- Impacts on compliance and market authorization
These discussions confirm a reality on the ground: cybersecurity is no longer a theoretical topic, it directly affects the availability and resilience of facilities.
Best Practices for Securing OT Environments
Securing industrial environments today relies on a structured, step–by–step approach.
1. Map OT assets and data flows
Precisely identify equipment, dependencies, and data exchanges.
2. Segment IT and OT networks
Limit the spread of incidents and reduce the attack surface.
3. Implement a “security by design” approach
Integrate cybersecurity from the very beginning of machine and system design.
4. Secure remote access
Strengthen authentication and control of external connections.
5. Rely on recognized standards
Notably the IEC 62443 standard, the benchmark for industrial systems.