Layered Security Guidance for Data Asset Management in Additive Manufacturing

Fahad Ali Milaat,Joshua Lubell
DOI: https://doi.org/10.1115/1.4064128
IF: 2.3
2023-11-23
Journal of Computing and Information Science in Engineering
Abstract:Abstract Manufacturing industries are increasingly adopting additive manufacturing (AM) technologies to produce functional parts in critical systems. However, the inherent complexity in AM designs and processes render them attractive targets for cyber-attacks. In addition, the diversity of AM business models and supply chains further increase attack surfaces and impacts. Risk-based Information Technology (IT) and Operational Technology (OT) security guidance standards are useful resources for AM security practitioners, but the guidelines they provide are insufficient without additional AM-specific revisions. Therefore, a structured layering approach is needed to efficiently integrate these modifications with preexisting IT and OT security guidance standards. This paper proposes such an approach, leveraging the National Institute of Standards and Technology's Cybersecurity Framework (CSF) to develop risk-based guidance for fulfilling specific security outcomes. Following an in-depth literature review revealing the importance of AM data and asset management to risk-based security, this paper adopts the CSF asset identification and management security outcomes as bases for providing AM-specific guidance. Furthermore, AM geometry and process definitions are identified in standardized, system-neutral data representations to aid manufacturers in mapping data flows and documenting processes. Finally, the Open Security Controls Assessment Language (OSCAL) is used to integrate the AM-specific guidance with existing IT and OT security guidance in a rigorous and traceable manner. Implementation of the proposed approach would result in value-added, non-redundant security guidance for AM that is consistent with preexisting guidance.
engineering, manufacturing,computer science, interdisciplinary applications
What problem does this paper attempt to address?