Change Management Automation.

In the late 90s, Change Management was understood as making backups and keeping them organized. Ethernet networks in production were in their infancy, engineers and IT did not communicate, there was no operations technology (OT) as such, and there was no disaster recovery plan. It may seem like an exaggeration, but at that time there were cases such as a large utility company contacting the owner of a systems integration company, now defunct, to recover a PLC program from the storage room.

The Pioneers.

The adoption of Ethernet technology as a communications network for data acquisition was key to the evolution of Change Management systems. It was no longer necessary to trust that the copies of the PLC programs stored on the server were the latest; every night it was possible to check if they were with automated and planned comparisons. The first to adopt Ethernet as a communications standard were the automotive sector, airports for their baggage management systems, and manufacturers of fast-moving consumer goods (FMCG). They quickly saw the advantages of Change Management software, since they all have in common a downtime associated with very large potential losses.

Open Standards.

PLC manufacturers were reluctant to add Ethernet options, each promoting their own network connectivity solution. To accelerate the number of PLCs connected to Ethernet, Ethernet Device Servers appeared. In this way, PLCs could be connected to the Ethernet network through the serial programming ports. Later, it would be even more important for data acquisition when the OPC (Open Platform Communication) standard appeared.

For a long time, the production/process network was separate from the business network. But it was not going to be like this forever due to the great benefits for business management that real-time production data could provide. Connecting these two networks, IT / OT, is still today one of the technological challenges in which many companies find themselves.

Industry 3.0

The architecture of Change Management systems evolved when these two networks came together. Production networks had to assimilate the rules of the IT world. Independent “islands” of automation with duplicate IPs caused real headaches. Stopping production lines that operated 24 hours a day, 7 days a week, needed a good justification of their benefits.

Connecting to the automation layer led to a series of problems with old equipment and operating systems that could not be updated. Even today, in 2021, we find ourselves in situations of this type. With the advancement of technology and the increase in digitization, it will be a continuous journey for many.

Introducing IT policies in the automation layer could not end well for anyone. Engineers needed administrator rights and to update systems to support the latest network standards. The work required was prohibitively expensive or directly impossible. This is how OT Cybersecurity was born, and Change Management systems were integrated into the Cybersecurity strategy of companies.

Recovery, one of the 5 pillars of any company’s Cybersecurity policy

Maintain Order.

The good practices of making backups knowing who did what, where, when and why, have not changed. But today, with the critical importance for a company of having Cybersecurity strategies, Change Management software has evolved. Whether due to a malware attack, human error, or simply a hardware failure, it is critical to have a disaster recovery procedure to ensure timely restoration of the operating system. The planning of automated comparisons and making backups when differences are found ensures that the latest version has been saved securely and is ready to be deployed immediately.

Change Management software can also help in situations of Stuxnet-type attacks, where industrial systems are reprogrammed, detecting any changes in the code of PLCs or the SCADA system. Additionally, weaknesses in PLC Cybersecurity can be identified thanks to the functionality of generating reports of deployed hardware/firmware versions.

Legislation.

The European directive (Network and Information Systems Directive, EU 2016/1148) has forced utility companies, transportation companies, among others, to evaluate their automation systems from a Cybersecurity point of view. In this sense, Change Management solutions play a fundamental role in complying with the requirements of the directive, especially in Objective B.

Change Management is only part of a fully integrated Cybersecurity solution. If you do nothing else to protect your OT assets, then make sure you can recover from a data loss of your critical assets.

Contact us and we will explain how to protect your operations.