Cybersecurity Standard Compliance in Development of Distributed Embedded Systems

Abstract

In recent years, communication technologies have been actively developed and used in the machinery manufacturing industry. They allow distributed embedded systems to operate more efficiently by remotely interacting with each other and with maintenance systems. However, the ability of machines to communicate through the Internet has increased the number of attack vectors that a potential attacker can utilize. In the lift industry, cybersecurity incidents can lead to a malfunction of lift systems, disruptions to transportation services and irreparable damage to people's lives. The manufacturer can implement security measures from industrial cybersecurity standards to prevent cybersecurity incidents that involve the developed products, to improve security of industrial systems and to ensure safety of their users. Nonetheless, the cybersecurity standards compliance process can be challenging for the product developers. Our intention is to apply this process to the development of distributed embedded systems. In this thesis project, we conducted research on the cybersecurity standards of the IEC 62443 series that are applicable in the lift industry. We analyzed ISO 8102-20 that was published in August 2022 to cover cybersecurity for lifts. We also applied this standard to the development of a prototype of a lift controller in a case study. We document the process of applying ISO 8102-20, present insights into the new standard and underline some areas for improvement.