Cybersecurity, Safety, Ethics and Governance

Introduction

Mechanical engineering systems are increasingly connected through industrial networks, cloud platforms, digital twins, mobile applications and artificial-intelligence services. A modern production cell may contain programmable logic controllers (PLCs), robots, sensors, variable-frequency drives, safety instruments, cameras and enterprise software. These connections create operational value, but they also create pathways through which an attacker, software defect, biased model or poorly governed data practice can cause physical harm.

Cybersecurity in mechanical engineering is therefore not limited to protecting information. It includes protecting people, equipment, production continuity, product quality, intellectual property and the environment. The central engineering question is not merely whether a system can be attacked, but whether a foreseeable failure or attack can lead to an unacceptable consequence and whether the system can detect, contain and safely recover from it.

This chapter develops a systems approach to cybersecurity, functional safety, ethics and governance for connected mechanical systems. It addresses threat identification, secure-by-design practices, access control, encryption, network segmentation, risk assessment, privacy, bias, explainability, accountability, standards and regulatory responsibilities.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Identify common cyber threats to connected mechanical and industrial systems.
2. Explain secure-by-design principles, identity management, encryption and network segmentation.
3. Conduct a structured cybersecurity and safety risk assessment.
4. Distinguish cybersecurity, functional safety, reliability and resilience.
5. Evaluate privacy, bias, explainability and accountability in engineering AI applications.
6. Relate engineering practice to standards, legislation and organizational governance.
7. Recommend proportionate controls for a connected mechanical system.

1. The Cyber-Physical Nature of Mechanical Engineering

A cyber-physical system combines physical processes with computation, communication and control. In a manufacturing system, a sensor measures temperature or position; a controller evaluates the measurement; an actuator changes speed, force or motion; and supervisory software records the result. A cyber event can therefore become a physical event.

Examples include:

• falsified vibration data causing unnecessary maintenance or missed faults;
• unauthorized changes to robot speed or workspace limits;
• ransomware disabling production scheduling and maintenance systems;
• manipulation of a digital twin used for engineering decisions;
• a compromised remote-access account used to alter a PLC program;
• an AI inspection model accepting defective components because its training data no longer represent current production.

The principal security objectives are commonly expressed as confidentiality, integrity and availability (CIA):

For safety-related systems, additional properties are essential: authenticity, traceability, fail-safe behaviour, determinism, maintainability and recoverability. Confidentiality may be less urgent than integrity and availability during an emergency, while intellectual-property protection may make confidentiality strategically important in normal operation.

2. Threats, Vulnerabilities and Consequences

A threat is a potential cause of an unwanted event. A vulnerability is a weakness that can be exploited or triggered. An asset is something requiring protection, such as a robot controller, safety program, sensor dataset, design file or human life. A consequence is the resulting harm or loss.

Threats may be classified by origin:

• External malicious threats: internet-based attackers, criminal groups and state-sponsored actors.
• Internal threats: malicious insiders, negligent users or misuse of legitimate privileges.
• Supply-chain threats: compromised firmware, counterfeit components, malicious updates or insecure vendor support.
• Accidental threats: configuration errors, incorrect software updates, electromagnetic interference or cable damage.
• Environmental threats: fire, flood, power loss and extreme temperature, which may expose or disable digital controls.

Common attack paths include exposed remote desktop services, default passwords, unsupported operating systems, unencrypted industrial protocols, removable media, poorly controlled engineering laptops, flat networks and cloud application programming interfaces.

A useful asset-threat-vulnerability-consequence chain is:

Asset → Threat event → Vulnerability exploited → Operational consequence → Safety, financial or environmental impact

This chain prevents a narrow focus on software weaknesses. For example, “outdated PLC firmware” is not itself the final risk. The engineering analysis must ask what can be changed, whether the change can be detected, whether the machine can enter a safe state and what injury or production loss could result.

