The DOE-Funded Institute Working to Make Manufacturing More Secure

CyManII, the Cybersecurity Manufacturing Innovation Institute, is on a mission to help U.S. manufacturers increase their awareness of and security around data critical to their manufactured parts and manufacturing processes — but to do this in a way that promotes productivity rather than hindering business activity.

“We should be the brakes on the car,” says Brian Luffy, director of engineering for CyManII (pronounced like “si-man-ee”). “The brakes are there to let you go fast safely.”

Funded by the Department of Energy (DOE) and led by the University of Texas San Antonio, CyManII has three main pillars of activity: education, which ranges from basic cybersecurity hygiene to full operational technology (OT) training; security innovations it is developing for business adoption; and work with OEMs to establish best practices and security features that can be baked into new equipment from the outset. Its work is about being forward-looking in terms of protecting manufacturing — not just from cyber attacks, but also from inefficiencies and supply chain vulnerabilities.

Case in (Pain) Point

While CyManII works with manufacturing companies broadly (key partners include GE and Siemens, along with a number of universities), it is getting underway with at least one additive manufacturing partner. This company, a supplier of 3D printed tooling in the Midwest, had been struck twice with ransomware attacks and connected with the institute for help preventing future attacks. Along with addressing the company's overall OT infrastructure and vulnerabilities, CyManII is working to integrate inexpensive sensors into its existing systems; adding these devices will help the manufacturer optimize operations while also providing cybersecurity solutions as a co-benefit. 

The AM company, for instance, revealed that the cost of replacing a linear actuator in one of its printers is in the neighborhood of $25,000. CyManII is working to implement off-the-shelf sensors on the actuators that would alert the user to wear and support a predictive maintenance schedule rooted in real-time data; replacing a component when it is close to failure (rather than at standard intervals) could save money in the long run. But if the performance of these actuators can be tracked, there are potential security benefits as well. Actuators operating as expected can be indicators that machines are making what they are supposed to be. Tying back to the institute's DOE roots, such sensing systems can also be used to monitor energy performance and improve efficiency.

It’s all about addressing pain points, Luffy says. Manufacturers might be unwilling to alter their machines for the sake of security alone, but the chance to better monitor wear components offers a compelling value-add. By providing solutions for predictive maintenance that promote machine uptime, CyManII can simultaneously help to protect the machines from manipulation.

Securing Digital Manufacturing

Other innovations the institute is working on include a cyber-physical passport that can be used to track part provenance from material through production (whether through AM, machining or some other method) and delivery. The passport is ledger-based and, through encryption, can selectively reveal information to the parties that need it, protecting an OEM’s IP while still allowing it to securely make use of outside service providers.

As the most digital manufacturing method to date, AM is likely to be used by the companies most disposed to begin implementing data security measures.

There is no specific process focus in CyManII’s activities. The organization seeks to help all types of manufacturers in the U.S., especially small to medium businesses that may not have the resources to integrate security and efficiency solutions themselves.

However, as the most digital manufacturing method to date, AM is likely to be used by the companies most disposed to begin implementing these measures. 

Speaking from experience working with ransomware victims, Luffy says, “Everyone learns a lot when they don’t have access to their data. Manufacturing businesses depend on data more than they might think.”

Because AM was digitized from the get-go, CyManII has more telemetry available than for traditional manufacturing, he says. But there is a mindset difference as well; additive manufacturers are used to thinking digitally and anticipating how data affects real-time part production, which is a good first step toward securing vulnerabilities.

“Understand your data,” Luffy recommends. “Understand what it is, where it lives, and how it moves from place to place. Then think about what would be valuable or damaging if it were released.”