Protecting Additive Manufacturing Information When Encryption Is Insufficient

Abstract

Recent research shows that a side-channel attack on a 3D printing process can bypass encryption-based defenses to obtain proprietary design information. This result has critical implications for outsourced additive manufacturing (AM). Three complementary cyber-risk management guidance specifications can help point the way for customers of AM services in protecting against such attacks when the usual defenses are inadequate. This paper provides an overview of the three specifications, discussing what each provides. It then shows how the technology-agnostic specifications can be used in conjunction with attack taxonomies and threat classifications from the AM security research literature, and knowledge of AM technology, to determine which safeguards to implement to mitigate the risk of a side-channel attack scenario. The takeaway from this investigation is that there is more to AM security than encryption. A risk-based process, supplemented with AM-specific knowledge of the manufacturing process and its security risks, is also needed to help find appropriate alternatives when technical controls are not an option.