3. Risk Assessment for Connected Mechanical Systems

Risk assessment is a structured process for identifying hazards, estimating risk and selecting controls. It should include both accidental failures and intentional cyber events. A practical lifecycle is:

1. Define system boundaries, operating modes and stakeholders.
2. Identify assets, data flows, interfaces and dependencies.
3. Identify hazards and cyber threats.
4. Estimate likelihood and consequence.
5. Select controls according to risk reduction and practicability.
6. Verify that controls work in normal, abnormal and recovery conditions.
7. Monitor, review and update the assessment after changes or incidents.

A simple qualitative model is:

where R is a risk score, P is the estimated likelihood or probability of an unwanted event, and C is its consequence or severity. This expression is a screening model, not a universal physical law. Its use assumes that the chosen scales are defined consistently and that multiplying ordinal scores does not create a false impression of statistical precision. Many organizations therefore use risk matrices, scenario analysis or formal quantitative models instead.

For an event with annual probability p and consequence expressed as an expected monetary loss L, the expected annual loss can be represented as:

Here, EAL and L are monetary quantities per year, while p is dimensionless. This model is useful for comparing alternatives when probabilities and consequences can be estimated, but rare catastrophic events are difficult to estimate reliably. Safety decisions must not be based solely on financial expectation.

A risk register should record the asset, scenario, initiating cause, consequence, existing controls, risk owner, residual risk, required action and review date. Cybersecurity risk assessment should be connected with hazard analysis methods such as failure mode and effects analysis (FMEA), fault-tree analysis, hazard and operability studies (HAZOP) and structured threat modelling.

Worked Example: Remote Maintenance Access

A packaging machine is accessible through a vendor remote-maintenance account. The account is shared by several technicians, uses a static password and permits access to both the engineering workstation and the PLC network.

The scenario is: compromise of the vendor account leads to unauthorized logic modification, causing unexpected actuator movement.

A preliminary five-point matrix assigns likelihood P = 4 and consequence C = 5. The screening score is:

Suppose the organization classifies scores of 15–25 as high priority. The appropriate response is not simply to change the password. Controls should include named accounts, multifactor authentication, time-limited approval, a jump server, network restrictions, session logging, vendor identification, backup verification and an independent safety function that prevents hazardous motion. After implementation, the team must reassess the residual risk rather than assuming that every control is effective.

4. Secure-by-Design Engineering

Secure-by-design means that security requirements are established during concept and architecture design rather than added after commissioning. It resembles safety-by-design: eliminate or reduce hazards at the source before relying on warnings or administrative controls.

Important principles include:

Least privilege

Each user, process and device receives only the permissions required for its function. A temperature sensor should not be able to modify robot programs. A maintenance technician may need diagnostic access but not permission to change safety limits.

Secure defaults

Unused services, ports, accounts and protocols should be disabled. Default credentials must be replaced before deployment. The initial configuration should be restrictive rather than convenient.

Defence in depth

Protection should not depend on one barrier. Authentication, segmentation, application allow-listing, backups, monitoring and physical controls should provide overlapping protection.

Fail-safe and fail-secure behaviour

A machine should move to a defined safe state when a critical control signal is lost. A security mechanism should not create a hazardous condition when authentication or communication fails. The safe response depends on the process: stopping a cutting tool may be safe, whereas abruptly stopping a rotating process may create another hazard.

Secure updateability

Products require signed updates, vulnerability handling, rollback capability and a tested maintenance process. “Never update” is not a security strategy; untested updates are also dangerous.

Secure observability

Events such as logins, configuration changes, firmware updates, safety trips and unusual commands should be recorded with reliable time sources and protected from unauthorized alteration. Monitoring must respect privacy and should collect information proportionate to the purpose.

Resilience and recovery

A system should be able to isolate a compromised component, continue essential operations where safe, restore trusted configurations and learn from incidents. Backups must be offline or otherwise protected against simultaneous compromise, and restoration must be tested.

5. Identity, Access Control and Encryption

Authentication verifies identity; authorization determines permitted action; accountability links an action to a responsible identity. These functions should not be confused. A password may authenticate a user, but it does not decide whether that user may alter a safety program.

Recommended practices include:

• unique user identities rather than shared accounts;
• multifactor authentication for remote and privileged access;
• role-based or attribute-based access control;
• separation of duties for program change and approval;
• time-limited emergency access;
• periodic review of privileges;
• immediate removal of access when personnel or suppliers leave;
• protected service identities for machine-to-machine communication;
• tamper-evident logs and synchronized time.

