Cyber security at ELHA

This page has been translated automatically.

Modern machine tools are networked: they provide data for condition monitoring and production planning, receive updates and can be maintained remotely. This makes manufacturing more efficient, but also places new demands on security. An attack on a machine control system can not only compromise data, but also halt production or put people at risk. That is why cyber security is an integral part of our product development process.

Our approach

We take security requirements into account right from the start when developing our machines, control systems and software. This includes a secure development process, the protection of control programmes against unauthorised access and modification, and the regular testing of software components used for known vulnerabilities. Should any security vulnerabilities come to light, we provide updates for supported products and inform affected customers via our security advisories.

What you, as an operator, can do

Security is a shared responsibility between the manufacturer and the operator. We recommend operating machines on a production network that is separate from the office network, only permitting remote access via secure connections that are activated as and when required, changing default passwords, and installing updates promptly as they become available. Our service team will be happy to assist you with the secure integration of your machines into your IT environment.

Have you found a security vulnerability?

If you have discovered a potential vulnerability in one of our products or services, please report it to cra@elha.de. For confidential reports, you can use our PGP key:

Key: https://elha.de/.well-known/pgp-key.txt
Fingerprint: 55C84D85E8E2DBAE9ADCEFEC5853F383B89F50CE

Our policy on reporting security vulnerabilities sets out how we handle reports and what we expect from those who report them. Our contact details are also available in machine-readable form in our security.txt. We would like to thank everyone who is helping us, in a responsible manner, to make our products safer.

With the Cyber Resilience Act (CRA), the European Union has introduced mandatory cybersecurity requirements for products containing digital elements. We actively implement these requirements for our products, including through a robust process for managing vulnerabilities, the provision of security updates throughout the 10-year support period, and the timely reporting of actively exploited vulnerabilities to the relevant authorities.

You will find the public ELHA Security Advisories here.

The security of our machines, software and online services is a top priority for ELHA-MASCHINENBAU. We welcome feedback from security researchers, customers and partners that helps us identify and rectify vulnerabilities.

Scope: This policy applies to software and firmware in ELHA machine tools and their control systems, to our IIoT software, and to web services on elha.de and its subdomains. Products from third-party manufacturers (e.g. control components from suppliers) are not covered; please report these directly to the relevant manufacturer. If you are unsure, please feel free to report them to us anyway; we will pass them on.

How to report a vulnerability: Send your report to cra@elha.de, preferably encrypted using our PGP key (https://elha.de/.well-known/pgp-key.txt). It would be helpful to provide details of the affected machine or software, including the version; a description of the vulnerability and its potential impact; steps to reproduce the issue; and your contact details, should you wish to be named.

What you can expect from us: We will acknowledge receipt within 5 working days, assess the report and inform you of the next steps. We will keep you updated on progress and agree on a publication date with you. As a rule, we aim to publish updates within 90 days of receipt; however, for machines in the field, the roll-out of updates may take longer, in which case we will agree an appropriate timeframe with you. We report actively exploited vulnerabilities to the relevant authorities in accordance with our legal obligations.

Please note: Do not carry out tests on machines that are in production, particularly those belonging to our customers. Interfering with machine control systems may endanger people and cause damage to property. Refrain from carrying out denial-of-service attacks, social engineering, phishing and physical attacks. Only access data to the extent necessary to demonstrate the vulnerability, and delete any data obtained once the test is complete. Do not publish any details until you have consulted with us.

Legal assurance: Provided you act in good faith and in accordance with this policy, we will not take legal action against you.

Rewards: We do not currently run a bug bounty programme and do not pay any rewards for reports.