One of the latest EU regulations is the Cyber Resilience Act (CRA). This act aims to strengthen the cybersecurity of connected products. The CRA applies to all products with digital components that communicate with each other and obliges producers to ensure a high level of security from the outset.
This includes a detailed risk assessment, the consideration of cyber risks right from the product development stage, as well as the obligation to make products secure by default and updatable. In addition, the CRA requires that critical security incidents and exploited vulnerabilities are reported within 24 hours and remediated quickly through updates.
This poses far-reaching challenges for machine manufacturers and suppliers. Making existing products CRA-compliant can involve considerable effort – in some cases it is not possible at all. The consequences of non-compliance are serious: large fines of 5 to 15 million euros or up to 2.5% of the total annual worldwide turnover, whichever is the higher.
In addition, a non-CRA-compliant product that poses a significant cybersecurity risk may be withdrawn from the market or its deployment restricted or forbidden. However, formal infringements – such as missing or incorrectly affixed CE marking or incomplete technical documentation – can also result in sanctions even when there is no direct risk.
The CRA thus makes cybersecurity mandatory – act early to be on the safe side.
Maintaining CRA compliance – what does it mean?
Machine manufacturers must take security measures into account from the outset to minimize cyber risks and comply with legal requirements:
✔ Product-level risk assessment
✔ Taking cyber risks into account during development
✔ Products must be secure by default
✔ Remediate vulnerabilities promptly with updates
✔ Plan for updatability during the development process
✔ Establish a software update management system (SUMS)
Bosch Rexroth is a pioneer when it comes to cybersecurity in automation and relies on the highest security standards – from encrypted data transmission to secure software updates.
✔ Secure by design and secure by default
✔ Protects data that is saved, transferred or otherwise processed
✔ Provides a platform to issue and apply security patches without delay and side effects
✔ Is robust and resilient
For example, ctrlX OS runs on the control system ctrlX CORE from Bosch Rexroth. ctrlX CORE is designed for maximum cybersecurity thanks to secure by default and secure by design IoT integration, and through compliance with international standards. Data is protected by strong password rules, up-to-date software, secure deployment of updates, encrypted Internet connections via VPN, as well as authentication and authorization.
The control system can be easily extended at the push of a button with additional security applications from the ctrlX OS Store. For example, with the Firewall, VPN Client, and Security Scanner apps.
Do you have any questions or comments about the ctrlX OS security features.
The following solution sets, which also contain solutions from ctrlX World partners, ensure quick and reliable implementation as ready-made complete packages:
With MB Connect Line combined with ctrlX CORE and the VPN Client, machine controls can be securely and remotely debugged, reset, and maintained. The how-to guide provides simple steps to set up Internet connectivity, IP forwarding, VPN configuration, and certificate installation for fast and reliable remote access.
The first no-code industrial IoT connector especially for modern machine manufacturers. ctrlX OS devices connect directly to the IXON Cloud. Features such as VPN remote access, encrypted data streaming, intuitive data visualization, alarm messages, and user management enable optimized remote maintenance and data-based service optimization – all without any additional hardware.
The PRTG monitoring solution from Paessler GmbH for OT, IT, and IoT monitors all aspects of an OT infrastructure and creates a central overview. It alerts users to problems, simplifies fault detection, and reduces or eliminates downtime. In addition, dashboards and reports can be created and data and alerts can be supplied via OPC UA to control systems such as SCADA or ctrlX OS.
The control system ctrlX CORE demonstrates its strengths in terms of security to the full. Thanks to its secure design, from the ground up, as well as compliance with international standards and the certified operating system ctrlX OS, the control system inherently offers the highest level of cybersecurity. It can also be used as a security gateway.
✔ Secure by default
Encrypted data transmission, minimum network footprint
✔ IoT integration with security by design
Compliant with IEC 62443-4-2 SL2
✔ Secure update deployment
Rexroth Store, ctrlX Device Portal Premium
✔ Flexible IT security configuration
Sessions and password rules, service configuration, etc.
✔ Functionality can be extended
With additional security apps from the ctrlX OS Store
Get your manufacturing CRA ready.
„Openness is everything“ – this is the motto of the ctrlX AUTOMATION magazine 2023/2024. This year, it´s all about openness and co-creation, which enables a completely new world of automation. Furthermore, there will be innovations of the product portfolio, exciting case studies and expert opinions on digitalization and connectivity.
More information!