Encryption protects information in transit and at rest. Transport encryption helps prevent interception and alteration of network traffic; storage encryption reduces exposure if a device or backup is stolen. Encryption does not correct a compromised endpoint, poor key management or an authorized but malicious user. Keys require controlled generation, storage, rotation, revocation and recovery procedures.

In industrial technology, legacy devices may not support modern cryptography. Compensating controls can include a secure gateway, physical isolation, restricted management paths, monitoring and replacement planning. Such controls should be documented as temporary or permanent risk treatments rather than described as equivalent to native security.

6. Network Segmentation and Zero-Trust Concepts

A flat network allows an intruder who compromises one workstation to reach many controllers. Segmentation divides systems according to function and trust. A representative architecture separates:

1. enterprise information systems;
2. an industrial demilitarized zone (DMZ) for controlled data exchange;
3. supervisory control and data acquisition systems;
4. control networks containing PLCs and drives;
5. safety systems and critical physical functions;
6. vendor and maintenance access paths.

Firewalls should permit explicitly required communication, preferably by source, destination, service and direction. Industrial protocols should be documented, and unexpected traffic should generate an alert. Segmentation is not merely a collection of VLANs; effective segmentation requires policy enforcement, monitoring and tested failure behaviour.

Zero-trust security is a useful governance concept: no user, device or network location is automatically trusted. Access is continuously evaluated against identity, device condition, context, authorization and policy. In a time-critical control loop, however, zero-trust mechanisms must be engineered so that authentication delays or service outages do not compromise functional safety.

7. Functional Safety and Cybersecurity

Functional safety concerns the ability of a system to perform actions necessary to achieve or maintain a safe state when hazardous conditions occur. Cybersecurity concerns protection against unauthorized access, disruption, alteration or destruction. They overlap but are not identical.

A safety function may be implemented by a safety PLC, guard interlock, emergency stop, light curtain, speed monitoring device or independent shutdown circuit. Its design must consider systematic failures, random hardware failures, diagnostic coverage, independence and proof testing. Relevant standards may include IEC 61508, ISO 13849 and sector-specific standards. Machinery designers must also consider applicable national legislation and machinery regulations.

A cybersecurity control can support safety by preventing unauthorized parameter changes. Conversely, a safety function can limit the consequences of a cyberattack. However, cybersecurity should not be assumed to provide safety integrity, and a safety circuit should not be assumed to resist cyber compromise. The safety lifecycle and security lifecycle should exchange hazard information, assumptions, test evidence and change records.

When AI is used for safety-related control, caution is essential. An AI model may be difficult to validate across all operating conditions, may fail under distribution shift and may produce outputs without deterministic guarantees. It is often safer to use AI for advisory functions, predictive maintenance or anomaly detection while retaining independently validated conventional safety barriers. If AI directly influences a safety function, the assurance case must address data, model behaviour, uncertainty, failure modes, monitoring, fallback logic and change control.

8. Privacy, Data Governance and Responsible AI

Mechanical systems increasingly collect worker images, voice recordings, biometric information, location data, productivity measures and maintenance histories. Data governance should specify purpose, lawful basis where applicable, minimization, retention, access, accuracy, security and deletion.

Privacy risks include surveillance beyond the stated purpose, re-identification of supposedly anonymous data, inference of health conditions from machine interactions and unfair employment decisions based on incomplete sensor data. A privacy impact assessment is appropriate when processing is extensive, sensitive or likely to affect individuals significantly.

AI introduces additional ethical questions:

• Bias: training data or labels may systematically disadvantage a group, shift or supplier.
• Validity: a model accurate in one factory may fail after a tooling, material or lighting change.
• Explainability: users need a meaningful account of the factors influencing a recommendation, especially when safety, employment or quality decisions are affected.
• Human oversight: operators must have authority, competence and time to challenge automated outputs.
• Accountability: responsibility remains with identifiable people and organizations; it cannot be transferred to “the algorithm.”
• Security: adversarial inputs, poisoned training data and model theft can affect physical decisions.
• Environmental impact: model training, cloud storage and continuous sensing consume energy and resources.

