🔐 Cyber Security Revolution in Industrial Sensors from Leuze: CRA Compliant Development!

[Cengiz Özemli]

🛡️ Cyber Resilience Act (CRA) and Industrial Automation​

The Cyber Resilience Act (CRA (EU) 2024/2847), enacted by the European Union, introduces new cybersecurity standards for digital products. This act will be implemented gradually starting in 2026, obliging manufacturers to report serious security incidents, protect their products against cyberattacks, and provide security updates throughout their lifecycle. This regulation, which is of great importance particularly for industrial automation systems, is pushing sensor manufacturers like Leuze to reshape their product development processes.

🚀 Leuze's CRA Compliance Process: A Security-Focused Approach​

Leuze integrated CRA requirements into its product development and production processes at an early stage. The company's many years of expertise in occupational safety (personal protection) facilitated its transition to security processes that protect systems and networks against external attacks. Leuze's key strategies in this regard are:

• Security by Design: Digital products are developed in accordance with the latest cybersecurity standards. The sensor architecture has been strengthened with features such as secure boot and file systems. Uploaded software is verified with security features in the device hardware, and data in sensors is protected against tampering. Additionally, encrypted data transmission is ensured via the communication channels of the sensors.
  
• Security by Default: Factory settings are designed to be cybersecurity-compliant, and all optional interfaces are disabled. Every user access requires authentication. Sensors can be reset to factory settings at any time, and customer data can be deleted.
  
• Updateability: Digital products in operation can be updated according to the latest security standards. Updates are activated via the process interface when appropriate. If an update fails, the system reverts to its previous secure state.
  

💡 Changing Approach in Product Development​

Security considerations are included at every stage of the development process for new sensors:

• Systematic Threat Analysis: A risk matrix is created to examine and evaluate potential attack scenarios.
  
• Minimizing Attack Surfaces: Strict security requirements are integrated from the product development stage onwards.
  
• Providing Security Updates: Lifecycles are defined for the entire service life of the sensors. These lifecycles determine the support period and product succession. Customers are ensured to receive regular updates throughout the planned service life of the products.
  
• Documentation: Comprehensive documentation is created for each product to help customers use the products securely.
  
• Vulnerability Management and Reporting: Processes have been established to identify and manage security vulnerabilities, and rapid reporting in emergencies is ensured within the timeframes specified in the CRA.
  

🤝 Leuze's Support for Customers​

Leuze guides product users through the transition period until the full implementation of the CRA. The sensor manufacturer provides information about the requirements and shares best practice approaches. Customers receive guidance on CRA-related questions (from selecting appropriate products to securely integrating them into existing systems). These services include:

• Customized Consulting: Experts help customers evaluate their systems and components.
  
• Application Recommendations: Specific guidance is provided on how to operate sensors and control systems securely.
  
• Documentation Support: Customers are assisted in preparing the necessary technical documentation.
  
• Information on Reporting Procedures: How to report security incidents and what steps to take in an emergency are explained.