Implementing the Risk Management Framework for Additive Manufacturing Security: A Model-Based Approach

Abstract Metal additive manufacturing machines are complex and inherently digital and often cyber-physical systems. As the adoption of this manufacturing technology increases and it becomes increasingly industrialized, concerns about security are evermore prevalent. Both cyber and non-cyber related attacks on critical infrastructure such as additive manufacturing production systems are causes for concern for industry and government. Both the public and private sectors need to focus on securing their information systems to reduce the risk of security attacks and their adverse effects. This research aims to apply the National Institute of Standards and Technology’s Risk Management Framework to the metal additive manufacturing production scenario. The Risk Management Framework defines a rigorous, yet flexible and repeatable, process for managing security risk. A model-based assessment approach is proposed to leverage the digital nature of this manufacturing technology. A case study is performed to demonstrate this approach for a commercial laser powder bed fusion machine in its operating environment. This case study focuses on the technological security risks. This study demonstrates how a model-based approach maximizes the benefits of the Risk Management Framework by improving information and decision traceability for addressing metal additive manufacturing security risks.