Explainability is not the same as exposing source code. A useful explanation may identify relevant variables, confidence or uncertainty, operating limits, comparable cases and the reason a recommendation was escalated. Explanations should be understandable to the role receiving them and should not encourage unsafe overconfidence.

9. Governance, Standards and Regulation

Governance establishes who decides, who approves, who operates, who monitors and who is accountable. A mature governance system includes a policy hierarchy, asset ownership, risk acceptance authority, supplier requirements, incident escalation, competence requirements, audit, change management and continual improvement.

Relevant frameworks and standards include:

Standards are not automatically laws, and compliance with one standard does not prove that a system is safe or secure in every context. Legal duties may arise from machinery safety law, occupational health and safety law, product liability, privacy and data-protection law, critical-infrastructure requirements, export controls and incident-reporting obligations. Requirements differ by jurisdiction, industry and system role; engineers must obtain current legal and regulatory advice rather than relying on an outdated checklist.

Governance should also cover the supply chain. Contracts should define vulnerability disclosure, security update periods, incident notification, remote access, software bills of materials (SBOMs), support termination, data ownership and evidence of testing. Procurement is a security decision because insecure components can impose risks that operators cannot remove later.

10. Incident Response and Continuous Assurance

No practical system is risk-free. Incident response should define preparation, detection, analysis, containment, eradication, recovery and lessons learned. For a connected machine, the response plan must preserve evidence while protecting people. Immediate priorities may include placing equipment in a safe state, isolating network connections, preventing unauthorized remote access and notifying responsible safety personnel.

A response plan should answer:

• Who can authorize shutdown?
• How is a suspected compromised controller isolated?
• Which backups are trusted?
• How are safety functions verified before restart?
• Who communicates with workers, suppliers, regulators and customers?
• How are logs preserved?
• What conditions permit return to service?

Assurance requires more than a one-time penetration test. It includes code review, configuration review, vulnerability management, threat modelling, security testing, safety validation, restore exercises, access reviews, supplier assessments and monitoring of operational performance. Tests must be planned so that they do not create uncontrolled motion or production hazards.

11. Illustrative Case: Connected Robotic Welding Cell

Background

A manufacturing plant operates a robotic welding cell with a robot controller, PLC, safety light curtains, an industrial camera and a cloud-based production dashboard. A supplier requests remote access for troubleshooting.

Problem

The cell uses a shared vendor account and a permanently enabled modem. Production data are sent to the cloud without a documented retention period. The camera model detects weld defects, but its performance has not been checked after a change in surface coating. The plant network has limited separation between office computers and control equipment.

Analysis

The assets include worker safety, robot programs, production availability, product quality, design data and worker images. Threats include credential compromise, ransomware, unauthorized logic modification, model manipulation and privacy misuse. The most serious scenarios involve unexpected robot motion and acceptance of defective welds.

The assessment identifies interacting risks. A compromised office workstation may provide a path to the PLC network. A false camera result may not directly injure a worker but can cause defective products and loss of trust. Retaining worker images unnecessarily creates privacy exposure. A safety light curtain provides an independent barrier, but its effectiveness depends on correct validation and maintenance.

Approach and Solution

The plant implements named supplier accounts, multifactor authentication, approval-based remote sessions and a hardened jump server. The modem is disabled except during approved service windows. Firewalls separate the enterprise, DMZ, control and safety-related zones. PLC programs and robot configurations are backed up with integrity checks, and restoration is tested.

The AI inspection model is placed under formal change control. Its performance is evaluated using representative data from different shifts, materials, lighting conditions and coating states. Low-confidence results are sent for human inspection rather than automatically accepted. Camera data are minimized, access-controlled and deleted according to a documented schedule.

The safety team independently validates emergency stops, guards and safe-speed functions. Cybersecurity staff monitor authentication, configuration changes and unusual traffic. The supplier contract includes vulnerability notification, support obligations and incident reporting.

