Cyber security: A standard CMDB data model for pharmaceutical manufacturing shop floor systems

Through a compare and share process, the BioPhorum Cyber Security members have asked the questions “what are our peers doing?” and “what are they doing about these same problems?”

This paper looks to address two specific problem statements of:
1. The asset cybersecurity risk is hard to assess, and take action when the CMDB does not contain appropriate OT data and information.
2. Current asset data collection tools and processes cannot effectively track and maintain OT information in a common and standard way.

To address the above problem statements, the BioPhorum Cyber Security members propose a standard way for manufacturing companies to describe the assets on the shop floor. The term ‘shop floor’ is used to describe IT assets such as computers, servers, Programmable Logic Controllers (PLC), Human Machine Interface (HMI) and other IP-enabled equipment used at manufacturing sites in the production and analysis of products. The information model typically used by the standard CMDB installation is based on the idea that all systems used by the enterprise are software based and are described by a class of objects called an application. This does not always align to the needs within an OT environment.