Securing Manufacturing through Patch Management for IoT Devices

IoT devices bring new opportunities for manufacturing but the difficulty in patching poses cybersecurity risks for manufacturing. To remove the possible risks, we identify assets by marking the patch status of devices, classify them, and establish a patch management list for monitoring purposes. A mitigation plan is also developed in situations where devices cannot be patched due to the lack of standardization, complexity in system integration, and dependencies on other devices. In this study, we present a patch management procedure for a service provider. The procedure allows patching under the supervision of the asset owner and the service provider to meet the requirements of IEC 62443-2-4. Through the patch management procedure, we reduced cybersecurity risks and ensured production availability. Finally, we obtained the IEC 62443- 2-4 certification, demonstrating the effectiveness of the proposed patch management procedure. Overall, this approach ensures cybersecurity and productivity and reduces maintenance costs.