Outcome

The cell remains productive while remote maintenance becomes controlled and auditable. The organization reduces the chance that an office compromise reaches the controller, detects model degradation earlier and limits unnecessary personal-data retention. The remaining risks are documented and assigned to responsible owners.

Learning Points

1. Remote access is a system architecture issue, not merely an account-management issue.
2. Safety barriers and cybersecurity controls must be coordinated but separately assured.
3. AI performance must be monitored after process and material changes.
4. Privacy and security requirements begin at data collection, not only at storage.
5. Governance converts technical controls into accountable operating practice.

12. Challenges and Limitations

Security controls can introduce cost, latency, maintenance burden and operational complexity. Legacy equipment may lack authentication, logging or encryption. Excessive access restrictions can encourage unsafe workarounds. Frequent updates can disrupt validated configurations. Monitoring can generate false alarms and overwhelm staff. Risk matrices may conceal uncertainty, while compliance programs can become paperwork exercises.

There are also unavoidable trade-offs. A highly restrictive system may be secure but difficult to recover. A cloud service may improve analytics but increase dependency and data exposure. An explainable model may be less accurate than a complex model, yet its transparency may be essential in a safety or employment decision. Engineers must document assumptions, compare alternatives and involve operators, safety specialists, cybersecurity professionals, legal advisers and affected workers.

13. Best-Practice Design Checklist

Before commissioning a connected mechanical system, verify that:

• system boundaries, assets and data flows are documented;
• hazards and cyber threats are assessed together where they interact;
• default accounts and unnecessary services are removed;
• privileged and remote access use named identities and multifactor authentication;
• networks are segmented with explicit communication rules;
• sensitive data are encrypted where practicable and keys are governed;
• safety functions are independent, validated and tested after changes;
• logs are protected, reviewed and retained for a defined purpose;
• backups and restoration procedures are tested;
• AI models have documented data provenance, limits, uncertainty and human escalation;
• privacy, retention and worker-impact assessments are complete;
• suppliers provide update, vulnerability and incident responsibilities;
• incident response and safe-restart procedures are rehearsed;
• residual risks have named owners and formal acceptance.

Chapter Summary

Connected mechanical systems are cyber-physical systems in which digital compromise, software error or poor data governance can produce physical, economic, environmental and human consequences. Effective protection begins with asset, threat, vulnerability and consequence analysis, followed by proportionate controls.

Secure-by-design practice uses least privilege, secure defaults, defence in depth, segmentation, controlled updates, encryption, monitoring, resilience and recovery. Identity and authorization must be traceable, while remote access and supply-chain relationships require particular care. Functional safety and cybersecurity are related but distinct disciplines; each must be assured using suitable standards and evidence.

Responsible AI requires attention to data quality, privacy, bias, explainability, uncertainty, human oversight and accountability. Governance assigns ownership, defines decision rights, manages suppliers and connects engineering work with standards and legal obligations. Continuous assurance, incident response and tested recovery are necessary because no connected system is permanently risk-free.

Key Terms

Asset: A system, component, data set, capability or person requiring protection.

Authentication: Verification of a user, device or service identity.

Authorization: Determination of which actions an authenticated identity may perform.

Availability: The property that authorized users can access required functions when needed.

Cyber-physical system: A system combining physical processes with computation, sensing, control and communication.

Defence in depth: Use of multiple independent or overlapping protective measures.

Functional safety: Ability of a system to achieve or maintain a safe state in response to hazardous conditions.

Integrity: Protection against unauthorized or incorrect alteration.

Least privilege: Assignment of only the permissions necessary for an approved task.

Network segmentation: Division of a network into controlled zones with restricted communication.

Privacy impact assessment: Structured evaluation of risks arising from personal-data processing.

Residual risk: Risk remaining after controls have been implemented.

Risk register: A controlled record of risks, controls, owners, actions and review status.

Secure-by-design: Integrating security requirements into system design from the beginning.

Supply-chain risk: Risk introduced through vendors, components, software, services or updates.

Threat: A potential cause of an unwanted event or harmful outcome.

Vulnerability: A weakness that can be exploited or triggered.

Zero trust: A security approach that grants no automatic trust based solely on network location.

