Layered Security Guidance for Data Asset Management in Additive Manufacturing

TL;DR

This paper proposes a layered, risk-based cybersecurity guidance framework for additive manufacturing, integrating AM-specific data management with existing IT and OT security standards using the NIST CSF and Open Security Controls Language.

Contribution

It introduces a structured layered approach to develop AM-specific security guidance by leveraging the NIST CSF and integrating it with existing standards, filling a critical gap.

Findings

Layered approach enables structured development of AM security guidance.

AM data and asset management are crucial for risk-based security.

Integration with existing standards is feasible and effective.

Abstract

Manufacturing industries are increasingly adopting additive manufacturing (AM) technologies to produce functional parts in critical systems. However, the inherent complexity of both AM designs and AM processes render them attractive targets for cyber-attacks. Risk-based Information Technology (IT) and Operational Technology (OT) security guidance standards are useful resources for AM security practitioners, but the guidelines they provide are insufficient without additional AM-specific revisions. Therefore, a structured layering approach is needed to efficiently integrate these revisions with preexisting IT and OT security guidance standards. To implement such an approach, this paper proposes leveraging the National Institute of Standards and Technology's Cybersecurity Framework (CSF) to develop layered, risk-based guidance for fulfilling specific security outcomes. It begins with an in-depth literature review that reveals the importance of AM data and asset management to risk-based security. Next, this paper adopts the CSF asset identification and management security outcomes as an example for providing AM-specific guidance and identifies the AM geometry and process definitions to aid manufacturers in mapping data flows and documenting processes. Finally, this paper uses the Open Security Controls Assessment Language to integrate the AM-specific guidance together with existing IT and OT security guidance in a rigorous and traceable manner. This paper's contribution is to show how a risk-based layered approach enables the authoring, publishing, and management of AM-specific security guidance that is currently lacking. The authors believe implementation of the layered approach would result in value-added, non-redundant security guidance for AM that is consistent with the preexisting guidance.