Cybersecurity Is a Lifecycle, Not a Feature

Connected critical systems are evolving rapidly. More interfaces, connected equipment and data exchanges create new operational possibilities. They also make cybersecurity an increasingly important architectural consideration. 

For critical automation systems, cybersecurity cannot simply be added at the end of product development. It needs to be considered throughout the architecture and across the product lifecycle. At LEROY Automation, this means combining secure development practices, architecture choices, controlled communication boundaries, vulnerability management, secure updates and long-term product support. 

Cybersecurity begins before the product is connected 

A system does not suddenly become a cybersecurity concern when it is connected to a network. Cybersecurity decisions begin much earlier. They influence the way products are developed, systems communicate and network domains are connected. 

• Which systems need to communicate? 

• Which information needs to move between network domains? 

• In which direction should this information travel? 

• How should communication boundaries be controlled? 

• How will cybersecurity be managed throughout the operational lifecycle? 

Addressing these questions early helps make cybersecurity part of the architecture rather than an additional layer introduced later. 

Controlling communication boundaries with DataDiode DTD 

In some critical architectures, information needs to leave one network domain without creating a bidirectional communication path. Unidirectional communication can then become an architectural mechanism. 

The LEROY Automation DataDiode DTD provides hardware-enforced unidirectional communication between network domains. It is IEC 62443-4-2 SL3 certified and EN 50155:2021 compliant, providing a physical mechanism for controlling one-way data exchange. 

Security by design 

Cybersecurity also concerns the way connected automation products are developed. LEROY Automation applies an IEC 62443-4-1 compliant development process, independently certified in 2024. 

For BRIO, independent assessments have included an IEC 62443-4-2 gap analysis confirming alignment with Security Level 2 requirements, an embedded software security review and penetration testing. 

Cybersecurity continues after delivery 

Critical infrastructure can remain operational for many years. During this period, software, vulnerabilities, components and system architectures may evolve. Vulnerability management, secure update strategies and lifecycle support therefore become part of maintaining cybersecurity over time. 

From feature to engineering discipline 

The question should no longer simply be “Is this product secure?” A broader question is “How is cybersecurity addressed throughout the architecture and its lifecycle?” Cybersecurity is not simply a feature. It is an engineering discipline that accompanies the system throughout its lifecycle.