How can you improve the security of your electrical control systems for robotics?

Having as-is status and preparing the design to be reached as functionality and accessibility can be step 0 action before having a risk assesment.

Before assessing risks I would start by getting to know my as-built infrastructure by performing a comprehensive asset inventory exercise. With that information, then it is time to set a scope and proceed with the risk assessment activities along with all stakeholders, especially the system owner.

begin by assessing potential threats and vulnerabilities to electrical control systems to understand what we are actually trying to fix. If you do not know what to protect, you will not be able to protect it. Use a security risk assessment framework from NIST SP 800-82 to review system architecture, system components, system functions, interfaces and data flows to discover potential security risks. It helps to determine critical risk scenarios, prioritize those based on the business impact and likelihood that a threat actor would successfully exploit the vulnerability, and determine which risks can be effectively mitigated.

One thing I've found helpful was ensuring your configuration change management process was up to date. This is because configuration management is used to maintain the integrity of hardware, software, and firmware. An example is ensuring the approver is different from the requester, establish baselines, and the right person is authorized to approve. Some ways to ensure the software you are using is secure include validating file hashes, utilizing secure central software repositories, and use of SSL communications for obtaining software updates. Lastly, keep physical security in mind. You can have all the protections and firewalls but if your physical doors are unlocked patches and updates won't necessarily matter.

Implementing authentication and permission are critical stages in improving the security of your electrical control systems. Authentication ensures that individuals and devices attempting to access your control systems are who they say they are. Common forms of authentication include: Username and Password: Users create a unique username and a secret password. Multi-Factor Authentication: Requires more verification than just a password Certificates: Digital certificates authenticate the identity of devices or individuals. Authorization determines which activities individuals or devices can do once authenticated. It sets permissions and access levels based on roles e.g. Role-Based Access Control (RBAC) Attribute-Based Access Control (ABAC)

Simply applying Defense in Depth approach will cover all security areas that required for crucial services like electricity control, defense in depth layers such as security management to control the access and allow authorized persons to access to the control room, physical security to protect against intended or non intended physical damages, network security to close unnecessary network access (if there is a network access to control room) and protect against adversaries threats , also I prefer to use “Air Gap” approach with electricity control rooms.

The number one thing any manufacturing company should work towards is isolating control system networks. Treat your Control Systems as if you were protecting them from the internet. Place a firewall or ACL controlling access to these critical networks.