Cybersecurity SEMI Standards

Working towards a secure future

An increasing threat

The size, value, and global importance of the semiconductor industry makes it a high value target for cyber criminals. In recent years, there has been an increasing frequency of high-profile cyberattacks against all levels of the supply chain. The destructive consequences of these breaches include the loss of hundreds of millions of dollars in revenue, factory downtime, unauthorized access, stolen IP, and more.

Future attacks are inevitable and as the complexity of the global semiconductor industry increases, so to do the vulnerabilities that can be exploited. Protecting and securing our industry is a monumental task requiring industry-wide participation and collaboration.

Semiconductor cybersecurity challenges

The interconnected nature and complexity of the global semiconductor manufacturing supply chain leaves it open to cyber attacks. Interdependancy between all tiers of suppliers – some of which may not have the resources to implement robust cybersecurity measures – and factories means that defensive capabilities are only as strong as the weakest link.

Factories are especially vulnerable because of the large size of their attack surface, which is the number of all possible points, or attack vectors, where an unauthorized user can gain access to extract data or cause harm.

Additionally, as factory operations, tools, and the software they run become older or out-of-date, or when threat actors have more time to probe for issues, security gaps may appear revealing vulnerabilities that can be exploited.

In response to these vulnerabilities, SEMI developed and published three cybersecurity Standards, SEMI E187, SEMI E188 and SEMI E191.

Cybersecurity SEMI Standards

SEMI Cybersecurity Standards SEMI E187, SEMI E188 and SEMI E191 were developed to address the two areas where a factory is most at risk:

• The delivery and integration of an infected tool into a factory.
• Unmaintained tools that become vulnerable over time.

SEMI E187: Specification for Cybersecurity of Fab Equipment

SEMI E187 has been developed to provide a baseline level of security for semiconductor fab equipment by addressing required measures for cybersecurity in the design, operation, and maintenance of semiconductor production equipment and automated material handling system.

E187 applies to equipment running Microsoft Windows and Linux operating systems and provides fundamental requirements in the following areas:

Watch our recorded webinar on SEMI E187 by clicking here.

Learn about the PEER E187 Compliance Assessment service offering that helps equipment comply with SEMI E187 by clicking here.

SEMI E188: Specification for Malware Free Equipment Integration

SEMI E187 focuses on overarching view of the equipment’s security needs. SEMI E188 provides a framework for how to mitigate the propagation of malware to manufacturing facilities during tool integration and support activities.

This Standard defines protection systems and processes that ensure the integrity of manufacturing equipment, specifically defining the requirements for:

SEMI E191: Specification for Computing Device Cybersecurity Status Reporting

SEMI E191 describes required cybersecurity status information to be reported for each computing device the equipment supplier provides that connects to the factory network. This information can help factories evaluate the cybersecurity risk the device represents, for example, an End-of-Life Operating System is more vulnerable to malware incidents as it is not receiving security updates from the OS manufacturer.

For the first revision, SEMI E191 requires implementers to report five basic operating system details for each computing device:

Resources

PEER Group leadership

As a Tier 1 supplier with decades of experience developing standards-based software for the semiconductor industry, we believe the development and adoption of cybersecurity SEMI Standards is the best path towards protecting and securing our industry from threats while building resiliency so when attacks do happen, the impact is minimal.

To this end, we are committed to:

• Following internal processes and operations that have always adhered to strict security protocols and procedures to ensure our products and solutions are deployed into the field safely and securely.
• Sharing the internal knowledge we’ve developed over the years with the rest of the industry to strengthen the security and defense of the entire semiconductor supply chain.

Get involved

Factories and OEMs that want to participate in the development of Cybersecurity SEMI Standards are encouraged to join the Semiconductor Manufacturing Cybersecurity Consortium, co-chaired by Doug Suerich, Director of Marketing at PEER Group.