# A Review of Industry 4.0 Manufacturing Process Security Risks
## 4 Solutions
### Securing the Manufacturing Information Architecture
#### 4.1.3 Cryptographic Techniques  
Finding widespread use within various IT networks, cryptographic techniques such as encryption algorithms, digital signatures, cryptographic hashing functions and key agreement protocols, have been very successful in securing these networks from various forms of cyber-attack. However, the industrial manufacturing industry has seen little to no presence of these techniques in manufacturing systems networks. This is mainly due to the fundamental differences between IT and OT systems and the underlying platforms, as discussed in Section 2.2.  
Because of the limited processing power of some OT systems, either new cryptographic techniques must be developed, or existing techniques must be adapted to suit the needs and be compatible with the OT systems platforms. First and foremost, the cryptographic techniques must present security that is of sufficient strength to withstand and prevent cyber-attacks, while not inhibiting the core functionality of the platform/system itself. Since some cryptographic techniques require relatively high amounts of processing power, a fine balance must be maintained between the effectiveness of the implemented security measures and the efficiency of the actual process for which the system is designed.  
Data that are transmitted between devices within a manufacturing systems network should ideally be encrypted with encryption algorithms that can reduce the effectiveness of cryptanalysis and attacks that are aimed specifically at breaking the encryption used in such communications. It is also crucially important that the initial configuration and setting up of cryptographic measures, such as the configuration and loading of cryptographic keys, be performed by trustworthy entities by means of processes and procedures that are specifically tailored to ensure that the security configuration of such systems is as secure as possible. Should any step in the security configuration of such systems be compromised, particularly in terms of configuring cryptographic parameters, the effectiveness of the entire security framework would immediately be reduced. If an attacker compromises a network system before or during a security configuration is performed, the attacker could gain access to sensitive security parameters that can be used to bypass these measures during an attack on the network. The use of strict access control mechanisms on these network systems that employ authentication and verification techniques, such as digital signatures, digital certificates and user key sets, can reduce the possibility of unauthorized access to the network and underlying systems. For example, security configuration updates and patches can be digitally signed in order to prove the authenticity of the files. A digital signature involves the use of a key pair consisting of a public key and a private key. The private key is used by the owner of the data to create a digital signature over the data. The data, along with the signature, are transmitted to the receiving party, who can verify the signature by means of the corresponding public key. If the signature cannot be verified, then the data are not authentic, and the source of the data is possibly compromised.  
Security personnel can also be assigned digital certificates that need to be renewed regularly in order to ensure that the persons gaining access to such safety-critical systems are authorized to do so and are trustworthy [3, 8]. Requiring multiple security personnel (instead of only a single person) to be present, and digitally verified to perform any maintenance on the systems, can also reduce the risk of a security breach. The use of secret sharing techniques, such as the Shamir secret sharing scheme [43], can be utilized very effectively in this context.