Review Questions

Short Answer Questions

1. Distinguish confidentiality, integrity and availability in an industrial control system.
2. What is the difference between authentication and authorization?
3. State two reasons why network segmentation improves resilience.
4. Why are cybersecurity and functional safety related but not identical?
5. Name four governance issues that should be addressed in a supplier contract.

Long Answer Questions

1. Explain a complete risk-assessment process for a connected robotic work cell.
2. Discuss how least privilege, multifactor authentication and session logging should be applied to vendor remote access.
3. Compare encryption in transit and encryption at rest, including their limitations.
4. Explain the ethical risks of using worker and machine data in an AI-based productivity system.
5. Discuss how IEC 62443, IEC 61508, ISO 13849 and ISO/IEC 27001 may contribute to assurance without treating compliance as proof of absolute safety.

Analytical / Application Questions

1. A plant has a flat network, shared administrator accounts and an internet-connected engineering laptop. Develop a prioritized improvement plan and justify the order of actions.
2. An AI weld-inspection model performs well during commissioning but its error rate increases after a material change. Analyze possible causes and propose technical, organizational and governance responses.
3. A vendor requests permanent remote access to a machine whose emergency-stop circuit is independent of the PLC. Assess the cyber and safety risks and design a safer access architecture.

Multiple Choice Questions with Answers

Question 1

Which CIA property is most directly concerned with preventing unauthorized modification of a robot program?

A. Confidentiality

B. Integrity

C. Availability

D. Portability

Correct Answer: B. Integrity

Question 2

What is the principal purpose of least-privilege access control?

A. To give every user administrator rights

B. To eliminate the need for authentication

C. To limit permissions to those necessary for an approved task

D. To encrypt all network traffic

Correct Answer: C. To limit permissions to those necessary for an approved task

Question 3

A preliminary risk assessment assigns likelihood P = 3 and consequence C = 4 using the stated screening model R = P × C. What is the risk score?

A. 7

B. 12

C. 16

D. 34

Correct Answer: B. 12

Question 4

Which architecture best limits movement from an enterprise network to industrial controllers?

A. A single flat network

B. A shared wireless password

C. Network segmentation with controlled firewall rules and an industrial DMZ

D. Disabling all event logging

Correct Answer: C. Network segmentation with controlled firewall rules and an industrial DMZ

Question 5

Which statement correctly describes functional safety?

A. It is identical to confidentiality protection

B. It concerns the ability to achieve or maintain a safe state when hazards occur

C. It guarantees that no cyberattack can happen

D. It applies only to cloud databases

Correct Answer: B. It concerns the ability to achieve or maintain a safe state when hazards occur

Question 6

Why should an AI inspection model be reevaluated after a change in material or lighting?

A. The model may experience distribution shift and changed performance

B. Encryption keys automatically expire after every material change

C. Network segmentation stops operating

D. A safety relay becomes a sensor

Correct Answer: A. The model may experience distribution shift and changed performance

Question 7

Which control most directly improves accountability for remote maintenance actions?

A. A shared permanent password

B. Named accounts with session logging

C. Removing all timestamps from logs

D. Allowing anonymous access through a modem

Correct Answer: B. Named accounts with session logging

Question 8

What is a major limitation of the simple model R = P × C?

A. It cannot use any consequence information

B. It is a screening model and may create false precision when ordinal scores are multiplied

C. It always produces monetary values

D. It applies only to mechanical forces

Correct Answer: B. It is a screening model and may create false precision when ordinal scores are multiplied

Question 9

Which practice is most consistent with privacy by design?

A. Collecting unlimited worker images indefinitely

B. Collecting only necessary data and defining access and retention rules

C. Publishing raw sensor data publicly

D. Ignoring the purpose of data collection

Correct Answer: B. Collecting only necessary data and defining access and retention rules

Question 10

What is the central idea of zero-trust security?

A. Trust every device inside the plant network

B. Trust only devices manufactured by one supplier

C. Grant no automatic trust based solely on network location

D. Remove authorization checks for safety systems

Correct Answer: C. Grant no automatic trust based solely on network location