The Critical Need for Cybersecurity in Non-Road Equipment

By Gregg Wartgow, Special to AEM

As the landscape of non-road equipment evolves with technological advancements and increased automation, the importance of cybersecurity has surged. Manufacturers, dealers, equipment owners, and various stakeholders are prioritizing the safeguarding of machinery and the sensitive data it generates.

Diverse Data: Responsibilities and Challenges

Navigating the complexities of data protection in non-road equipment involves understanding its various forms and locations. Who holds the responsibility for securing data when it’s stored directly on a machine? What about when it’s being sent to cloud storage? Or when it’s housed within fleet management software?

Erica Baird, the executive director for global sales and service at Cummins, a member company of AEM, emphasizes that “as equipment becomes more connected, the risks associated with machine data access and integrity have grown significantly.” This highlights the urgent need for a unified framework to guide manufacturers and stakeholders in shielding machine data effectively.

The Framework for Cybersecurity: AEM’s Guidance Document

To address these concerns, AEM’s Technology Leadership Groups in agriculture and construction have collaboratively produced the document “Cybersecurity for Machine Data for Non-Road Equipment.” Released in May, this guidance aims to foster a common vernacular surrounding cybersecurity, data, and autonomy within the industry.

Seth Zentner, an engineer with CLAAS of America and Vice Chair of AEM’s Ag Technology Leadership Group, noted, “We wanted to create a document people could have a conversation around.” Targeting a broad audience, the document is designed to be accessible, even to those with limited cybersecurity expertise.

Baird clarifies that the guidance is not about a one-size-fits-all approach; rather, it aims to lay the groundwork for cohesive cybersecurity practices in the non-road equipment sector. “Laying the groundwork for these topics now will facilitate even more in-depth discussion in the future,” she states.

Understanding Machine Data: What Needs Protection?

Machine data encompasses an array of information generated by equipment during operation. This includes GPS location, operating hours, diagnostics, fault codes, performance metrics, and sensor readings. Some machines, particularly in agriculture, even gather agronomic data from various terminals or devices.

“It’s crucial that all this data, whether transmitted or not, be protected,” says Zentner. The diversity and complexity found within machine data necessitate tailored security protocols at each stage of its lifecycle.

Baird elaborates, “AEM’s cybersecurity guidance document summarizes all the steps machine data must traverse as it moves from the equipment through various systems.” Understanding unique cybersecurity concerns is essential as data moves across different platforms.

Levels of Data Access and Control

The guidance document outlines three specific levels for consideration:

1. On-Machine: This includes data directly sourced from sensors or electronics on the equipment itself.

2. Data Transfer: This stage focuses on the movement of data to cloud or on-premise servers.

3. Off-Machine: This encompasses cloud systems, analytics platforms, or third-party management systems.

Baird emphasizes the significance of robust data access protocols. “Permissions-based authentication ensures only trusted users and systems have access to sensitive machine data.” This foundational approach is pivotal for maintaining cybersecurity across all levels.

Responsibilities Across the Data Lifecycle

AEM’s guidance clarifies the roles expected of different stakeholders at various points of the data lifecycle. For example, original equipment manufacturers (OEMs) are responsible for security patches on on-machine systems, while platform providers handle off-board recovery and updates. Baird underscores, “This clarity encourages proactive planning in a multi-stakeholder environment.”

Zentner adds another layer by noting the importance of including cybersecurity measures within contracts with suppliers and data transfer providers. Clear responsibilities help mitigate risks and promote collective accountability.

Why Cybersecurity Is Essential

Understanding why cybersecurity planning is vital can be illustrated through real-world scenarios:

• On-Machine Concerns: If unauthorized firmware is introduced to a machine, the consequences could jeopardize operational safety. The threats may vary by equipment type; for instance, the risks posed to a complex tractor differ from those associated with simpler machinery.

• Data Transfer Risks: Unsecured channels may allow for data interception or alterations in transit, potentially compromising sensitive operational data. Organizations need to implement safeguards ensuring the integrity and confidentiality of data during its transfer.

• Off-Machine Vulnerabilities: Lack of access controls on remote platforms can lead to unauthorized manipulation of fleet data. For large fleets interacting across disparate platforms, ensuring data integrity during arrival at its destination is crucial.

Leveraging Existing Standards

Zentner highlights the importance of awareness regarding existing standards that shape non-road equipment cybersecurity efforts. Standards such as ISO 24882 for on-machine data and ISO 27001 for off-machine frameworks are integral to AEM’s guidance.

“By referencing them, AEM provides its members with established frameworks that can be adapted to specific needs,” Baird explains. This guidance serves as a starting point for organizations seeking to enhance cybersecurity measures.

Members of AEM can utilize this framework to evaluate their existing practices critically. Questions like “Do we have clear roles defined?” and “Are our access controls robust?” can guide improvements in governance and technical controls, fostering ongoing education within the industry.

AEM’s Up-to-Date Guidance for Stakeholders

AEM has released a trio of guidance documents to promote a shared language on topics such as cybersecurity, autonomy, and data within the non-road equipment industry. These documents, available on AEM.org, are designed to serve as consensus resources, facilitating informed discussions and communications among stakeholders in this ever-evolving field.

Through such initiatives, AEM aims to equip its members to better articulate and implement cybersecurity best practices, ensuring the resilience and integrity of non-road equipment in a connected world.